Privacy notice

Version 2026-11-10 · In force since Tuesday, November 10, 2026

1. Data controller

The data controller is Claudio Mocci, registered office at Piazza Verga 4, 56123 Pisa, tax code (codice fiscale) MCCCLD89T09I452U, reachable at info@macondoapp.eu.

2. What data we process

Registration data: first and last name, email address, phone number, nickname, date of birth, gender, profile and cover images, description.
Location data: the city and coordinates you provide at registration, or those obtained from your device sensor (see section 4). The GPS tracks of the workouts you record. If you start a public workout, your approximate position (about 100 metres), the sport and the start time are visible, while the workout is active, to users searching for nearby workouts, together with your name, nickname and profile picture; users you have blocked do not see them.
Usage and diagnostic data: IP address, device type, session identifiers, access and security logs (which include request parameters, for example the terms of a search), timestamps of operations, the channel through which you arrived (for example an invitation). For each user we also record which modules of the app they use on each day (usage analytics, see section 3) and the token that identifies your device for push notifications. Use of the Cycle module is not recorded per user: it is only counted anonymously (how many distinct users use it on a given day, with no identifier). You may object to usage analytics at any time with the switch in Settings > Privacy and security.
Problem reports: if you send one, we receive its text, the app version, the platform, the operating system version and the device model, the page you were on and the list of the last calls (up to 50) the app made to our servers, with method, address, outcome and duration, plus an excerpt of the error message.
Content you create: messages, voice notes, images, videos and attached files in chats, notes, reminders, shopping lists, receipts, pantry, recipes and any other content you enter in the app's modules. In direct chats the content of messages and attachments is end-to-end encrypted and our server cannot read it; the data needed to deliver them remains visible to the server: who writes to whom and when, the names of attached files, the reactions to messages and, if you ask for a link preview, the address of the link, which our server opens to prepare it.
Public recipes: if you publish a recipe on the Public shelf of the Recipes module, we store a copy separate from your personal recipe (name, category, ingredients, instructions, video, tags and photos), together with who published it and when. We also record the consent you give at your first publication (date and version of the text), the rating you give other people's recipes with “I cooked it” (whether you liked it or not) and the counters that follow from it (saves, times cooked, positive ratings), together with the ranking score.
Sports community: if you enter the public zone of the Sports community module (we ask you for explicit confirmation), we store a sports profile separate from your chat profile: the name you choose, an optional photo, the sports you play, a neighbourhood or city label written by you and your zone, that is a square of about 2 km calculated by the server. The coordinates your phone sends to calculate the zone are not stored. We also process the match announcements you publish and the requests to take part, your times on public routes and segments, milestones (records, consistency, first times, matches and challenges), your participation in the monthly challenges, and the training plans and routes you publish.
Orders and bookings with businesses: when you order takeaway or delivery, or book with a business on Macondo, we process the order or booking data and communicate it to the business: for a delivery, address, doorbell name, phone and notes; the allergies and notes you write on dishes. The addresses you save on your profile (at most 10) are encrypted and the business does not see them: it receives only those you choose for an order.
Google Calendar: if you connect your Google account, we read the events of your calendar in read-only mode (no changes) and keep the connection token encrypted; you can revoke it at any time.
Special categories of data (Art. 9 GDPR): if you enable the relevant modules, we process health-related data — workouts, heart rate, weight, height, meal plan and how you followed each meal (as planned, different or skipped, with an optional note) — and, if you enable the Cycle module, menstrual cycle and fertility data: periods, symptom diary and, if you choose to record them, sexual intercourse. Cycle data is encrypted in our database and is never shared with your family group. This data is processed solely on the basis of your explicit consent, which is requested separately when you enable the module. If you delete the Cycle data from the module, periods, diary, settings and the related reminders are permanently erased from our systems. The food diary with calories, which the app no longer uses, is no longer visible but is still kept: you can export it from the Meal plan module.

3. Why we process it and on what legal basis

Purpose	Legal basis
Creating and managing your account, providing the requested features	Art. 6(1)(b) — performance of a contract
Access security, abuse prevention, authentication event log	Art. 6(1)(f) — legitimate interest in service security
Tax and accounting obligations, responses to authorities	Art. 6(1)(c) — legal obligation
Processing health data in the fitness and nutrition modules	Art. 9(2)(a) — explicit consent
Location (updating your position, finding users and content near you, workout tracks)	Art. 6(1)(a) — consent, which you give by granting the location permission in your phone settings
Per-user app usage analytics and anonymous aggregate statistics	Art. 6(1)(f) — legitimate interest in understanding and improving the service
Communications from Macondo about news, usage tips and offers relating to its own services, never third-party advertising	Art. 6(1)(a) — consent, optional and revocable in the settings
Publishing your recipes on the Public shelf of the Recipes module, with your name and profile picture	Art. 6(1)(a) — explicit consent, given at your first publication and revocable by hiding your recipes in the privacy settings
Taking part in the Sports community (sports profile, zone, matches, times on leaderboards, milestones, challenges, published plans and routes)	Art. 6(1)(a) — consent, which you give by entering the public zone and can withdraw by turning the module off and deleting its data
Orders and bookings with businesses, communication of the related data to the business	Art. 6(1)(b) — performance of a contract
Moderation of public content (recipes, sports profiles, match announcements, times, published plans and routes, reports, removal of content, suspension of publishing)	Art. 6(1)(f) — legitimate interest in preventing abuse and unlawful content

Providing registration data is necessary to create the account: without it the service cannot be delivered. Providing consent-based data is always optional, and refusing it only makes the related feature unavailable. The statistics we share with partners are aggregated and anonymous: any value referring to fewer than 5 people is not shown, with one exception: the map of registered users shows, for zones of about 5 km, how many people have their position there, even when they are fewer than 5, with no names or other data that identify them.

4. Location and device address book

Location. If you have granted the app the location permission in your phone settings, the app automatically updates your position when it starts and when you return to it, and saves it on our server: we use it to suggest users and content near you and for features that depend on place. If you do not grant the permission, the app does not detect your position on its own and asks for it only when you use a feature that needs it. The permission is your consent and you can withdraw it at any time in your phone settings. To obtain the name of your city, your phone sends the coordinates to the Photon (Komoot) geocoding service, which receives them together with your IP address.

Address book. Some features can suggest contacts who already use the service, but only after the app has informed you and you have given your explicit consent. In that case the numbers in your address book are not transmitted to us in the clear: they are turned on your device into a pseudonymised code (a SHA-256 fingerprint of the number in international format) and sent to the server solely to find who already uses Macondo. This is pseudonymisation, not anonymisation: a phone number can be reconstructed from a fingerprint by systematic guessing. The server compares the fingerprints with those of registered users and returns the matches; it does not retain them.

Data is accessible to authorised staff and to suppliers acting as processors under Art. 28 GDPR: cloud hosting and infrastructure, email delivery and push notifications. An up-to-date list is available on request at info@macondoapp.eu. Below are the external services that receive data, grouped by purpose.

Artificial intelligence (Mistral AI): when you ask to generate a workout plan (parameters, exercises to exclude and free text you write), describe a route in words, or import a professional's address book from a spreadsheet (only the column headers, never the rows), our server sends these texts to Mistral AI, based in France, through its European endpoint (api.eu.mistral.ai). We do not send your name, your email, your account identifiers or your IP address: to Mistral the request cannot be traced back to you. Mistral does not act on our behalf and may use these texts to improve its own models, under its own privacy policy: for this reason we ask you not to write personal or health data in the free texts.
Importing recipes from a link: when you use import from a link, you paste or share the address of a recipe page and our server downloads that public page and extracts the ingredients and steps to prepare a draft for you, which you check and save in your recipe book (it stays private and cannot be published). The website visited sees the request coming from Macondo's server, not from you. If the page contains no structured data, the text of the page (never the link or any data about you) may be sent to Mistral AI for extraction, through its European endpoint, under the same conditions described above for the other uses of Mistral: the request cannot be traced back to you, Mistral does not act on our behalf and may use that text to improve its models, according to its own privacy notice. The link and the domain of the source remain saved in the recipe.
Email (Resend): we send through Resend the emails verifying your address, resetting your password and the invitations professionals send to their contacts (the recipient's address, the name of the contact record and of the page, a link). Resend is based in the United States (see section 6).
Maps, routes and geocoding: to show maps, search places and build routes, your phone or our server sends coordinates, map areas or search texts to OpenStreetMap (tiles and Nominatim), OpenFreeMap, Photon (Komoot), Overpass, OSRM (routing.openstreetmap.de), Wikidata, Google Maps (static maps) and the OpenTopoMap and CyclOSM tile providers. These are public services that also receive the IP address of the device or of our server.
Weather and elevation: the coordinates of routes are sent by our server to Open-Meteo (forecasts and air quality) and to OpenTopoData (elevation).
Food catalogues: product searches and barcodes are sent by our server to Open Food Facts.
Embedded videos: if you open a recipe or exercise video, your device loads it from YouTube or Vimeo, which receive your IP address. For the preview of YouTube links in chats our server queries YouTube.
Sign-in with Google or Apple: if you choose these sign-ins, Google or Apple give us the email address and name associated with your account. If you connect Google Calendar, our server communicates with Google (read-only).
Push notifications (Google Firebase Cloud Messaging): the server sends Google your device token and the content of the notification (title and text, for example the name of who is calling you).
Voice and video calls: our server relays between participants the messages needed to start the call. Audio and video travel directly between the devices or, when the network does not allow it, through a relay server managed by us, which receives the devices' IP address but cannot read the content, which is encrypted between the participants.
Statistics for partners: to authorised partners we show only aggregated and anonymous data; values referring to fewer than 5 people are hidden, except in the map of registered users by zone (see section 3).
Businesses and professionals: the business where you order or book receives the data described in section 2. A professional (for example a personal trainer or a nutritionist) sees the data of your modules only for the areas you give them access to — workout, reading the meal plan, writing the meal plan — and you can revoke any access at any time; for a gym or sports facility, access to workouts also applies only as long as you have a valid membership.

Some content is visible to other users by your own choice: public profile, messages you send, family groups or shared lists you join, public workouts, recipes you publish on the Public shelf, profile and content of the Sports community. In Settings > Privacy and security (“What others see”) you choose whether to show city, age, gender and when you are online, whether to be found by name, by proximity or by interests, and who can add you to groups or call you. Users you have blocked see none of this.

Sports community. The other members of the public zone see your sports profile, never your chat profile, your number, your age or your gender. Times on leaderboards and milestones appear to others between 24 and 96 hours after the workout and show only its month, never the day or the hour; you can turn milestones off by type in the privacy settings. Of the routes you publish, others do not see the start and the end (150 metres by default, adjustable), and searches and distances are calculated only on the visible part. When a request of yours to join a match is accepted you enter the match's group, where the other participants see your chat profile. Our staff may hide a reported content item and suspend the sports profile, telling you the reason.

Public recipes. The recipes you publish on the Public shelf are visible to Macondo's registered users, except those you have blocked and those who have blocked you: the recipe, its photos, your name and profile picture, your city (only if your profile is public) and a link to your profile, where the recipes you have published appear in a dedicated section. To publish, your profile must be public: if it is private, by accepting you make it public. Other users do not see the individual ratings you give, only the counters. Recipes are published under the Creative Commons Attribution-ShareAlike 4.0 licence: anyone may copy and adapt them, crediting you, and copies already saved by others remain theirs even if you withdraw the recipe or delete your account. You can withdraw a recipe at any time, or hide all your recipes and the profile section from the privacy settings (“What others see”); switching it back on makes them visible again. Our staff may remove a reported recipe and suspend its author's publishing. Thirty days after a recipe is withdrawn (by you, by our staff, or as a result of deleting your account) the public copy and its photos are permanently deleted; your personal recipe and the copies saved by others are not affected.

Data is neither disclosed publicly nor sold to third parties.

6. Transfers outside the European Economic Area

Where a supplier processes data outside the EEA, for example Resend and the other services in section 5 based or hosted outside the Union, the transfer takes place on the basis of a European Commission adequacy decision or of the standard contractual clauses set out in Decision (EU) 2021/914, together with any supplementary safeguards required. The public map and geocoding services contacted directly by your phone do not act on our behalf: they receive data within the limits described in section 5 and process it under their own notices. Mistral AI likewise does not act on our behalf: it receives the texts described in section 5 and processes them under its own privacy policy.

7. How long we keep it

Account data: for the duration of the relationship. When you ask for deletion, your account is deactivated immediately and for 30 days you can cancel the request by signing in to the app and choosing "Reactivate". After the 30 days the data is permanently deleted or made anonymous. Only content that also belongs to other people is kept in anonymous form:
- messages already delivered in direct chats and chats with pages stay with the people who received them, with the sender shown as "Deleted user"; in groups, the content of your messages is deleted;
- content you shared with the family group stays with the group;
- the recipes you published on the Public shelf that are visible stay, with their photos, without your name and with the author shown as “Deleted user”; those you had hidden in the privacy settings are withdrawn; the ratings you gave to other people's recipes are deleted (the counters stay as they were) and the publishing consent is deleted;
- reviews you wrote stay, with the author shown as "Deleted user".
Professionals: if you are a client of a professional, the record they keep in their address book remains under their responsibility, as an independent controller; on deletion it is unlinked from your account. The training plans and meal plans they assigned to you are deleted.
Orders with businesses: address, doorbell name, phone and delivery notes are deleted 30 days after the order is closed, allergies and notes on dishes after 90 days.
Access and security logs: 180 days.
Reports and moderation measures concerning you: kept in pseudonymised form for 12 months after your account is deleted, to prevent repeated abuse (legitimate interest), then deleted.
Withdrawn public recipes (by you, by our staff, or through account deletion): the public copy, its photos, the ratings received and the closed reports about it are permanently deleted 30 days after the withdrawal; a recipe with a report still open stays until our staff closes it. Your personal recipe and the copies saved by others remain.
Reports and suspensions linked to public recipes: reports you sent, once closed, and publishing suspensions are kept in pseudonymised form for 12 months after the account is deleted, then deleted; reports about one of your recipes that stays on the shelf remain for as long as the recipe does, without your name.
Per-user usage analytics (which modules you use on each day): 13 months, after which only anonymous aggregates remain; they are deleted when your account is permanently deleted.
Cycle data: until you delete it, which is permanent.
Consent-based data: until consent is withdrawn.
Consent register: 10 years from the deletion of your account, in order to demonstrate compliance under Art. 7(1) GDPR.
Data needed for tax obligations: for the periods prescribed by law.

8. Automated decision-making

We do not carry out solely automated decision-making producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR.

9. Your rights

You may at any time exercise the rights under Arts. 15-22 GDPR: access your data, request its rectification or erasure, obtain restriction of processing, object to processing based on legitimate interest, and receive your data in a structured format and transmit it to another controller.

For usage analytics (section 3) objecting is immediate: simply turn off the switch in Settings > Privacy and security. From then on we stop recording your per-user activity and we delete what was already collected. Use of the Cycle module is never recorded per user.

Where processing is based on consent, you may withdraw it at any time from the app settings, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights write to info@macondoapp.eu. We respond within one month, extendable by two further months in particularly complex cases.

If you believe the processing infringes the Regulation you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the country where you reside.

10. Minors

The service is not intended for anyone under 14 years of age, the digital consent age set in Italy by Art. 2-quinquies of Legislative Decree 196/2003. If we become aware that a child below that threshold has registered, the account is closed and the data deleted.

11. Cookies and data stored on your device

Macondo does not use profiling, advertising or statistics cookies, nor any third-party tracking tools. That is why we do not ask for your consent to cookies: the ones we use are technical and necessary to provide the service you asked for (Art. 122 of Italian Legislative Decree 196/2003).

Sign-in cookie (macondo_rt): web version only. It keeps you signed in; only our server can read it (it is httpOnly), it is sent only with sign-in requests to our domain and it lasts 30 days. We delete it when you sign out.
Data stored on your device: the app and the browser keep on your device what they need to work: your session, the end-to-end encryption keys, your language and display preferences, message drafts, recently used emoji, the books you download and, in the phone app, an encrypted copy of your data so you can use it offline. We do not use them to track you, and they stay there until you sign out, clear them from your browser or uninstall the app.
Third-party content: fonts and icons come from our own servers. Maps and videos (section 5) load only when you use them; a YouTube or Vimeo video you choose to open may set its own cookies, under those services' rules. In the web version, YouTube videos go through YouTube's cookieless domain (youtube-nocookie.com).

12. Changes

If we make substantial changes to this notice we will flag them in the app before they take effect and ask you to review them. The version in force and its effective date are always shown at the foot of this document.