Privacy

José Antonio Neto Suárez (Utropía), tax ID 29607219D, C/ Manuel Vela 37, 13, 21440 Lepe (Huelva), Spain. For anything about your data: hello@utropia.es.

Recipe, guide, problem and tool pages are served without cookies, without a session and without analytics: no visit is measured today. If visits are ever counted, it will be without cookies and without identifying you, and this page will say so first.

The app works without an account. What you log (your jars, their check-ins and readings, your cultures and recipes, your level, kit and interests, your tasting notes and the photos of each check-in) is kept only in your browser’s storage. It is not sent to our server.

Photos are shrunk and kept on your device. From “Me” you can download a copy of your jars. To erase everything, clear this site’s data in your browser settings; deleting a jar deletes its photos too.

If you add the app to your home screen, your device keeps its files (code, typefaces and icons) to open it instantly. It keeps nothing of yours.

The account is optional: it is for a copy of your diary and for Fervida+. You sign in with your email, no password: we send you a six-digit code that works for 15 minutes and only once. We keep your email and your language; the code, hashed, is deleted once used or, at the latest, a day after it expires.

When you sign in, your browser receives a key that it keeps in its storage (it is not a cookie) and that the app sends with each request. The server keeps only its hashed fingerprint and when it was last used. A key unused for a year is deleted; just sign in again.

Your diary’s copy holds the same as your browser: your jars with their check-ins, readings, temperatures and notes, your tastings, your cultures, your recipes, your level, kit and interests. It updates itself a few seconds after each change, so you have it on all your devices.

The basis is the contract you accept when creating the account: without this data we couldn’t keep your copy or give you Fervida+ (GDPR article 6.1.b).

Without Fervida+, check-in photos stay on your device. With Fervida+, they are also copied to your account, shrunk, so you see them on all your devices: we keep them on our server, privately, and serve them only to your account. If Fervida+ ends, those already copied stay and no more are copied.

A photo is deleted from the account when you delete its jar, from any device, or when you delete the account.

If you connect an electronic hydrometer (iSpindel, Tilt, RAPT Pill or another) with Fervida+, we keep its name, its secret address and what it sends: gravity, temperature, battery and when, tied to the jar you put it in. The device, or its maker’s service as you set it up, sends those readings straight to that address.

Readings are deleted with their jar, with the sensor or with the account; those of a sensor in no jar, after a week.

If you turn notifications on in “Me”, your browser gives us the address where its maker (Google, Apple, Mozilla or Microsoft, depending on the browser) delivers its notifications and the keys to encrypt them, and gets back a key of its own, kept in its local storage. No account is needed. If you are signed in, it is tied to your account: when the community arrives, that is how we will tell you about replies to what you ask.

Your browser works out what is due over the next two weeks (each check-in, each reading, each feeding of a culture) and leaves us, for each notification, only the time, the title (the name of the recipe or culture), its line and the page it opens. Nothing else about your jars leaves your browser.

At its time, the server sends the notification, encrypted, to your browser’s push service, which delivers it without being able to read it. A sent notification is deleted after two days; the browser, when you turn notifications off, when its maker tells us it no longer accepts them, or after three months without opening the app.

The basis is your consent: the permission you give the browser, which you withdraw whenever you like from “Me” or from its settings (GDPR article 6.1.a).

Posting in the community needs the account and a name, which can be a nickname. What you post (your questions and replies, the photo you add and, if you ask from a jar, its recipe, day, salt, temperature, pH and gravity) is public and anyone can read it. The photo is shrunk and stripped of what the camera stores inside it, location included.

Before it goes out, every post goes through an automatic review with AI. AI also writes the first answer to each question and translates every post into the other language. This is done by OpenAI (OpenAI Ireland Ltd., Ireland, with OpenAI, L.L.C. in the United States), which handles the text and the photo on our behalf and only for this: it does not use them to train its models, and we ask it not to keep them, apart from what its abuse monitoring retains for at most 30 days.

We keep who follows each thread, to tell you by email or on your devices when someone replies; every email has a link to stop following it. We also keep which replies you mark helpful and the reports you make, for a year.

What you delete disappears at once and is erased for good after 30 days, as is what the review turns down. If you delete your account, what you wrote stays in the conversations it belongs to, but without your name, and the photos of your questions are deleted; if you want the text erased too, delete it first or write to us.

The basis is the agreement you accept when you post: without this data we couldn’t show or moderate what you write (GDPR article 6.1.b).

Sign-in codes and purchase confirmations are sent by Resend (Resend, Inc., United States), which handles your address on our behalf and only to deliver them. We send you no advertising.

Fervida+ is sold by Creem (Armitage Labs OÜ, Estonia), acting as merchant of record: it charges you, issues the invoice and handles taxes and refunds. To do so it handles the purchase data (your email, your country and payment method) as an independent controller, under its privacy policy (creem.io/privacy).

Fervida passes it your email and a purchase identifier, and receives from Creem only what it needs to open Fervida+: which plan you have, until when and your customer identifier at Creem. Fervida never sees your card number.

We keep each purchase attempt for thirty days and Creem’s payment notices for a year, to sort out any incident. Creem keeps the invoices as long as the law requires.

Resend may handle your email in the United States, under the standard contractual clauses approved by the European Commission, which bind whoever receives the data to protect it as the GDPR requires. Creem is in Estonia, inside the European Union. Notifications go through your browser maker’s push service, which may be outside Europe; they are encrypted and it cannot read them. OpenAI may handle what you post in the community in the United States, and Laravel and Cloudflare (see “Where Fervida lives”) are United States companies, all under the same standard contractual clauses.

The website, the app and the database run on Laravel Cloud (Laravel Holdings Inc., United States), on Amazon Web Services servers in Frankfurt (Germany), behind Cloudflare’s network, which protects them and serves them fast. Photos from accounts and from the community are stored on Cloudflare R2 under European Union jurisdiction. All of them handle data on our behalf and only to provide the service.

Like any website, the server logs the requests it receives: IP address, date, page requested and browser. This keeps the site working and helps detect faults and attacks. These logs are not combined with anything or used to profile anyone, and are kept for the minimum time needed. The basis is the legitimate interest in a working, secure website (GDPR article 6.1.f).

The account and its copy, for as long as the account exists. From “Me” in the app you can delete it whenever you like: your email, your diary’s copy, its photos, your sensors with their readings, your keys and your purchase attempts are deleted at once, and a subscription is cancelled so you are not charged again. Your jars stay in your browser, and so do their notifications, now without an account.

If you write to hello@utropia.es, we use your address and what you tell us to reply, and keep it as long as the conversation needs.

Fervida sets no cookies, on the website or in the app, and uses none to measure you, track you or advertise. The only one that may reach your browser is set by Cloudflare, the network that protects the server, to tell people from bots (“__cf_bm”, it lasts 30 minutes). It is technical and necessary for the site to run safely, so it needs no consent: that’s why you won’t see a cookie banner.

You have the right to know what data there is about you, to correct it, have it erased, restrict its use, object and take it with you. What is in your browser is already in your hands; you download your diary from “Me”, and delete the account from there too. For anything else, write to hello@utropia.es and we will reply within a month. You can also complain to the Spanish Data Protection Agency (aepd.es).

If this policy changes, the date above changes and what is new is explained. It never changes silently.