Potluck, Malta

Privacy Notice

What we collect, why we use it, who sees it, and how to exercise your rights.

Updated 19 October 2026, Version 2026-10-19.4, Draft

Who is responsible

[Legal operator name to be confirmed] operates Potluck from Malta. Contact address: [Malta business/contact address to be confirmed]. Email: help@letspotluck.app.

The operator is the controller of personal data used to run Potluck. This notice addresses the EU General Data Protection Regulation (GDPR) and Malta’s Data Protection Act, Chapter 586. It applies to visitors, members, and people contacting us.

Information we process

Account information includes your display name, email, authentication and verification information, settings, and legal-document versions and dates accepted. Our authentication provider handles passwords; they are not displayed or included in account downloads. If you choose Google sign-in, Google provides your verified email and basic profile details to authenticate your account. We request only sign-in scopes, not access to Gmail, Drive or your other Google content. Google accounts review our agreement separately before using the workspace.

You provide app names, descriptions, URLs, icons, screenshots, visibility choices, testing instructions, questions, answers, ratings, summaries, and completion-dispute evidence. We store published app snapshots, review states, deadlines, manually tracked elapsed time, credit transactions, notification choices, inbox/read status, queued emails, delivery results, support correspondence, and privacy requests. The timer measures elapsed time, not verified activity.

Preview imports retrieve public information from websites, Apple’s App Store, Google Play, or the Chrome Web Store. Infrastructure providers may process IP addresses, browser/request details, and security or operational logs. If you buy credits, Stripe handles the payment on its hosted Checkout page and receives your account email to prefill it; we do not see or store your card details. We keep the order’s credits, price and currency, Stripe’s session and payment references, and whether the payment was completed, refunded or disputed. Local demo orders do not charge money.

Purposes and lawful bases

We process account and testing information to perform our agreement with you: authenticate you, save apps, publish requests you choose to publish, manage feedback and credits, and provide requested features. Required fields are identified; without necessary account details we cannot provide an account.

We rely on legitimate interests for security, preventing spam and duplicate claims, maintaining reliable service, resolving misuse/disputes, and defending legal claims, subject to balancing those interests against your rights. We rely on legal obligations when applicable to rights requests and valid legal requirements.

Email updates for your first reviewer, submitted feedback and requests waiting for credits are on by default. You can turn them off in Settings → Communication. Other optional workflow emails are off until you enable them. Saved notification choices are respected. Where consent is required for optional communications or future tracking, it is separate and withdrawable. Accepting Terms is not blanket consent to personal-data processing. No promotional mailing programme is enabled in this version.

Account integrity and credit corrections

We compare submitted-review relationships, account ages, credit grants, credit movements, and completion-dispute patterns to identify activity that needs an operator check. Operators can inspect the relevant submitted feedback and record findings and award corrections. These checks use service records, not optional PostHog analytics, device fingerprints, phone numbers, or AI-text classifiers. A signal alone does not reject feedback, withhold its reward, or establish that accounts belong to the same person.

We check new signup email domains against a local list of known disposable providers. No email address is sent to an external email-scoring service for this check. Existing members can continue signing in and recovering their accounts. We retain investigation and credit-correction records under the service security, dispute, and rights-request procedures; contact the operator about an incorrect block or correction.

Usage statistics

With your optional consent, EU PostHog measures page usage, app setup, testing workflows and A/B experiments so we can improve the service. It is disabled until you accept analytics in the privacy controls. You can reject it without losing account features and withdraw consent at any time through Privacy preferences in the footer; withdrawal stops future analytics from that browser. We record page usage with query strings and fragments removed and identifiers replaced by screen labels. Authentication and recovery pages are excluded. Requests sent to the provider necessarily include connection information such as the network IP address. Our event payload excludes referrer URLs and device details, and disables geolocation enrichment. An anonymous browser-tab identity supports the recorded event sequences; it does not identify your account. Analytics does not receive your account name or email, app descriptions, review answers, chat messages or password reset tokens as event properties.

Optional product events count setup steps, completion, skips, broad error categories, reviewer-count choices, credit routes and successful app-testing actions. Only fixed labels, counts from one to ten, duration ranges and experiment variants are sent; entered app links, names, answers, free text and current-user ranges are excluded. PostHog uses a random anonymous identity for that browser tab, stored in sessionStorage after analytics consent. Feature-flag requests contain only that identity, the public project token and the approved flag names; no page, app or profile context is supplied. It is not linked to your account ID or email. Person profiles, automatic interaction capture, session recording, heatmaps and geolocation enrichment are disabled. PostHog data is sent to its EU ingestion service; its free analytics plan guarantees at least one year of event availability, which is not an automatic deletion deadline. Our analytics deletion schedule remains to be confirmed before public launch. Opting out stops future captures and clears the SDK’s analytics persistence; the provider may still retain events sent earlier under the configured retention and rights procedures. These counts describe interactions, not a guaranteed count of unique records. Development and demo traffic is excluded from the live service statistics. Provider arrangements and retention must be included in the configuration described below.

Visibility, sharing, and recommendations

Saved apps set to Only you keep their full details visible to their owner. All members apps share full details with signed-in members. Apps set to All members are also shown on the public Home and Apps pages as a summary: name, description, icon, first screenshot, tags, platform names and whether the app has an accepted review. This is on by default and you can turn it off for each app at any time in Edit app. Apps set to Only you are never shown publicly. Visitors cannot see the maker’s name or profile, app destination links, testing questions, other screenshots or feedback through this summary. Turning it off removes the summary from the public pages and deletes its public image copies. Copies made while it was public, including image links and search engine copies, can stay available after you turn it off.

Publishing a request shares a copy of its app details, links, icon, and brief with members even if the saved app is private. Closing a request does not automatically remove that snapshot. Unsubmitted drafts are private to the reviewer. Submitted feedback, ratings, and reviewer display names are available to the reviewer and app author. Operators handling completion disputes can access relevant submitted evidence. Your inbox and preferences are private to your account, subject to necessary operator/provider access.

Dashboard aggregates cover your own apps and submitted reviews. Overall averages include critical feedback and show sample counts; custom rating questions stay separate. Suggestions use categories/platforms, availability, existing claims, and testing preferences. This ranking does not make decisions producing legal or similarly significant effects. We do not sell personal data.

Providers and international transfers

Service providers process information needed for hosting, authentication, database/storage, and email delivery. The software uses Supabase-compatible services and supports Resend for optional workflow emails. Local development uses local services and Mailpit. Email providers receive the address and content needed to deliver enabled messages.

[Live provider identities, processing regions, backup locations, processor agreements, and any international-transfer safeguards have not yet been confirmed. Complete this section before public launch.]

For processing outside the EEA, the deployment information must identify applicable adequacy decisions or suitable safeguards, such as standard contractual clauses where appropriate. Contact us for details or copies of relevant safeguards. Proportionate disclosure may also be necessary to advisers or authorities for legal obligations, security, or claims.

Imported sites receive requests from our importer, not your account email or password. When you add a website, a page-capture service may load the public page to take a screenshot; it receives the page address and nothing about you. Opening an app/store link takes you to a separate service with its own privacy practices. Avoid real customer data, production credentials, or unnecessary sensitive information in test tasks.

Retention and erasure

We keep account/app data while needed for an active account. Published snapshots, submitted reviews, credit ledgers, disputes, and agreement evidence can require separate retention periods for transactions, disputes, and applicable legal obligations. Drafts, email payloads, and operational logs should not be kept indefinitely without a documented reason.

[Retention periods, backup expiry, and deletion/anonymisation procedures remain to be confirmed. Automated account erasure and production retention cleanup are not implemented in this alpha. A workable operator process must be in place before public launch.]

The in-app erasure form requests review; it does not immediately delete the account. Shared review and credit records may require limited retention or anonymisation for a lawful exception or other participants’ rights. We explain any exception and expected timing when handling your request.

Your rights

Subject to applicable conditions, you can request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent for optional processing without affecting lawful earlier processing. Disabling an email preference cancels queued messages that have not begun sending; delivered emails cannot be recalled.

Settings → Privacy offers an account-data download and a request form. The download covers information available through that tool; use a rights request for a complete response, including relevant provider-held information. You can use the contact email above without an account. We may need proportionate identity verification; do not send identification documents unless requested through a suitable secure process.

We normally respond within one month. Where the GDPR permits an extension due to complexity or number of requests, we explain it within the initial month. You may complain to Malta’s Information and Data Protection Commissioner (IDPC), or the competent authority where you live or work, without contacting us first.

Security and changes

Access controls protect account/private-draft data and limit operator access to relevant work. No service can guarantee absolute security. Use a strong password and report suspected unauthorised access.

The version/date above identifies this notice. We communicate material changes where required and explain new processing before introducing it. Updating this notice does not create consent for optional processing.

Related information

Privacy Notice, Terms, Cookies & browser storage, Contact

Your rights (IDPC), Complain to IDPC, Consumer authority (MCCAA)