Privacy notice

This notice describes what Nutella Index does with personal data. It matches what the code does. If the two ever disagree, the code is the bug.

Nutella Index is run by a private individual, not a company. That person is the data controller and can be reached at info.nutellaindex@gmail.com. There is no data protection officer: the project is too small to require one.

The lawful basis for publishing observations is legitimate interest: running a public, comparable price index. Reviewing submissions and preventing abuse rests on the same basis. Your email address is used only to contact you about your own submission.

You can object to processing based on legitimate interest at any time. See "Your rights" below.

A published observation shows the country, the city if you gave one, the date, the package weight, the normal price and currency, the price per 100 g in euro, the offer price if the jar was on offer, the store or retailer if you gave one, and the photo.

Your name appears next to it only if you choose "Publish my name" on the form. If you choose "Publish anonymously", the observation is credited to "Anonymous User" and your name is stored but never displayed. Your email address is never published in either case.

The city, if you give one, appears on the observation's public page and on the country page. It is where you saw the price, not where you are, and it is never used to place anything on the map, which stays at country level.

Published observations are also part of the downloadable dataset, which anyone may reuse under the CC BY 4.0 license. The file holds the same details as the public page, city and store included, but never your name, your email or the photo.

By uploading a photo you confirm you are entitled to do so and you grant the license described in the legal notice.

Photos are re-encoded on upload. That strips all embedded metadata, EXIF and GPS coordinates included, before anything is stored. The original file is never kept, only resized copies at three widths. Please do not photograph faces, receipts, payment cards or other personal details. A moderator can remove an image without deleting the observation.

A published photo can also be found by search engines: it is listed in our image sitemap and in the structured data of the observation page.

We never ask for or record your device location. The browser geolocation API is disabled site-wide by a Permissions-Policy header, so the site cannot request it even by accident.

The coordinates behind the map are country centre points, resolved once per country from Mapbox geocoding and stored. They describe a country, not you and not a shop.

The site sets no advertising or profiling cookies, and there is no Google Analytics, ad pixel or fingerprinting script. Three technologies do process data:

Whether this narrow set requires a consent banner under Italian and EU rules is under legal review. Until that review concludes, the site ships this notice and no banner, and no new tracker will be added in the meantime. If the answer is that consent is required, a banner and a persistent "Cookie settings" control will be added and this notice updated.

• Vercel Analytics: aggregate page-view counts. Cookieless; it does not store an identifier on your device.
• First-party page-view logging: the page path, a truncated user-agent string and a timestamp, written to our own database. No cookie, no identifier, no IP address stored. When a search returns nothing we also store the search text, truncated, so we can see which data is missing; it is not linked to you, because we keep no identifier. On one visit in ten we also record how long the page took to load and respond: numbers only, with no identifier attached.
• Mapbox GL JS: loads only on the map page, because the map cannot work without it. Your IP address reaches Mapbox as part of requesting map tiles.

The site stores a few small settings in your browser. They are there to make the site work, they never track you and they are not sent to us.

• Your display currency (localStorage, "nutella-currency"), so your choice survives a reload.
• The last price the random button picked (sessionStorage, "nutella-random-last"), so it does not repeat itself. It goes away when you close the tab.
• A contribution draft you have not sent and the map notice you dismissed (sessionStorage). Both go away when you close the tab.
• A timestamp (localStorage, keys starting with "nutella-index:analytics:") so the same search is not counted twice within half an hour. The key can contain the search text, which stays on your device.

Submission and correction endpoints apply a per-IP rate limit. Those counters live in server memory, are never written to the database, and disappear when the server restarts. Uploaded images are validated by inspecting the actual file signature rather than trusting what the browser claims.

Submission photos are held in a private storage bucket. While a submission is under review its photo is readable only through short-lived signed links generated for a moderator. Once the observation is published, its photo becomes publicly visible on the observation page at a stable address: it is the evidence behind the price, and we say so at submission time. Photos from rejected or still-pending submissions are reachable from no public address.

There are none. No profiling, no automated decision-making with legal effect, and no automatic text extraction from your photo: a person reviews every submission before it is published.

If this notice changes materially, the date at the top changes with it. Substantive changes affecting how contributions are handled will be described on the page rather than made silently.

Every field on the contribution form, whether you must fill it in, and where it ends up.

• Country

  Required?

  Required

  Where it goes

  Published

• City

  Required?

  Optional

  Where it goes

  Published when given

• Observation date

  Required?

  Required

  Where it goes

  Published

• Weight

  Required?

  Required

  Where it goes

  Published

• Price and currency

  Required?

  Required

  Where it goes

  Published

• On offer? (yes or no)

  Required?

  Required

  Where it goes

  Published

• Normal price

  Required?

  Optional

  Where it goes

  Published

• Store name

  Required?

  Optional

  Where it goes

  Published

• Photo

  Required?

  Required

  Where it goes

  Published, resized and stripped of metadata

• Name

  Required?

  Required

  Where it goes

  Published only if you choose to be credited

• Email

  Required?

  Required

  Where it goes

  Never published

• Pending submission

  Kept for

  Until reviewed

• Rejected submission and its photos

  Kept for

  Deleted after review, at most 90 days

• Published observation

  Kept for

  Kept indefinitely, as part of the public dataset

• Contact email address

  Kept for

  Kept with the submission; deleted when the submission is deleted

• Correction reports

  Kept for

  Kept while open, then 12 months after resolution

• Analytics events

  Kept for

  14 months

• Rate-limit counters

  Kept for

  In server memory only, cleared on restart

Every third party involved in running the site. Transfers outside the EEA rely on the European Commission's standard contractual clauses.

• Vercel

  What it does

  Hosting and request logs

  Where

  EU / US

• Supabase

  What it does

  Database and photo storage

  Where

  EU

• Mapbox

  What it does

  Map tiles and country geocoding

  Where

  US

• Vercel Analytics

  What it does

  Aggregate page-view counts

  Where

  EU / US

• Google (Gmail)

  What it does

  The contact mailbox, if you email us

  Where

  EU / US

Fonts are self-hosted at build time, so loading a page sends nothing to Google. Exchange rates are the European Central Bank's and come through frankfurter.app, a free service that republishes them, in a server-side call that carries no user data.

You can ask for access to your data, correction, erasure, restriction or portability, or object to processing based on legitimate interest. Write to info.nutellaindex@gmail.com and say which submission you mean: quoting the reference from the confirmation page is the fastest way. We answer within one month. You can always withdraw your name from a published observation: the observation stays and the credit becomes anonymous.

If you are not satisfied with how a request was handled, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to the authority where you live.

Legal notice