Privacy policy

What we keep

• Your email address, to sign you in. If you use “Sign in with Apple”, the identifier Apple gives us.
• What you enter about your family: its name, where it lives (Québec or France), your preferred grocery stores if you give them, and for each person a first name or nickname, children’s birth dates, allergies, diet, the “eczema or known allergy” note and the daycare’s name if you write it.
• What you log for each child: the foods tried with the reaction and your notes, the allergens given, your reaction notes, the milestones reached, your questions for the doctor, the answers to the picky-eating quiz and the days ticked, kid mode’s reward and stickers.
• Your meal plans, what is checked on the grocery list and your own items.
• The daycare menus and flyers you confirmed: the dishes, the products and the prices. The photo or PDF is never kept.
• For each automatic reading of a menu or a flyer: who asked for it, the day, whether it worked and what it cost in computing.
• Your questions to a dietitian and their answers, when that service is offered.
• The people you share the family with and their right (edit or view). The secret of an invitation link is never kept in clear.
• If you choose reminders: the delay chosen, the phone’s time zone and the phone’s notification address.
• The date you accepted the medical information notice and its version; the date you finished the introduction.
• A history of who changed what in the family, so that changes made by several people stay consistent.

What we do not ask for

• A child’s last name, photo, address or health insurance number. A first name or a nickname is enough.
• Your location. The app never asks for it.
• A child never has an account. Kid mode holds no link, no purchase and no sign-up.

The website’s waiting list

Before the launch you can leave your email address on our website to be told the day Avo is available. We keep that address, the page’s language and the date, nothing else, and we use it only to write to you once, at launch.

The confirmation email holds a link that removes your address at once; you can also write to us at contact@shadowlabsai.com. In any case an address is not kept on this list for more than 12 months. This list is not an account: it is tied to no family.

Why

Only to make Avo work: adapting meals to each person’s age, allergies and diet, keeping your records, keeping the family’s phones in step and sending the reminders you chose. We sell no data, we show no advertising, and the app holds no advertising tracker and no third-party analytics tool.

By creating an account you consent to this processing for yourself and, as a parent or guardian, for the children you add. You can withdraw that consent at any time by deleting your account.

Who processes this data for us

We use a few providers, each for a single task. Your data is hosted in the United States: it therefore leaves Québec and the European Union.

• DigitalOcean (United States): the servers and the database where all of the above is kept.
• Resend (United States): sending the email that holds your sign-in code. It receives your address and that code.
• Apple: notifications on iPhone. A reminder travels through Apple with the child’s first name and the names of the allergens, nothing else. And Sign in with Apple if you choose it.
• Anthropic (United States): the automatic reading of a photo or a PDF of a daycare menu or a flyer, only when you send one. The document is sent once to be read; we do not keep it, and nothing about your family goes with it.

For how long

Your family’s data is kept for as long as your account exists: it is your notebook, and it does not erase itself. The rest is deleted automatically:

• expired sign-in codes and report or export links: the next day;
• invitations used, cancelled or expired: after 30 days;
• the list of reminders sent: after 90 days;
• the log of automatic readings: after 12 months;
• the history of changes: after 24 months.

Your rights

You can do everything yourself in the app, under “Family and settings”, then “Your data and your privacy”:

• get a copy: a file of everything we keep about you and, if you manage the family, about your family, in a format (JSON) that other services can read;
• correct: each piece of information is changed where you entered it;
• erase a child’s data: from their page, by the parent who manages the family;
• delete your account: it is deleted from our database at once, with the family you manage and everything logged in it. The backup copies held by our host are replaced on their usual cycle.

Security

Exchanges between the app and our servers are encrypted. One family can never read another’s data. Sign-in codes and link secrets are kept in a form that cannot be read back. No method is perfect: if an incident affected your data, we would tell you.

Contacting us, or complaining

The person in charge of the protection of personal information at Shadowlabs answers at contact@shadowlabsai.com.

If our answer does not satisfy you, you can turn to the Commission d’accès à l’information du Québec or, in France, to the CNIL.

Changes

If this policy changes in an important way, the app will tell you before the change applies. The date at the top of the page is that of the last change.