Privacy

Last updated: 15 October 2026

This is a translation for convenience. If the English and French versions differ, the French version applies.

In short

Without an account, everything stays on your device.
With an account, your data is kept on Kibo's server, in the European Union, so you find it on all your devices.
Your health data (weight, pregnancy, allergies, what you eat, your sleep, your water…) goes to the server only if you say yes, and you can say no at any time.
No ads, no ad trackers, no Google Analytics, no data sales.
You can get all your data (export) and erase it all (account deletion), right in the app.

Who is responsible for your data

Alexandre Fievez, sole trader, publisher of Kibo, 3b rue du Cornet, 59320 Haubourdin, France — projectafievez500@gmail.com. On this page, "we" and "Kibo" mean him.

What Kibo does with your data, case by case

1. Kibo without an account

What: Everything you put in Kibo: recipes, weeks, lists, stock, meals, spending, profile, weigh-ins, settings, photos.
Where: Only in your browser, on your device. Nothing is sent to Kibo, except the journey measurement (no. 7), crash reports (no. 8) and the end-of-filling line of the drive (no. 9a), which contain none of this data, and the messages you choose to write to us (no. 13).
How long: Until you erase it: Settings → "Erase everything on this device", or by clearing the site's data in your browser.
Who sees it: Only you. Kibo has no access to it.

2. Your account and sync

What: Your username; a fingerprint (hash) of your password and backup password (never the passwords themselves); your first name, nickname and, if you give it, your last name; the account creation date; your connected devices (their name, sign-in date and last use); and what you put in Kibo: recipes and their photos, weeks, shopping lists, stock, spending and receipts, settings, chosen store and drive, companion. Your Premium trial and subscription, and referrals (who invited whom). Your health data, including logged meals, sleep and water, is only part of it with your consent (no. 3).
Why: To run your account: find your data on all your devices, keep it if you change phones, run shared lists, referrals and Premium.
Legal basis: Performance of the contract (the terms of use).
How long: As long as your account exists. An item you delete in the app is erased from the server at the next sync (only a technical marker with no content remains, so your other devices delete it too). A device unused for 180 days is signed out and forgotten. When you delete your account, everything is erased at once (see backups, no. 11).
Who sees it: You, on your devices. The publisher, who runs the server, could technically read it but does not look at it, except to fix an outage or if you ask. His dashboard does not show this content (see no. 10).

3. Your health data and your consent

What

Pregnancy or breastfeeding (and trimester), being followed for your diet, your weight, height, age, sex, activity level, goal (lose, keep or gain weight), allergies, diet (vegetarian, vegan…), weigh-ins, and the goals calculated from them (calories, protein…). What you eat: the meals marked "eaten" and the extras (bread, fruit, eating out…), with their calories and protein. Your sleep: your wake-up and bedtime hours. Your water: the glasses drunk each day. The same information for the people in your household, if you add them (their first name is not part of it).

Why

To calculate your guidelines (calories, protein, portions), avoid suggesting what is not advised (for example: no "cut" during pregnancy, no dish to avoid when pregnant, no food you are allergic to), and track your weight, what you eat during the day, your sleep and your water if you want.

Legal basis

Your explicit consent (Article 9(2)(a) GDPR), only for keeping it on the server. On your device, it is used to make Kibo work for you.

How it works

When you sign up, a box that is not ticked in advance asks whether your health data may be kept on your account. Accounts that existed before get the same question.
If you say no, it stays on your device only: Kibo still works (My progress, My year and the recap read it on your device), but this data does not move between your devices. Server reminders that need it cannot take it into account: no bedtime reminder (the server does not know your wake-up time), no "your streak ends tonight" alert (it does not know what you ate), and the weigh-in reminder, if you want it, comes every Monday without knowing whether you have already weighed yourself.
You can withdraw your consent at any time, in Settings: the data is then erased from your account on the server and stays on your device. Withdrawing does not make what was done before unlawful.
Your answer (yes or no), its date and the version of the text are kept with your account: it is the proof of your choice. When this text changes (on 13 October 2026, what you eat, your sleep and your water were added), the question is asked again, and until you answer, your health data is no longer kept on the server.

How long

Until you withdraw your consent or delete your account (plus the time it takes for backups to roll over, no. 11).

Who sees it

Only you. It is never shown to others, never sold, never used for ads. The server only reads it automatically, for your reminders. For people in your household, only add their information with their agreement (for a child, as a parent).

4. Meal photos, nickname, ratings and shared links

What: The meal photo you send, the recipe, the date sent, your nickname. Your recipe ratings. The weeks or recipes you share through a link, and how many times the link is opened. The shopping lists you share with a code.
Why: Show real meal photos on recipes, with their author's nickname; rank recipes by average rating; share a week, a recipe or a list with people close to you.
Legal basis: Your consent for photos (you choose to send one); performance of the contract for ratings, links and shared lists.
How long: A pending photo: until it is picked or refused. Refused: erased 30 days later. Picked: until you remove it and as long as your account exists. Ratings and links: as long as your account exists. A list shared with others stays with them if you delete your account.
Who sees it: A pending photo: you and the publisher, who picks. A picked photo: everyone, with your nickname. Your rating: no one, only the average is shown, from 5 ratings. A link: anyone who has it. A shared list: the people who have its code.
To remove your photo: On the recipe, "Send my photo of the dish" shows your photos of this dish (pending or picked). "Remove my photo" erases it at once, from everyone's app and from the server (then from backups as they are replaced, no. 11). Deleting your account removes them all.

5. Notifications (reminders)

What: The subscription address your browser gives for notifications, its encryption keys, the date, and the list of reminders already sent (so they are not sent twice).
Why: Send you the reminders you chose: a dish to eat, a box to take out of the freezer, your cooking day, bedtime, weigh-in… The server prepares them from your synced data: without your consent for health data (no. 3), it has neither your sleep, nor your weigh-ins, nor your logged meals, and the reminders that depend on them are not sent or cannot take them into account.
Legal basis: Your consent: you allow them in your browser and in Settings, and you can turn them off at any time, one by one or all at once.
How long: Until you turn them off, sign out or delete your account. The list of sent reminders is erased after 30 days.
Who sees it: The reminder goes through your browser's or phone's notification service (Google, Apple, Mozilla or Microsoft). It is encrypted: that service knows a message is going to your device, but cannot read it.

6. Kibo Premium payment (not open yet)

What: Kibo keeps the state of your trial and subscription (dates, paid or cancelled) and, when payments open, your Stripe customer and subscription numbers. Your card and the email address you give at payment are handled by Stripe, never by Kibo.
Why: Unlock Premium features, collect the subscription, keep the accounts.
Legal basis: Performance of the contract; legal obligation for accounting (invoices are kept 10 years, as the law requires).
Who sees it: Stripe, acting for us and, for fraud prevention and its legal obligations, on its own behalf (Stripe privacy policy).

7. Anonymous journey measurement

What: The steps of your journey, each sent only once: onboarding done, first week planned, the shopping step by step (list ready, Shopping screen opened, filling opened, a first item ticked, everything ticked, shopping confirmed), first cooking session, first meal logged, coming back 7 days later. With the day, the app version and an identifier drawn at random on your device. And the day you open the app (once a day at most), with the same identifier. Never your account, your IP address, or what you eat or buy.; The app's speed, once a day at most: how long it took to show up (rounded), whether it was your first opening or a return, and a rough description of the device (number of cores and memory in bands, network type, touch screen or not), with the day and the version. Without an identifier: this line is linked neither to you nor to your device. Never your browser's name or your phone's model.
Why: Know at which step people give up, whether they come back, and whether the app is fast enough for them, to make Kibo simpler.
Legal basis: Kibo's legitimate interest in improving the app. It is audience measurement for Kibo only, with no ads and no tracking on other sites.
How long: 25 months at most. The random identifier lives no more than 13 months: it is then replaced with a new one.
Who sees it: The publisher, as totals ("how many devices reached each step", "how many came back the next day", "typical display time").
To object: Settings → Help and info → "Measure my journey". Turned off, nothing leaves this device any more, and what was already recorded for it (steps and opening days) is erased from the server. The choice applies to the device (the measurement does not know your account): do it on each of your devices. The same switch turns off the end-of-filling line of the drive (no. 9a).

8. Crash reports

What: When Kibo crashes: the error message, the screen where it happened, the app version, the browser model, the date and, if you are signed in, your username. Never your recipes, weight or lists.
Why: Find and fix bugs, and know which accounts are affected.
Legal basis: Kibo's legitimate interest in making the app work.
How long: 90 days (and the latest 2,000 at most). If you delete your account, your username is removed from them.
Who sees it: The publisher.

9. The "Kibo Drive" add-on

What: Your shopping list (items, quantities, chosen products), your store (your Leclerc Drive store number; for the other stores, on trial, only the fact that you opened their site), and what the store replies (products, prices, deals, availability, what Kibo put in your cart).
Where: In your browser only. The add-on talks to the store as if you were searching yourself, in your own session. None of this goes to Kibo's server (the only exception: one anonymous line at the end of a filling, no. 9a). It reads neither your password, nor your payment details, nor your other tabs.
Why: Fill your cart when you ask; and, when you run “Compare on my stores”, read your list's prices without adding anything to the cart (these prices stay on your device).
Legal basis: Performance of the contract: you start the filling yourself.
How long: Replaced with each new list; an unfinished request expires after 6 hours; uninstalling the add-on erases everything. What Kibo keeps afterwards (your store, chosen products, prices) is part of your Kibo data (no. 1 or no. 2).
Who sees it: You, and the store, which receives your searches and cart as usual.

9a. Filling the drive

What: A single line, sent by the app at the end of a filling: the store chain (Leclerc, Auchan, Carrefour…), success or failure, the step that failed and why, the number of items, the add-on version and the day. Never your account, your device, your IP address, your list or the products.
Why: Know whether filling works, chain by chain, and fix it quickly when a store's website changes.
Legal basis: Kibo's legitimate interest in making cart filling work.
How long: 25 months at most.
Who sees it: The publisher, as totals ("how many fillings succeeded or failed").
To object: The same switch as the journey measurement: Settings → Help and info → "Measure my journey". Turned off, this line is no longer sent. Lines already sent are not linked to anyone: they cannot be found again to be erased.

10. The publisher's dashboard

What: For each account: username, nickname, first and last name, sign-up and last-use dates, connected devices, trial or subscription state, notifications on or off, referrals, number of shared lists, and how many items it contains (weeks, recipes, and logged meals only with your consent for health data), never their content; the terms accepted (which version, on what date); the messages and requests sent from the app (no. 13). The meal photos sent and crash reports. And each week's figures, as totals: how many accounts used Kibo, which versions of the app and the add-on are in use.
Why: Help you if you have a problem, answer your messages and requests, pick meal photos, spot abuse and bugs, know how many people use Kibo and when an old version can stop, be able to show that you accepted the terms.
Legal basis: Kibo's legitimate interest in running and protecting the service.
How long: What comes from your account, including the terms accepted: as long as it exists. Each week's figures: 25 months.
Who sees it: Only the publisher, with a separate, password-protected account.

11. Backups and server logs

What: A full copy of the database, every day. And the server's technical logs: IP address, date, address called, and, for a signed-in account, the app version used.
Why: Not lose your data in an outage; protect Kibo (too many password attempts, attacks) and understand an outage.
Legal basis: Kibo's legitimate interest in keeping the service safe and available.
How long: Daily copies: 14 days on the server. Encrypted copy outside the server: 30 days. Copies made before each Kibo update: the latest 10. Logs: 1 month at most. Erased data therefore also disappears from backups as they are replaced.
Who sees it: The publisher, to restore the service after an outage. The copy outside the server is encrypted before it leaves: its host cannot read it.

12. What Kibo does with other services when you ask

Price comparison: to find prices recorded by Open Prices (Open Food Facts) volunteers, your device sends Kibo's server the names, brands, sizes and barcodes of the products on your list. The server looks them up in its copy of Open Prices data (reloaded every day) and keeps nothing of your request; Open Prices receives nothing. Prices the extension reads on your online stores stay on your device: they are never sent to Kibo's server or to Open Prices. How it works in detail: how the price comparison works.
Scanning a barcode: Kibo's server asks Open Food Facts for the product sheet with the barcode only, nothing about you. The product image is then loaded by your browser directly from Open Food Facts, which then sees your IP address, as with any website.
Recipe from a link: Kibo's server opens the page; the website sees Kibo, not you.
Reading a receipt and the barcode reader: on your device, nothing leaves it.
"Hands-free" mode: speech recognition is your browser's. Kibo does not receive the sound, but depending on your browser (for example Chrome), it may be processed by its maker (Google, Apple…).

13. If you write to us

In the app (Settings → Help and info → "Write to Kibo", and, with an account, Settings → My account → "Exercise my rights"): your message or request, its date and our reply are kept on Kibo's server, with your account if you are signed in. Without an account, you can leave your email address: it is used only to reply to you. They are erased 3 years after the last exchange; a request not yet handled stays until it is.
By email (or when we reply to you by email): your message and email address are used to reply to you. They are kept in our mailbox (Gmail, by Google) while we handle your request, then 3 years at most.

Kibo's service providers

Hetzner Online GmbH (Germany): hosts the server and its data, in the European Union.
Cloudflare, Inc. (United States): keeps the backup copy outside the server, encrypted before it leaves; Cloudflare does not have the key and cannot read it.
Google (Gmail): the contact mailbox.
Stripe Payments Europe, Ltd. (Ireland): Premium payment, when it opens.

Browser notification services (Google, Apple, Mozilla, Microsoft) only receive encrypted messages.

Outside the European Union

Your readable data stays in the European Union. A few providers are US companies (Cloudflare, Google, Apple, Microsoft, and Stripe for part of its processing): they only receive encrypted data, or the messages you send us, and are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

How your data is protected

Always-encrypted connection (HTTPS).
Passwords are never kept: only a fingerprint (scrypt, with a salt per account); device sign-in tokens are kept the same way.
Limits against repeated password attempts, and each account only sees its own data.
Isolated server, reachable by key only, with a firewall.
Daily backups, and an encrypted copy outside the server (AES-256).
Kibo only asks for what it needs: no email, no phone number, no address to create an account.

If a data breach put you at risk, we would tell you, and the CNIL (the French data protection authority) too, as the law requires.

Your rights

At any time you can:

see your data and get a copy;
correct it;
erase it;
take it with you in a file another app can read (portability);
object to processing based on legitimate interest (the journey measurement, for example);
ask us to freeze it while a disagreement is settled (restriction);
withdraw your consent (health data, notifications, photos);
say what happens to your data after your death.

In the app, right away

See and correct: everything can be edited in the app.
Take it with you: Settings → Backup → "Export a backup" (a JSON file).
Erase your account: Settings → My account → "Delete my account".
Erase your device: Settings → "Erase everything on this device".
Withdraw consent for health data, turn off notifications: Settings.
Object to the journey measurement: Settings → Help and info → "Measure my journey" (no. 7).
Remove your meal photo: on the recipe, "Send my photo of the dish" → "Remove my photo" (no. 4).

Asking us

For everything else (knowing everything Kibo keeps about you, correcting what you can't change yourself, objecting to a use, another question about your data):

in the app, with an account: Settings → My account → "Exercise my rights". You follow your request in the same place: where it stands, the reply deadline, our reply;
by email: write to projectafievez500@gmail.com with your Kibo username. We may ask you to prove the account is yours (for example by signing in).

We reply within one month (three months at most for a very complex request, and we tell you).

Complaints

If you are not satisfied with our answer, you can complain to the CNIL: cnil.fr/fr/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or to the data protection authority of the EU country where you live.

Minors

Kibo is for people aged 15 and over: from 15, you can give your consent yourself. Under 15, don't use Kibo on your own. If you add a child to your household, it is as a parent or guardian.

What Kibo never does

sell, rent or lend your data;
ads, ad trackers, ad profiling;
take an automated decision that has a legal effect on you;
read your Leclerc cart or orders outside what you start.

Kibo uses no cookies. It keeps in your browser what it needs to work (your data, your sign-in, your settings) and the random identifier of the journey measurement (no. 7).

When this page changes

If we change this page in an important way, Kibo tells you in the app at least 15 days before the change applies: a banner at the top of the app says what changes and from when. The update date is at the top.

See also: terms of use · terms of sale · legal notice