Privacy Policy

Last updated: 9 October 2026

App: Dolecular. Operator: Service & Logiciel Dolecular ("Dolecular", "we", "us", "our"), a business established in Québec, Canada. Registered address: 1915 rue Beausite, Saint-Jérôme, Québec J5L 1E4, Canada Québec enterprise number (NEQ): 2279581245 Effective date: 9 October 2026

Person in charge of the protection of personal information (Law 25, s. 3.1): Nicolas Lemire, Founder — privacy@dolecular.com.

Where the App is offered: Canada and the United States. This policy is written to Québec's Law 25, Canada's PIPEDA, and applicable U.S. state privacy laws. It is not written for the EU or UK - the App is not offered there.

1. What we collect

Grounded in what the App actually does today, not a generic template:

• Account information. Your email address, via Firebase Authentication, and, if you sign in with Google, your name and profile photo (Firebase Authentication holds the photo; the App does not show or copy it). Your password (if you use one) is handled entirely by Firebase Authentication - we never see or store it in plaintext. The App keeps a display name for you: Google's if you sign in with Google, otherwise one we derive from the part of your email before the "@" (nicolas.lemire becomes "Nicolas Lemire"). You can change it in Settings at any time.
• Household content. The todos, grocery items, notes, calendar occurrences, recipes, weekly meal plans, and pantry items you and your household members enter, plus family membership information, so it can be synced and shared across your family. A recipe can include a photo, which we store in Google Cloud Storage rather than our database (see §3) - not included in "Download a copy", only that a recipe has one. A recipe can also keep where it came from - a web address or a name - which you can change at any time. Stored in Supabase Postgres. Other members of a family you belong to can see your display name, your email address, and your role in that family. A child or dependent can be added as a managed profile, which is only a name - it has no account and no email.
• Device and notification data. If you enable notifications, we store a device token (via Firebase Cloud Messaging) so we can deliver them to your device. You choose which ones you get: reminders; a short morning summary of what is still ahead for you today; an alert when someone in your household adds groceries; an alert when a kitchen timer that belongs to you ends; and - only if you turn it on - a Sunday reminder to plan the week. Each can be switched off in Settings (the timer alert has no switch of its own: turning notifications off for the App on your phone stops it), and you choose the time of the morning summary. The text of a notification - for example the title of a todo, the name of a grocery item, or the first item of your day - passes through Google's Firebase Cloud Messaging on its way to your device. We never use notifications to advertise or to promote anything. To send each of them at most once, we also keep the date of the last morning summary and the last Sunday reminder we sent you. Without anything that identifies you or your device, we count how many notifications arrive and how many are tapped.
• Who added a grocery item. Each grocery item remembers which household member added it, so we can tell the others when someone else adds groceries (and not tell you about your own). The alert names the person who added it, to the other members of your household. It stays on our own servers, and is removed from the item if that person deletes their account - the item itself stays with the household.
• Voice command transcripts — only if you turn this on. Voice is off by default and asks for its own separate consent in the App, apart from the rest of this policy - you can grant or withdraw it in Settings at any time without affecting anything else. If you enable it: (1) your device's own speech recognizer turns what you say into text - depending on the device, that recognizer is a service run by Google (on Android and in Chrome) or Apple (in Safari), which may receive the audio under its own terms; Dolecular never receives or stores the audio, only the text. (2) That text is sent to Google's Gemini service to work out what you meant (see §3). (3) We keep the text of what you said - not the AI's replies - for up to 90 days to diagnose what isn't working, then a daily job clears it automatically - see §4. None of this happens without this specific consent turned on.
• Recipe photo extraction — only if you use it. If you press "Fill in from photo" on a recipe, or import several recipe photos at once, the photo is sent to Google's Gemini service to read it and fill in the ingredients and steps for you (see §3). We also send your family's own existing recipe tag names at the same time, so Gemini can reuse one you already use instead of inventing a near-duplicate. This happens only when you choose to use one of those two features - never automatically.
• Live mode (voice) - only if you start it. Where it is available, Live mode is a hands-free way to use voice, for when your hands are busy cooking. It needs the same voice consent as above. You tap once; then, instead of holding the microphone for each command, your device's speech recognizer keeps listening in short rounds, with your screen kept awake, and answers are read aloud. It stops when you say "stop" or tap Stop, when two rounds in a row hear nothing, after 10 minutes, after 50 commands, or when you leave the screen. A Pause button (or saying "pause") turns the microphone off completely for the time you choose; when that time is up, the App asks aloud whether to carry on. Each round that hears something is handled exactly like a command you held the microphone for: your device turns it into text (the audio is handled by your device's own recognizer as described above, and never reaches us), that text is sent to us and on to Google's Gemini service to work out what you meant (see §3), and we keep the text for up to 90 days (see §4). While Live mode is on, the microphone is open, so other people's voices nearby - a conversation in the kitchen, a television - can be picked up and sent the same way. Say "stop" or tap Stop when you do not want that, or use Pause for a moment. Live mode is read-only: it answers questions and helps you follow a recipe, and it does not add, change or delete your todos, notes, groceries, pantry or plans (besides answering, it can only start, check or stop a kitchen timer, below). We never record or keep audio ourselves.
• Questions you ask by voice, and answers read aloud. When you ask something like "what do I need for the nachos?" or ask to be walked through a recipe step by step, Gemini is told only what you said - including the name of the dish if you said it - so it can work out what you are asking. The recipe, the grocery list or the plan you are asking about is found in our own database, on our server, and sent to your phone: Gemini never sees your household's recipes, lists or plans, or the answer. An answer can be read aloud by your phone's or browser's own text-to-speech, using only voices that run on the device itself - never an online voice - so nothing is sent anywhere to read it out. The voice you choose in Settings is remembered on your device only.
• Importing a recipe from a web link - only if you use it. When you give Dolecular a web address - by sharing a page to Dolecular, pasting a link, or pressing "Fill in from this link" in a recipe - our server fetches that one public page, and the page's photo if it has one, and reads the recipe from it. The request is made by our server, not by your device, and it identifies itself as Dolecular, sends no cookies and nothing about you. We never go beyond that one page, never sign in to a site, and never get around a login, a paywall or a bot check - if a site refuses, we tell you and you can type the recipe in yourself. The title, steps, times and servings are taken as the site publishes them; Google's Gemini service is used only to split each ingredient line into an amount and an ingredient and to suggest tags from your family's existing tags - or, when a page publishes no structured recipe, to read the text of the page (see §3). Nothing is saved when a page is read: the recipe opens for you to review, and you decide whether to save it. If you save it, it is kept in your household's Recipe Book with the web address as its source, and the page's photo is stored in Google Cloud Storage like any other recipe photo. We also keep a record of each import: who made it, when, which website (its host name only - the full address stays with the recipe) and whether it worked. Link import has its own agreement in the App, asking you to confirm that you are importing for your household's own use and are entitled to copy the recipe for that purpose; you can withdraw it in Settings, which hides the feature.
• Kitchen timers. Timers are part of Meal planning. A timer is a length of time, when it ends, an optional label such as "Pasta" that you type or say, and the household member it belongs to - by default whoever started it, and it can be handed to someone else or to no one. Every member of the household can see the household's timers; only the person a timer belongs to is rung. Stopping a timer deletes it; a finished timer that nobody stopped is deleted after 12 hours, and a paused one after 24 hours. A timer is seen only by your household and is stored with the rest of your data (see §3); it is not shared with anyone else. Your phone may also set an alarm and show a notification on the device itself when a timer ends, and the web version of the App may show one in a browser tab where you have allowed notifications; your device creates those and nothing about them is sent to us or to anyone else. If the App is closed, we also send a notification when a timer that belongs to you ends - or, for a timer that belongs to no one, to every member of the household who has notifications on - through Firebase Cloud Messaging, like your other notifications; it can contain the timer's label. We send it at most once per timer, and not when the App is open on your device. When you set, check or stop a timer by voice, your phone understands the words itself: they are not sent to Gemini, and only the timer is sent to us.
• Technical data incidental to connecting. Your IP address is necessarily visible to, and logged by, the infrastructure providers that serve you (see §3). We do not use it to build a profile of you. We also save your device's time zone (for example "America/Toronto") on your account, updated as your device changes it, so reminders, notifications such as the morning summary, and "today" follow your own clock. It is a time zone, not a location, and we do not use it to work out where you are.
• Feedback you send us. If you use "Send feedback" in Settings, we keep the message you wrote, the category you picked, the language, platform (web or Android) and version of the App you were using, and which account it came from, so we can read it, reply to you and match a bug report to a release. It is optional and only happens when you press Send. Please don't put passwords or other sensitive details in it. It stays on our own servers and is deleted with your account.
• Invitations ("Invite a friend"). Everyone can get a personal invite code - a random code, not built from your name or email - and a link that carries it. If you join Dolecular through a friend's link, or by typing their code when you sign up, we record which account invited you and when. The person who invited you only ever sees how many people joined through their link, never who. While you sign up, the code is kept in your browser or the App until it has been used, and is then removed. It is optional and only happens if you share your link or join through one. It stays on our own servers and is deleted with your account.
• Early-access features. Some new features are switched on for a few people before everyone. Staff keep a short list of email addresses of people who have agreed to test things early, added by hand, and use it only to switch those features on for the matching account. If you turn on an experimental feature under Settings, we remember that choice on your account. Both stay on our own servers and are deleted with your account.
• When you last used the App. A single date and time on your account, refreshed while you are signed in (at most every 15 minutes). We use it to see how many people come back, to help when someone reports a problem, and to avoid sending a notification you do not need - such as a morning summary right after you opened the App, or the Sunday reminder if you have already been in that day. It stays on our own servers - no third party receives it - and it is deleted with your account.
• Email we send you. Right after you sign up we send you one welcome email, in your language. Our emails are sent through SendGrid (see §3), which receives your email address, your name and the message. Links in them pass through SendGrid's click tracking; we do not track whether you open an email. We keep, on your account, a record of what happened to each email - delivered, bounced or refused, marked as spam, a link clicked, or unsubscribed - with your email address, so we can tell whether our emails reach people. Separately, the App asks whether you also want product updates or surveys by email: each is its own choice, off until you turn it on, and you can change it in Settings or with the unsubscribe link in any such email. When you change a choice, your address is added to or removed from SendGrid's unsubscribe list for that kind of email so it is respected on both sides, and an unsubscribe made through SendGrid is recorded on your account. Replies to our emails reach support@dolecular.com.

We do not collect: payment information (no paid features are live), advertising identifiers, location data, contacts, or photos from your device (only the recipe photos you choose to add, see §1). No advertising SDKs are integrated. The App itself runs no third-party analytics: the only usage measure is the last-used time above, which stays on our own servers.

We do not use personal information to make automated decisions about you (Law 25, s. 12.1). Voice commands do use AI, but all it does is turn a sentence into an entry - a todo, note or grocery item - that you can see, edit and delete; that is not a decision about you or anyone else. If that ever changes, we will tell you before it does and explain how to contest the decision.

Storage on your device. So the App works, it keeps a few small items on your device: your signed-in session (held by Firebase Authentication), your language choice, the voice you picked for reading answers aloud, whether you have dismissed the install prompt, and a copy of the App's own files so it loads faster. Nothing in it is used to track you or for advertising. If you arrive through a friend's invite link, the invite code is also kept there until your account has been created. Clearing the site's data in your browser (or uninstalling the app) removes it.

Website analytics (marketing site only) - off unless you turn it on

The marketing website at dolecular.com can load Google Analytics 4 to help us understand which pages people read. It is strictly opt-in: on your first visit a banner asks you to Accept or Decline, with both choices presented the same way. Until you click Accept, the Google Analytics script is never loaded, no Google Analytics cookie is set, and no analytics request reaches Google. If you click Decline, none of that happens and the site keeps working exactly as before - declining costs you no functionality. It is not used on the App itself, and it never receives your account, household, or device data.

• Your choice is remembered on your own device, in one browser local-storage entry (DolecularConsent) recording whether you accepted, the version of the notice you answered, and the date. This record stays on your device and is never sent to us.
• If you accept, Google Analytics sets its own cookies (_ga and one named _ga_J4L0YYEF5Z) holding a randomly generated identifier for your browser. It receives the page paths you view, the site that referred you, your approximate region derived from your IP address, and your browser/device type. We never send Google your email, display name, account id, or any other direct identifier.
• To change your mind, use the "Cookie preferences" link in the site footer - it reopens the same banner at any time, so you can withdraw consent as easily as you gave it. Withdrawing deletes the Google Analytics cookies and reloads the page so the analytics script is gone.

2. Why we collect it, and our legal basis

3. Who we share it with

We do not sell your personal information and we do not share it for advertising. We share it only with the providers necessary to run the App and its website, each acting as a service provider under its own data-processing terms:

• Firebase (Google) — authentication and push notification delivery. The text of each notification, such as a todo's title, the name of a grocery item or the first item of your day, passes through it.
• Supabase — the database holding your account, household, and family data.
• SendGrid (Twilio) — sends our emails. It receives your email address, your name and the content of each email we send, tells us what happened to it (delivered, bounced, a link clicked, unsubscribed), and keeps the unsubscribe list for product updates and surveys. It keeps its own sending records under its own terms.
• Google Cloud Run — hosts the App's API, and keeps ordinary server logs (IP address, the address requested, the time).
• Google Gemini (Generative Language API) — three separate uses, each only when you use the matching feature. If you turn on voice commands (Live mode included): receives the text of what you say, to work out what you meant, plus the household context needed to interpret it correctly - the display names of your family members (including yours, as the speaker, and any managed profiles), your note category names, and, if the AI asked you a question, the earlier turns of that same exchange. It is not given your recipes, lists or plans to answer a question: those are looked up in our own database (see §1). If you use "Fill in from photo" on a recipe, or import several recipe photos at once: receives the photo itself, and your family's own existing recipe tag names, so it can reuse one you already use instead of inventing a near-duplicate. If you import a recipe from a web link: receives the ingredient lines, title and categories that the page publishes with its recipe, or - when the page publishes no structured recipe - the text of the page, together with your family's existing recipe tag names; it is not sent the web address. None of the three uses sends your email address or account id - and unlike voice, the photo and web-link uses never send your display name either. We use Gemini under Google's paid-services terms: Google does not use what it receives to train its models or improve its products, and keeps it only for a limited time to detect abuse.
• Your device's or browser's speech recognition — only if you use the microphone. It is not one of our service providers: it is whatever your device or browser uses to hear you (Google on Android and in Chrome, Apple in Safari, or another maker's), and it may receive the audio under its own terms. We never receive the audio. In Live mode it stays on, round after round, until you stop it, so it can also hear anyone speaking near you.
• Your device's or browser's text-to-speech — only if you have an answer read aloud. It is not one of our service providers either: the text of an answer is spoken by your device's own engine, using only voices that run on the device, so we send nothing out to have it read. We do not run or control that engine.
• The websites you import recipes from — when you import a recipe from a web link, each receives one request for the page and one for its photo, made by our server, not your device. It shows our server's address, not yours, and identifies itself as Dolecular; it sends no cookies and nothing about you. These websites are not our service providers and receive no personal information from us; their own terms and privacy policies apply to them.
• Google Analytics (marketing website only) — receives website usage data, as described in §1. It never receives your account or household data.

We may also disclose personal information where required by law, or where necessary to investigate a credible threat to the safety or rights of a user or of Dolecular.

Who at Dolecular can see it

Support and statistics are done through an internal admin page that only Dolecular staff can open, by signing in with a verified company Google account. It shows your account details (email address, display name, when you joined and last used the App, which households you belong to and your role in them, which consents you have given, and whether notifications are on) and counts and outcomes of what happens in the App - for example how many todos exist, or whether a voice command worked. It does not show what your todos, notes or grocery items say, or what you said to voice commands, and the database account behind it is technically unable to read them. The one exception is feedback you choose to send us from Settings: you wrote it for us to read, so staff can read it there, together with the email of the account it came from so we can reply. Staff can also see who invited whom through an invite link, so they can thank people personally, and can note that a thank-you was sent; they cannot read anyone's invite code. Staff also add and remove people on the early-access list. The admin page shows how many recipes were read from photos or web links and whether they worked, but not which websites you imported from, and not your timers; the record of which website a recipe was imported from can be read only in the database itself, by the person described next. The person in charge of running Dolecular can still reach the database itself to maintain it and keep it secure, and can read the voice transcripts described above during the 90 days they are kept.

4. Where your information goes, and how long we keep it

Transfers outside Québec

Our servers are currently hosted in the United States. If you are in Québec or elsewhere in Canada, your personal information is transferred to and stored in the United States.

Law 25 (s. 17) requires us to assess the privacy factors of that transfer and to satisfy ourselves the information would receive adequate protection. In short: the information is limited to what running a household-organization app needs, each provider is a service provider bound by written terms, and the transfer is necessary to run the App at all. The residual risk we could not mitigate is U.S. government compelled access to data held by U.S. providers; we disclose that rather than gloss over it. Written data-processing agreements are in force with Supabase and Google Cloud (which also covers Firebase).

Retention

• Account and household data: retained as long as your account exists.
• Things you delete: when you delete a todo, note, grocery item, pantry item, planned meal or recipe, it moves to "Recently deleted" (in the menu and in Settings) and stays there for 30 days so you can bring it back; a recipe keeps its photo meanwhile. Everyone in your household can see what is there. After 30 days, or as soon as you choose "Delete forever", it is removed for good. While we hold it, it is included in "Download a copy" and it is deleted with your account.
• Device tokens: kept while the device is still registered for notifications. A token is removed automatically once Firebase tells us it is no longer valid - typically after you uninstall the App or clear its data - and when your account is deleted. Turning notifications off, in the App or in your device's own settings, stops the reminders but does not by itself delete the stored token.
• Notification choices, and who added a grocery item: kept while your account exists, and deleted with it (a grocery item you added stays with the household once your name has been removed from it). Your choices are included in "Download a copy".
• Voice command transcripts: automatically cleared 90 days after each command, by a daily job - whether or not you keep voice enabled. We keep a record that a command happened (when, whether it worked, how long it took, and which way you started it - the microphone in the App, a shortcut, a tile or a widget) for longer, to measure whether the feature is working, but not the words you said.
• Live mode: what it hears is kept like any other voice command - the text for up to 90 days, then cleared by the same daily job. We keep nothing of the audio, because we never receive it. Live mode keeps no other record of its own.
• Recipes read from a photo or a web link: the recipe you save is kept like any other recipe. For each recipe read from a photo or a link we also keep a record that it happened - who, when, whether it worked, how long it took and what it cost to read, and for a web link the website's host name - while your account exists, and it is deleted with it. A recipe's web address stays on the recipe until you remove it or delete the recipe. Your agreement to link import is kept with your other consent records.
• Kitchen timers: deleted as soon as someone stops them; a finished timer nobody stopped after 12 hours, and a paused one after 24 hours, are deleted automatically by a daily job. When someone leaves a household, their timers stay with it, no longer belonging to anyone, until they are stopped or deleted that way. If a household has only you in it, its timers are deleted with your account. Timers are not part of "Download a copy", because they last hours, not days. Alarms your device sets for a timer stay on your device and are cleared by it.
• Email: the record of what happened to each email, and your choices about product updates and surveys, are kept while your account exists and deleted with it. SendGrid keeps its own records under its own terms.
• Invitations: your invite code and, if you joined through a friend's link, which account invited you and when, are kept while your account exists and deleted with it. If the person who invited you deletes their account, the link to them is removed and your account stays. They are included in "Download a copy" (your code, how many people joined through it, and whether and when you joined through a friend - never who).
• Early-access features: your place on the early-access list (your email) and any experimental features you turned on are kept while your account exists and deleted with it. They are included in "Download a copy" (the features you turned on, and whether your email is on the list).
• Feedback you send: kept until we have dealt with it, and in any case deleted when your account is deleted. It is included in "Download a copy".
• Website analytics: subject to Google Analytics' standard retention for the property.
• After account deletion: personal data deleted or irreversibly anonymized within 30 days.
• Deletion requests: when we delete an account at your request, we keep a note that it was done - the date, and which staff member did it. It refers to you only by a one-way code that can't be turned back into your identity, so it can be shown as proof the request was handled without identifying you.

Doing it yourself: Settings has a "Download a copy" button, which gives you everything we hold about you and your households as a single JSON file, and a "Delete your account" button, which acts immediately rather than within the 30 days the law allows. Deleting removes your account, your settings, your consent records, your voice command history, the record of recipes read from photos or web links, any feedback you sent, your invite code and any record of who invited you, your early-access choices and place on the early-access list, and anything only you could see. Content you added to a household you share with other people stays with them, no longer attributed to you - they depend on it, and it isn't ours to take from them. Anything you'd rather not do yourself, or any other request under §5, still reaches a person at privacy@dolecular.com.

5. Your rights

Whether you are in Québec (Law 25), elsewhere in Canada (PIPEDA), or in a U.S. state with a consumer privacy law, you have the right to:

• Access — get a copy of the personal information we hold about you.
• Correct — have inaccurate information corrected (you can change your name yourself in Settings).
• Delete — request deletion of your account and associated personal information.
• Portability — receive the personal information you provided to us in a structured, commonly used format (Law 25 s. 27).
• Object or restrict — object to processing, where applicable.

How to exercise them: contact the person in charge of the protection of personal information at privacy@dolecular.com. We respond within 30 days as Law 25 requires. If you're unhappy with our response, you may complain to the Commission d'accès à l'information du Québec (CAI), the Office of the Privacy Commissioner of Canada, or, if you're a U.S. resident, your state's Attorney General.

6. Children's privacy

Dolecular is built for use by adults coordinating a household. A child or dependent can be represented in a family only as a managed profile added and controlled by an adult Family Admin - they do not create their own account or provide personal information directly to us. If we learn we have otherwise collected personal information directly from a child without the consent Law 25 requires, we will delete it. If an adult in your family uses voice commands, the display names of everyone in the household - managed profiles included - go to the AI service along with the request, so it can tell who a reminder is for (see §3). If you would rather a child's full name not go there, give their managed profile a first name or a nickname. Voice also hears whoever is near the microphone: in Live mode, where the microphone stays open, what a child or anyone else says nearby can be picked up like the speaker's own words (see §1). Stop or pause Live mode when that is not what you want.

7. Privacy by default

Household content is visible only to members of the same family, per their role - there is no cross-family visibility and no public profile. Where the App offers a setting that affects the privacy of what you share, it defaults to the most privacy-protective option (Law 25, s. 9.1).

8. Security and confidentiality incidents

Sign-in is handled by Firebase Authentication (industry-standard hashing; we never see a plaintext password). The API validates every request's identity token directly against Google's published keys, and a server-side authorization check restricts each request to the requesting user's own family - a request can't read or write another family's data even with a valid token. Database credentials are stored in Google Secret Manager, not in application code.

No system is perfectly secure. If a confidentiality incident (Law 25's term for a breach) occurs and it presents a risk of serious injury, we will notify the CAI and the affected people promptly, and we maintain a register of confidentiality incidents as the law requires.

9. Contact

Person in charge of the protection of personal information: Nicolas Lemire, Founder — privacy@dolecular.com. General/support contact: support@dolecular.com. Service & Logiciel Dolecular, 1915 rue Beausite, Saint-Jérôme, Québec J5L 1E4, Canada.

10. Language

This policy is published in English and in French, at /privacy and /fr/privacy. You can switch language at any time.

11. Changes to this policy

We may update this policy as the App's data practices change (new features, integrations, monetization). Material changes will be announced in the App before taking effect, and the effective date above will be updated. Where a change affects what you agreed to, we will ask for your consent again.

Companion document: the Terms of Service.