Privacy & Cookies

The data controller is Khalid Ajjaoui, an individual based in Italy. Deketox does not have its own VAT number.

For any request about your data, write to info@deketox.com. We do not publish a physical address: this email is the point of contact.

Newsletter: if you subscribe, we collect your email address with your explicit consent, for the sole purpose of sending you the newsletter. We also record when you gave that consent and which version of the wording you accepted, so we can show how and when the subscription happened.

Payments (premium): handled entirely by Stripe. We never store your card details on our systems.

Link statistics: when you click an outbound link we log the event; the IP address is stored only in hashed form, never in plain text.

Admin area: access is limited to the site administrators.

What you get: on Friday, a roundup of the new articles published on Deketox over the previous seven days. If we publish nothing in a given week, you get no email.

How you subscribe: you enter your address and we send you a message with a confirmation link. The subscription only becomes active when you click that link, which is valid for seven days. Until then we never write to you: this is what prevents someone else from subscribing your address on your behalf.

How you unsubscribe: every email contains an unsubscribe link. One click is enough — you don't need to log in anywhere or write to us. You can also ask us by email if you prefer, but it isn't necessary.

We don't use your address to profile you, we don't pass it to anyone, and we don't use it for third-party advertising.

We use technical cookies necessary for the site to work (e.g. session, consent storage).

Only after your consent do we enable Vercel Web Analytics, an aggregate and anonymous statistics tool that does NOT use cookies and does not profile individual users: it tells us how many people visit each page, without identifying you.

If you decline via the banner, no analytics tool is loaded.

Some links to Amazon and other partners are affiliate links: if you buy through them we may earn a small commission, at no extra cost to you.

To run the service we rely on providers that process data on our behalf: Vercel (hosting), Supabase (database and authentication), Resend (email delivery: subscription confirmation and newsletter), Stripe (payments), Upstash (security/anti-abuse) and Amazon (affiliate programme).

Some of these providers may process data outside the EU, with the safeguards required by law.

Newsletter: your email address stays in our systems while your subscription is active; if you unsubscribe we delete it within 30 days. If you sign up but never click the confirmation link, we delete it within 30 days of signup.

Link statistics: click events (with hashed IP only) are kept for a maximum of 12 months, then deleted or fully aggregated.

Premium subscription: billing data is kept by Stripe for as long as tax obligations require.

Backups: database backups are kept for up to 90 days and then automatically deleted.

You have the right to access your data, rectify it, erase it, restrict its processing, object to it and request its portability.

To unsubscribe from the newsletter, the link in every email is all you need: no need to contact us. For the other rights, write to us at the site's email address. You may also lodge a complaint with the competent supervisory authority.

If you use the app's personal space we record what you write in the diary (foods, amounts, times), your goals, the weekly menu and the shopping list. If you give them, we also record year of birth, biological sex, height and weight: they are only used to work out your goals, and you can set those by hand without giving them.

This is health data, a special category under Article 9 GDPR. The legal basis is your explicit consent, Article 9(2)(a): we ask for it with a dedicated tick box, separate from every other consent and never pre-ticked, and we record when you gave it and which version of the text you accepted. Without that consent the app records nothing.

You must be at least 18 to use the app and declare it when you sign up. No password is needed: you get in with a six-digit code sent to your email, valid for 15 minutes and usable once. The app account is independent of the newsletter: you can have one without the other, and unsubscribing from the newsletter does not touch your diary.

The data sits on servers in the European Union, in Ireland, run by Supabase and Vercel on our behalf. It never enters any analytics tool and is never sent to artificial intelligence services.

From your profile you can download all your data at any time, as a complete JSON file or with the diary as CSV. You can withdraw your consent with one click: the diary stays, becomes read-only, and you can still download or delete it, because withdrawing consent and asking for erasure are two different things. You can also delete the account: it becomes inaccessible at once and is permanently erased within 30 days, along with everything in it.

If you do not sign in for 24 months we write to warn you and, if you do not come back within the following 30 days, we delete the account: we do not keep health data belonging to people who have stopped using the service.

This notice may be updated. The applicable version is always the one published on this page.

If you are subscribed to the newsletter and confirm your address with a one-time code, you can write reviews on recipes and comments under articles. We publish only the name you choose, the text, any rating and the date: your email is never shown.

We keep the link between the contribution and your subscription, so that you can edit or delete it, and a hash of your IP address (never the plain IP) as a defence against automated abuse; the hash is deleted after 12 months.

You can delete your contribution at any time from the same page where you wrote it. If you unsubscribe from the newsletter, your contributions are anonymised.

An automatic filter holds back texts in which we recognise an account of an ongoing medical treatment: we do not publish them before reading them, because we do not want to accidentally spread information about your health that you did not ask us to publish.

In the Personal stories section you can tell your experience, one chapter at a time. If you choose to, that account may contain information about your health: this is special category data under Art. 9 GDPR and we process it only on the basis of your explicit consent, collected with a dedicated checkbox before publication.

Every chapter is read by a person before it is published. The purpose is to check that the text contains no health information about third parties, no medical advice addressed to other readers and no promises of healing.

We publish the signature you choose, the text, and your age range and city if you provide them. We recommend a pen name: if you decide to use your real name we ask for a second consent, because that link remains in search engines even after deletion.

You can withdraw your consent at any time with one click: the story and its comments disappear from the site immediately and the text is permanently deleted after 30 days. That window exists only to undo an accidental withdrawal.

Published text can be indexed by search engines and copied by third parties beyond our control: that is a consequence of publication over which we have no power.