Back to Home

Privacy Policy

Last updated: September 8, 2026

1. Privacy Officer

Origano is operated by Jean-François Côté. Our Privacy Officer is:

  • Name: Jean-François Côté
  • Title: Founder and Privacy Officer
  • Email: [email protected]

Any request regarding your personal information should be directed to this person. We will respond within 30 calendar days of receiving your request. This period may be extended by an additional 30 days upon written notice.

2. Personal Information We Collect

In connection with providing our services, we collect only the following personal information:

  • First and last name — collected at registration or upon first login, in order to personalize your experience and communicate with you in a personalized manner.
  • Email address — used to create your account, authenticate you, and communicate with you.
  • Password — stored in encrypted form (BCrypt hash); we do not have access to it.
  • User-created content — recipes, recipe books, meal plans, and preferences you enter in the application. This content belongs to you.
  • Technical data — session data necessary for the proper functioning of the application.
  • Referral code: only if you created your account after following an ambassador's link, we keep that person's code on your account so that we can credit them. The code identifies them alone and reveals nothing about you.

We do not collect sensitive information, payment card data, or any information about minors under 14 years of age.

3. Purposes of Collection and Use

The information collected is used solely for the following purposes:

  • Creating and managing your user account.
  • Allowing you to access your personalized data (recipes, meal plans).
  • Sending you transactional communications (password reset, account confirmation).
  • Processing Pro subscription payments.
  • Ensuring the security, reliability, and continuous improvement of the application.

We do not sell your information and we build no advertising profile. The information you entrust to us (name, email, recipes, menus) never leaves our servers for advertising purposes. The application carries no advertising and no product recommendations, on either plan.

4. Disclosure to Third Parties: Sub-Processors

Your personal information is not sold or rented to third parties. It may however be shared with the following sub-processors solely for the purpose of delivering our services:

  • Resend (email delivery) : your email address is transmitted for sending transactional communications.
  • Stripe (online payments) : your email address is shared to create a customer record. Payment card data is handled entirely by Stripe and never passes through our servers.
  • Google Analytics (audience measurement) : used to analyze application usage in an aggregated manner. This service places analytics cookies (_ga, _ga_*) only with your prior consent. Google may process this data in the United States.
  • Microsoft Clarity (journey analysis) : used only while you are signed in to your account, and only with your prior consent. This service records your navigation inside the application (pages visited, clicks, scrolling, mouse movement) to show us where the interface wastes your time. Passwords and everything typed into a form field are masked before being sent, and your email address is masked in the recordings. So that the visits of one account can be linked together, your email address is turned into a digital fingerprint by your browser before being sent: Microsoft never receives the address itself. Your account's internal number travels alongside that fingerprint so we can recognise you. Neither your name, nor your postal address, nor your recipes are passed on. This service places cookies (_clck, _clsk). Microsoft may process this data in the United States.
  • Anthropic (Claude AI) (AI parsing) : used to extract a recipe structure from a web page, both during URL import and during an import made with the browser extension (see section 9). No personal data is transmitted; only the content of the page being viewed is sent.
  • Legal obligation : if required by law or in response to an order from a competent court.

These providers may be located outside Quebec. In such case, we ensure they provide an adequate level of protection as required by Quebec's Act respecting the protection of personal information in the private sector (Law 25).

5. Retention Period

  • Active accounts — retained for the lifetime of the account.
  • Deleted accounts — permanently deleted within 30 days of the request.
  • System logs — retained for 90 days, then destroyed.
  • Reset tokens — automatically expire after 24 hours.

Some data may be retained longer if required by a legal obligation.

6. Security Measures

We implement reasonable and appropriate security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include password encryption (BCrypt), encrypted communication (HTTPS/TLS), CSRF protection, and data access controls.

In the event of a privacy incident likely to cause serious harm, we will notify you and inform the Commission d'accès à l'information du Québec within 72 hours, in accordance with our legal obligations.

7. Cookies

Origano uses four categories of cookies:

  • Essential cookies — required for the application to function (authentication, CSRF security, language and theme preferences, remember-me login). They are set automatically and cannot be refused without impairing the use of the service.
  • Analytics cookies (Google Analytics, Microsoft Clarity) : set only with your explicit consent. They let us measure audience in an aggregated manner (_ga, _ga_*) and, for signed-in accounts, record the journey through the application so we can fix what blocks it (_clck, _clsk). You may withdraw your consent at any time from your account settings, under “Usage data”.
  • Referral cookie: set only if you arrive through the link of an ambassador, someone who recommends Origano (origano_ref, kept for 90 days). It lets us credit them if you go on to create an account. It holds nothing but that person's code, no data about you. It is read by no third party and serves neither advertising nor profiling. Clearing your browser data removes it.
  • Advertising cookies — we set none. The application contains no ad network, no affiliate links to third-party products and no product recommendations, so there is nothing to measure or target.

You may also configure your browser to refuse all cookies, but this may prevent you from using certain features of the application.

8. Your Rights

In accordance with Quebec's Law 25 and the Act respecting the protection of personal information in the private sector, you have the following rights:

  • Right of access — You may request to view the personal information we hold about you.
  • Right of rectification — You may correct your information directly in your account settings.
  • Right to erasure: you may delete your account and all your personal information directly in the application. See how to do it.
  • Right to data portability — You may download a copy of your data in JSON format directly from your account settings.
  • Right to withdraw consent — You may withdraw your consent to analytics cookies at any time from your account settings, and withdraw your consent to the processing of your data by deleting your account.

For requests that cannot be handled directly in the application, write to [email protected]. We will respond within 30 calendar days.

If you believe your rights have not been respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI) at www.cai.gouv.qc.ca.

9. Browser Extension

Origano offers an optional extension for Chrome and Firefox that imports the recipe from the page you are viewing. Installing it is never required to use Origano.

What the extension reads. It reads the content of the page in the active tab only at the moment you click its icon. It runs on no page until you ask it to, does not follow your browsing, and has access to neither your history, nor your other tabs, nor any page you view without clicking its icon.

What is transmitted. On that click, the content of the page is sent to our servers, then to Anthropic (see section 4), for the sole purpose of extracting the ingredients and the steps. That content is not retained: only the resulting recipe is saved in your account, exactly like a recipe you would have typed in by hand. If the extraction fails, we keep the address of the page and the error message so that we can fix the problem.

What is kept in your browser. The extension stores locally, on your device only, your access key along with the last recipe book and meal types you selected. None of this is transmitted to any third party.

The access key. It links the extension to your account and stands in for your password, which the extension never learns. We keep only a cryptographic fingerprint of it, never the key itself. You can review your connected browsers and revoke a key at any time from Browser extension in your account menu. Revoking cuts that browser off on its next use.

The extension contains no analytics, no advertising and no trackers.

10. Changes to This Policy

We may modify this policy from time to time to reflect changes in our practices or applicable law. In the event of a significant change, we will inform you by email or through a prominent notice in the application. The date of the last update appears at the top of this page.