Your data, explained clearly.

Privacy at a glance

DoughTools tries to keep simple planning and calculator data local to your browser where that is enough. Account features are different: when you sign in, selected pizza plan, history, Party Order, and photo data can be saved to Supabase so you can use account features.

DoughTools does not include advertising pixels or analytics tracking in the inspected code. Hosting, authentication, database, storage, and photo-checking providers still process technical data needed to run the service.

Who controls your data

DoughTools is currently operated by Marcin Arcisz in Finland. For privacy requests, use hello@doughtools.app.

The current product repository confirms the owner name, country, and email contact. A postal address, business ID, hosting/database region choices, and any formal company/trading details still require Marcin’s confirmation before this notice should be treated as final legal publication copy.

What data DoughTools processes

• ✓Account data: email address, Supabase authentication identifiers, and authentication-session data.
• ✓Pizza plan data: dough settings, timing, shopping, Timeline, Kitchen, Review notes, completed-plan titles, and related plan metadata.
• ✓Browser-local data: active local sessions, saved calculator recipes, experience-level preference, local bake results, cost currency, install-prompt state, gear checklist choices, and similar local-only tool state.
• ✓Party Orders: organizer event details, public guest link token, guest names, guest comments, pizza choices, edit tokens, status, and timestamps.
• ✓Pizza photos: optional uploaded image, original filename and type metadata, optimized image metadata, moderation/relevance results, and Supabase Storage path.
• ✓Technical data: request metadata, IP address, device/browser information, security logs, and hosting/provider logs generated when the site or APIs are used.
• ✓Support communications: email address, message content, and attachments if you contact DoughTools by email.

Why and on what legal basis

DoughTools uses personal data to provide the service you request, keep account features working, secure the service, prevent abuse, respond to support and privacy requests, and maintain records where required.

The main GDPR legal bases described by this notice are: performance of the requested service or contract for account, pizza plan, Party Order, and support features; legitimate interests for security, abuse prevention, service reliability, and basic technical logging; consent or your optional action where the interface asks you to upload a photo or start an optional feature; and legal obligation where applicable law requires records or responses.

Where DoughTools relies on legitimate interests, the interest is to keep a small pizza-planning service secure, reliable, and usable without collecting more data than needed. You may object to processing based on legitimate interests by contacting DoughTools.

Local-only data

Some data stays in your browser unless you separately choose an account or cloud feature. This includes local pizza plan storage, saved Quick Calculator recipes, saved calculator recipes in the main calculator, experience-level preference, local bake results, gear checklist choices, cost currency, install-prompt state, and older local planning state.

Local browser data is stored on the device and browser profile you use. It may be deleted by the relevant in-product delete/reset control where available or by clearing site data in your browser. After successful self-service account deletion, DoughTools clears known DoughTools-owned local app data from the current browser, but it does not clear unrelated browser data or data on other devices. DoughTools cannot recover browser-local data after you clear it.

Account and cloud data

If you create an account, Supabase handles authentication. DoughTools application code does not store your password. Signed-in users can save active pizza plans, completed plan history, completed-plan titles, Party Orders, and optional pizza photos in Supabase-backed cloud storage.

Active and completed pizza plan records can be archived through the current account UI. Account Settings also includes Download my data and Delete my account for self-service account-level access and deletion where the signed-in account is eligible.

Saved Quick Calculator recipes and many older calculator saved recipes remain local-only in the browser and are not currently described as account-synced data.

Download and delete your data

Signed-in users can use Account Settings to download a UTF-8 JSON export. The export includes safe account identity metadata, account preferences, owned pizza plans and Review data, metadata for owned Review photos, owned Party Orders, related guest submissions and items for those owned orders, and the account role relevant to the signed-in account.

The export does not include passwords, login tokens, raw Storage credentials, signed photo URLs, private Party Order public or edit tokens, or data from other users.

Signed-in users can also choose Delete my account in Account Settings. The flow requires typing DELETE before it runs. It deletes owned Review photos from Supabase Storage, deletes owner-scoped DoughTools cloud application data, deletes the Supabase Auth account after required cleanup succeeds, revokes the current signed-in session where possible, and clears known DoughTools-owned local app data from the current browser.

Self-service deletion does not delete public admin-created configuration such as theme campaigns or product sound settings. Admin-role accounts are blocked from self-service deletion so public product configuration can be reviewed first.

If self-service export or deletion fails, or if you need correction, restriction, objection, or help with a privacy request that is not covered by the product UI, contact hello@doughtools.app.

Pizza photos and moderation

Pizza photos are optional and available only for signed-in completed pizza plans. Before a photo is stored, DoughTools checks the uploaded image with OpenAI for safety moderation and pizza relevance. If the check fails, the photo is not stored for the overlay feature.

Accepted photos are uploaded to the Supabase Storage bucket used for pizza-session photos. DoughTools stores metadata such as the storage path, upload time, content type, file size, original filename, original content type, optimized size, image dimensions, compression quality, and related session data.

When an eligible user completes self-service account deletion, owned Review photos are removed from Supabase Storage before the related DoughTools cloud data and Supabase Auth account are deleted. If the Storage cleanup fails, the Auth account is not deleted and the user can retry or contact support.

The moderation and relevance checks are practical feature checks. They do not create legal or similarly significant automated decisions about you; a rejected image simply cannot be used for the DoughTools photo feature.

Party Orders and public links

Party Orders let a signed-in organizer create a public guest link. Anyone with the link may be able to open the guest form while orders are open, so the link should be shared only with intended participants.

Guest submissions can include a guest name, optional comment, pizza choices, quantities, and an edit token. The organizer can view guest orders, close or reopen orders before the deadline, archive the Party Order, use the totals to create a pizza plan, and delete individual guest submissions from the organizer view.

When an organizer deletes their account, DoughTools deletes Party Orders owned by that organizer and the related guest submissions and items for those owned orders. DoughTools does not delete guest data by name matching and does not delete data belonging to another organizer.

Guests should not submit sensitive information, allergy details, medical information, or private data in Party Order names or comments. Allergies and dietary safety should be verified directly outside DoughTools.

Cookies, local storage, and similar technologies

DoughTools uses cookies and browser storage only where the current product needs them for requested features or user-selected preferences. The current audited implementation does not use analytics cookies, marketing cookies, advertising pixels, profiling identifiers, or nonessential third-party tracking storage.

Anonymous page loads checked during the Patch 475 audit did not create cookies, localStorage, or sessionStorage. Some storage is created later only when you use a feature that needs it, such as signing in, saving a pizza plan, saving a recipe, using Kitchen Mode, changing a guidance level, or changing a currency/sound preference.

Supabase server-side authentication may use first-party cookies through the Next.js/Supabase SSR client so signed-in account routes and APIs can work. These authentication cookies are technically necessary for requested account functionality. Exact cookie names and durations can vary with the configured Supabase project and token settings.

DoughTools includes a web app manifest and install prompt support, but the inspected app does not register a custom service worker or use push notifications.

• ✓Supabase auth cookies such as the `sb-<project-ref>-auth-token` family: used by Supabase authentication for signed-in account sessions; provider is Supabase; duration depends on the configured auth session and token settings; classified as technically necessary.
• ✓`doughtools:pizza-sessions-v1`: localStorage used to keep local Pizza Session data on this browser after you create or save a plan; provider is DoughTools in your browser; kept until you delete it, clear site data, or account cleanup clears known local DoughTools keys; classified as technically necessary for the requested local planning feature.
• ✓`doughtools:active-pizza-session-id`: localStorage used to remember which local Pizza Session is active; provider is DoughTools in your browser; kept until the active session is cleared, completed, archived, deleted, or browser data is cleared; classified as technically necessary.
• ✓`doughtools:cloud-backed-pizza-session-id`: localStorage used to relate a local active session to a cloud-backed account session when that feature is used; provider is DoughTools in your browser with Supabase-backed account data; kept until replaced or cleared; classified as technically necessary for requested account/session continuity.
• ✓`doughtools:dough-plan-auto-saved-snapshot-key`: sessionStorage used during account save/autosave flows to avoid saving the same snapshot twice in one browser session; provider is DoughTools in your browser; lasts for the browser tab/session; classified as technically necessary.
• ✓`doughtools-saved-recipes-v1` and `doughtools.quick-calculator.recipes.v1`: localStorage used for browser-local saved recipe data where those save features are available; provider is DoughTools in your browser; kept until deleted or site data is cleared; classified as technically necessary when you request recipe saving.
• ✓`doughtools:bake-results`: localStorage used for private local bake/review results; provider is DoughTools in your browser; kept until deleted, cleared, or account cleanup clears known local DoughTools keys; classified as technically necessary for the requested local result feature.
• ✓`doughtools.kitchen-bake-timer.v1:<sessionId>`: localStorage used to keep Kitchen bake-timer state across reloads while you use the timer; provider is DoughTools in your browser; kept until the timer/session state is reset, removed, or site data is cleared; classified as technically necessary for timer continuity.
• ✓`doughtools.experienceLevel`, `doughtools-currency`, and `doughtools.bake-timer.sound-enabled.v1`: localStorage used to remember user-selected guidance level, Costs currency, and bake-timer sound preference; provider is DoughTools in your browser; kept until changed, cleared, or account cleanup clears known local DoughTools keys; classified as functional preference storage.
• ✓Shared Quick Calculator links may include calculator settings in the URL. This is not a cookie, but the settings can appear in browser history or in any link you share.

Service providers and recipients

• ✓Supabase: authentication, database, and storage for account, pizza plan, Party Order, and pizza-photo features.
• ✓Vercel: hosting, delivery, build/runtime infrastructure, and technical logs for the website and API routes.
• ✓OpenAI: optional pizza-photo safety moderation and pizza-relevance analysis when a signed-in user uploads a pizza photo.
• ✓Email providers: if you email DoughTools, your email provider and the DoughTools mailbox provider process the message outside the application itself.

International data transfers

The inspected code does not prove the exact Supabase project region, Vercel runtime/log region, OpenAI processing region, or support-mailbox provider. Those details require Marcin confirmation.

Because the verified providers may process data outside Finland or the European Economic Area, DoughTools should rely on the provider’s data-processing terms, subprocessor disclosures, and applicable transfer safeguards such as Standard Contractual Clauses or adequacy decisions where relevant. The exact active safeguards must be confirmed against the configured production accounts.

Retention and deletion

Browser-local data remains until you delete it in the product where a delete/reset control exists, clear site data, switch browser profiles, or the browser removes it.

Cloud pizza plans, completed history, Party Orders, related guest submissions and items, account preferences, owned Review photos, and the Supabase Auth account can be deleted through self-service account deletion for eligible signed-in non-admin accounts. Current code limits completed-plan list display to recent entries, but that display limit is not a deletion period.

Uploaded pizza photos are replaced when a new photo is uploaded for the same completed session. The previous stored photo path is removed from Supabase Storage during replacement. During account deletion, owned Review photo objects are removed before database and Auth deletion continue.

Deletion from ordinary application tables and Storage is designed to happen during the self-service flow, but backups, provider logs, build/runtime logs, support emails, security records, and infrastructure retention may follow provider or legal retention periods rather than disappearing immediately. Exact production backup and log retention periods require provider/account confirmation.

Security

DoughTools uses authenticated account access for account-only features, Supabase row ownership checks through application queries and database policies, private signed URLs for stored pizza photos, public-token separation for Party Orders, and AI checks before photo upload.

No online service can guarantee absolute security. You should keep your account password safe, avoid sharing Party Order edit links publicly, and avoid submitting sensitive information into free-text fields.

Your data-protection rights

Depending on the situation, you may have rights to access, correct, delete, restrict, receive a copy of, or object to the use of your personal data. You may also withdraw consent where processing is based on consent.

Use Account Settings for self-service Download my data and Delete my account where available. To make another request, report a failed deletion, handle an admin account, or ask for help, contact hello@doughtools.app. DoughTools may need enough information to verify that the request relates to you or your account. Deletion from backups or processor logs may follow the provider’s normal retention cycle rather than happening instantly.

You can also contact the Finnish Data Protection Ombudsman if you believe your data-protection rights have not been handled properly.

Children

DoughTools is not directed to children. The product does not currently publish a confirmed minimum user age. Account creation, Party Orders, and photo uploads should be used only by people who can lawfully use an online service in their location, or with appropriate parent or guardian involvement.

Do not submit a child’s personal data, photo, allergy information, or other sensitive information through DoughTools unless you have the right to do so and it is necessary for the feature you are using.

Changes to this notice

DoughTools may update this notice when the product, providers, storage behavior, or legal requirements change. Material privacy changes should be reflected clearly rather than hidden in vague wording.

Contact and supervisory authority

Privacy contact: hello@doughtools.app.

Supervisory authority: Office of the Data Protection Ombudsman, Finland. Use the authority’s official public website for current contact details and complaint guidance.

Effective date and last updated

Effective from: 13 July 2026.

Last updated: 23 July 2026.

This page is a legally grounded product notice based on the inspected DoughTools implementation and official sources. It does not claim lawyer review, regulator approval, or guaranteed compliance.