Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Overview

Loafy is a sourdough guidance application that helps you bake better bread. We believe in privacy by design and collect only the data necessary to provide you with a great baking experience. This privacy policy explains what data we collect, how we use it, and your rights regarding your personal information.

3. Data We Collect

3.1 Without an Account

You can use Loafy's guided baking journeys without creating an account. In this case, we collect:

• Session data: Technical cookies required for the app to function
• Local storage: Your journey progress is stored locally in your browser
• Visitor identifier: A random value in a cookie. It is not your name. It lets us count visits (section 3.6) and keeps an Ask Loafy conversation with you before you have an account (section 3.5)

3.2 With an Account

When you create an account, we collect and store the following personal data:

• Name: Your display name for personalization
• Email address: For account management, login, and optional communications
• Password: Stored securely using industry-standard hashing (never in plain text)
• Marketing preference: Whether you opted in to receive our emails, when you opted in, and on which screen you were asked
• Language preference: Your preferred language setting
• Timezone: For displaying times correctly
• Terms acceptance: Timestamp of when you accepted the terms of service

3.3 Baking Data

When you use the Bake Journal feature, we store:

• Bake logs: Your baking records including recipe parameters, ratings, and notes
• Photos: Images you upload of your bakes
• Journey completions: Records of guided journeys you've completed
• Progress data: Your experience points, streaks, and earned badges

3.4 Session Data

For security purposes, we store information about your login sessions:

• IP address: To detect unauthorized access
• User agent: Browser and device information for security monitoring

3.5 Ask Loafy (AI Chat)

When you ask Loafy a question, we store:

• Your question and Loafy's answer: The text of the conversation, so that you can find your history again and so that we can check the quality of the answers
• Technical details: The AI model used, the book chapters the answer draws on, how long the answer took and what it cost us
• Your feedback: Whether you rated an answer as helpful, and whether you copied it

Conversations you start without an account are linked to the visitor identifier from section 3.1, not to your name. If you create an account later, the conversations you have already had are moved to that account so that your history is not lost. Where your question is sent in order to be answered is described in section 7.1.

If you ask about a bake from your journal, the numbers of that bake travel with the question: the type of bread, the date you baked it, hydration, salt and starter percentages, bulk and proof times and temperatures, how you proofed and baked it, any problems you ticked, and your rating. Sixteen fields in all. Your written notes, your "next time" notes and your photos are never sent.

3.6 Visit Data

To understand how Loafy is used and to keep the service stable, we record for each visit:

• Visitor identifier: The random value from section 3.1
• IP address and the country derived from it
• Browser, operating system and device type
• Referrer and landing page: Which site brought you here and which page you arrived on
• Pages visited: Which pages of Loafy you opened and when

We do not pass this data to advertising networks, we do not use a third-party analytics service such as Google Analytics, and we do not combine it with data from other websites. It is not, however, data that never leaves us: your IP address necessarily reaches Cloudflare, which sits in front of loafy.ai and delivers every request (section 7.4), and in the rare case where Cloudflare has not already told us your country we look it up (section 7.5). Section 7 lists everyone who receives anything.

3.7 Loafy in AI Assistants

You can add Loafy's tools to an AI assistant such as Claude (loafy.ai/claude). The assistant's provider then calls our tools on your behalf and sends us what a call needs, for example the dough amounts to calculate or the words to search the book for. We use this only to answer the call. The tools need no Loafy account.

For each call we store in our database:

• Which tool was called, and whether it found an answer
• The assistant's name for itself, for example "claude-ai", and its version
• The platform the call came from, derived from the provider's network address, and the time

We do not store the words of the request or the network address in our database. Like every request to loafy.ai, the call passes through Cloudflare (section 7.4). What you write to the assistant itself is governed by its provider's privacy policy, for Claude that of Anthropic.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b) GDPR): To provide our service and manage your account, including your Ask Loafy conversation history
• Consent (Art. 6(1)(a) GDPR): For marketing emails (only if you opted in)
• Legitimate interests (Art. 6(1)(f) GDPR): For security, fraud prevention, protection against automated misuse, our own reach measurement (section 3.6), and checking the quality of Ask Loafy's answers

4.1 What the Marketing Consent Covers

If you opt in, we send you emails about Loafy and about The Bread Code. In practice that means product updates and new features in Loafy, and updates from The Bread Code, including announcements of new videos on the channel. Both are brands of Allonsy GmbH, the controller named in section 1. Your address is not passed to any other company for its own advertising.

We do not send anything else on this basis. Emails you receive because you have an account, such as address confirmation and password resets, are not marketing and do not depend on this consent. Withdrawing your consent stops the marketing emails and leaves those account emails untouched.

Consent is never a condition of using Loafy, and the checkbox is never ticked for you. You can give or withdraw it at any time under Profile, or through the unsubscribe link at the bottom of every marketing email. Withdrawal takes effect for the future and does not affect emails already sent.

5. Cookies and Local Storage

All cookies on Loafy are our own. None of them belongs to an advertising network and none of them follows you to other websites:

• Session cookie: Keeps you logged in and enables secure use of the application
• CSRF token: Protects against cross-site request forgery attacks
• Visitor identifier (loafy_visitor_id): A random value, not your name. Once you sign in, the visits it counted are connected to your account (section 3.6). It lets us count visits and keeps an Ask Loafy conversation with you before you have an account
• Bot check (loafy_ask_human): Records that today's bot check (section 7.1) has been passed, so that you are not asked again
• Sign in with Apple (loafy_apple_sign_in): Set only when you choose to sign in with Apple on the website, and deleted when Apple sends you back, or after ten minutes at the latest. It holds a one-time check that Apple's answer belongs to your sign-in, and where to take you afterwards (section 7.2)

We do not use advertising cookies and we do not use a third-party analytics service such as Google Analytics. We use the visitor identifier for our own reach measurement on the basis of our legitimate interest (Art. 6(1)(f) GDPR). You can object to this at any time (section 6), and you can delete the cookie in your browser at any time.

Your journey progress (when not logged in) is stored in your browser's local storage, which you can clear at any time.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your stored data
• Right to rectification (Art. 16 GDPR): You can correct inaccurate data in your profile settings
• Right to erasure (Art. 17 GDPR): You can delete your account and all associated data
• Right to restriction (Art. 18 GDPR): You can request restriction of processing
• Right to data portability (Art. 20 GDPR): You can request your data in a structured format
• Right to object (Art. 21 GDPR): You can object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw consent at any time (e.g., marketing emails)

To exercise your rights, contact us at: [email protected]

You also have the right to lodge a complaint with a data protection supervisory authority.

7. Third-Party Services

7.1 AI Features (Ask Loafy)

When you ask Loafy a question, we send the text of your question to an AI service that generates the answer. For a follow-up question we also send the earlier questions and answers of the same conversation, and if your question comes from a step of a guided journey, the name of that step.

We use OpenRouter, Inc. (USA) for this as an intermediary. OpenRouter forwards the request to a language model provider, which may be located in the USA or in China. We cannot guarantee which provider handles an individual request.

Your question is therefore transferred to countries outside the European Union. For these countries there is no adequacy decision by the European Commission: the level of data protection is not equivalent to that under EU law, and authorities there may have access rights that are broader than under EU law. The transfer takes place on the basis of the standard contractual clauses contained in the providers' terms, and otherwise under Art. 49(1)(b) GDPR, because it is necessary in order to answer the question you asked.

We do not transmit your name, your email address, your account data or your IP address to these providers. What we do send, besides the question itself, is the bake you asked about, if you asked about one: the sixteen fields listed in section 3.5, which include the date you baked. Please do not write personal data into your question either, because we cannot take it back out afterwards.

With every question we ask OpenRouter to use only providers that, by their own declaration to OpenRouter, do not collect the data they are sent. We cannot audit those providers ourselves, so this is an assurance passed on to you as one, not a technical guarantee we are able to make on our own.

OpenRouter and the provider it selects process your question under their own privacy policies. OpenRouter's is here: openrouter.ai/privacy.

If you speak instead of typing, whether a question for Loafy or, in the iOS app, a note on a bake, the recording goes to OpenRouter and is turned into text by OpenAI's gpt-transcribe model running at whichever provider OpenRouter selects. We do not keep the recording: it travels in that one request, and only the text comes back, for you to send as a question or keep as a note. We send the same instruction with it, but we cannot confirm that OpenRouter applies it to transcription, so we make no promise about recordings beyond the one in OpenRouter's own policy. We do not send the recording to OpenAI ourselves and we do not choose the provider.

We store your questions and Loafy's answers as described in section 3.5. The legal basis is performance of the contract for registered users (Art. 6(1)(b) GDPR), because the conversation history is part of the service, and our legitimate interest in the quality and security of this feature (Art. 6(1)(f) GDPR).

Before your first question of the day without an account, we use Cloudflare Turnstile (Cloudflare, Inc., USA, privacy policy) to check that the request does not come from a bot. Cloudflare processes technical characteristics of your browser for this, and we set a cookie (section 5). The legal basis is our legitimate interest in protecting the service against automated misuse (Art. 6(1)(f) GDPR).

Loafy's answers are generated by artificial intelligence on the basis of the book The Sourdough Framework. They can be wrong. Please check them before you follow them through a bake.

7.2 Signing in with Google or Apple

You can create a Loafy account with Google or with Apple instead of a password, on the website and in the iPhone app alike. If you do, that provider tells us who you are and necessarily learns that you signed in to Loafy.

• Google (Google Ireland Limited): we receive your Google account id, your email address, your name and your profile picture
• Apple (Apple Inc., USA): we receive an identifier that Apple issues for Loafy only, the same one on the website and in the app, and that other companies cannot use to recognise you, and an email address. Apple sends us your name only at the first sign-in, and again only if you have removed Loafy from your Apple Account in between, which is why the app may ask you what to call you. Answering is optional

If you use Hide My Email, the address we hold is the relay address Apple generates for Loafy. We never see your real one. Our mail to you passes through Apple's relay, and if you switch the relay off at Apple we can no longer reach you at all.

When you delete your Loafy account we also ask Apple to withdraw your authorization for Loafy, so Loafy disappears from your Apple Account settings. That needs a token Apple hands us when you sign in, which we have only kept since September 2026, and it needs Apple to be reachable at that moment. If your last sign-in with Apple was earlier, or Apple could not be reached, you can remove Loafy yourself: in your iPhone's Settings under your name, Sign-In & Security, Sign in with Apple, or on the web at account.apple.com. The legal basis for all of this is performance of the contract (Art. 6(1)(b) GDPR): it is how the account you asked for gets created.

7.3 Email

Our email is sent by Resend (Plus Five Five, Inc., USA), which receives your address and the contents of the message in order to deliver it. That covers confirmation and password mails, which are part of the contract (Art. 6(1)(b) GDPR), and the baking emails you opted in to, which are consent (Art. 6(1)(a) GDPR) and which you can withdraw at any time from the link in every one of them.

7.4 Cloudflare

Cloudflare, Inc. (USA) sits in front of loafy.ai and delivers every request to it. That means Cloudflare processes your IP address, the page you asked for and technical details of your browser for every single visit, not only when the bot check runs. It is what protects the service from attacks and what makes it fast outside Europe, and there is no way to use Loafy without passing through it. The legal basis is our legitimate interest in a service that stays up (Art. 6(1)(f) GDPR).

7.5 Working out your country

For the visit data in section 3.6 we record which country a visit came from, never a city. Cloudflare usually tells us already, as part of delivering the request, and then nothing else happens. When it has not, we ask ipinfo.io (IPinfo LLC, USA) by sending them the IP address, over an encrypted connection. Their answer also names an approximate city and coordinates; we keep it in our cache for up to a week so that the same address is not looked up twice, and the visit record itself keeps only the two-letter country code.

If you use a Loafy Sense jar, Loafy also suggests how warm your kitchen is likely to be. For that we look up the approximate location of your IP address in the same way, at the level of a city, and ask Open-Meteo (open-meteo.com) for the outdoor temperature there. Open-Meteo receives those coordinates from our server, never your IP address. The legal basis is our legitimate interest in offering the suggestion (Art. 6(1)(f) GDPR), and it is only ever a suggestion you can change.

7.6 Push notifications

If you allow notifications in the iOS app, we send them through Apple's Push Notification service, which means Apple carries the text. A "Loafy has answered" notification contains the question you asked and the opening of the answer, because a notification that said only "you have a new message" would be no use. You can switch these off in the app, and the app is perfectly usable without them.

7.7 Embedded videos

Some pages embed videos from YouTube (Google Ireland Limited), and our video pages show YouTube's preview pictures. The player loads when you scroll to it, not only when you press play, and the preview pictures come from YouTube's servers when the page shows them. From that moment YouTube receives your IP address and technical details of your browser, and can set its own cookies under its own privacy policy.

7.8 Preview images when a link is shared

The picture that appears when a Loafy link is posted somewhere is rendered by ClickMagnet. It is fetched by the social network that shows the preview, not by your browser, so ClickMagnet does not see your visit.

7.9 External Links

Loafy contains links to external resources:

• The Sourdough Framework (the-sourdough-framework.com)
• The Bread Code (the-bread-code.io)
• Discord community chat

These third-party services have their own privacy policies.

7.10 Transfers outside the EU

Several of the recipients above are in the United States, and the AI provider OpenRouter selects may be elsewhere again, including China. For these countries there is no adequacy decision by the European Commission: the level of protection is not equivalent to EU law, and authorities there may have access rights broader than EU law allows. Transfers happen on the standard contractual clauses in those providers' terms, and for the AI request itself additionally under Art. 49(1)(b) GDPR, because sending the question is the only way to answer the question you asked.

The parts of Loafy that need no third party do not use one. Your account, your journal and your photos stay on our own servers.

7.11 Hosting

Our servers are located in the EU and are operated by GDPR-compliant providers.

8. Data Security

We implement comprehensive technical and organizational measures to protect your data:

• Encrypted transmission: All data is transmitted via HTTPS/TLS
• Password hashing: Passwords are hashed using bcrypt
• Access control: Strict access controls for all systems
• Regular updates: Continuous security updates of our systems

9. Data Retention

We retain your data only as long as necessary:

• Account data: Until you delete your account
• Bake logs and photos: Until deleted by you or upon account deletion
• Ask Loafy conversations: With an account, until you delete your account. Without an account, until you ask us to delete them (section 11)
• Login sessions: Until you log out or delete your account
• Visit data (section 3.6): For as long as we need it for reach measurement and for the stability and security of the service

When you delete your account we delete your account data, your bake logs, your photos, your Ask Loafy conversations, your API keys and your place on any mailing list. If you signed in with Apple, we also ask Apple to withdraw the authorization (section 7.2).

Visit records are the one thing that survives, because last March's visitor count should not change because somebody closed their account today. They survive stripped: the IP address, the browser, the operating system, the referrer and the landing page are erased, from your visits and from the visits the same browser made while you were signed out, and all of them move to a new random identifier that neither your account nor your browser holds. What is left is a date, a country, a device type and which pages were opened, without anything in their addresses after the question mark. We keep a record that a deletion happened, which is a keyed one-way digest of the account id and cannot be turned back into it. It exists so we can answer whether an account was erased and when, which is what Art. 5(2) GDPR asks us to be able to do.

You can delete your account yourself, on loafy.ai under your profile or in the iOS app under Settings, Delete account. Either way deletes everything we hold. Deleting in the app also clears what the app kept on your phone: your journal, your photos and your settings. If you delete on the website instead, the app signs itself out, and the copy of your journal it kept on your phone stays there until you delete the app.

10. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. The current version is always available on this page. For significant changes, we will notify registered users by email.

11. Contact

For questions about data protection or to exercise your rights, please contact us: