Privacy Policy
1. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Google ID, email, display name, profile photo from Google | Google OAuth |
| Profile | Nickname, nationality, language, currency, bio, avatar, equipped title, YouTube/Instagram links, creator banner | You |
| Location | GPS check-ins, approximate area, tourist area visits | Device (with permission) |
| Content | Questions, answers, photos, footprints, Trips, plans, comments, reports, support tickets | You |
| Usage | Credit history, certifications, saved content, views, interactions, notifications, app logs, analytics events | Automatic |
| Advertising and personalization | Ad or sponsor impressions, clicks, affiliate link activity, recommendation and ranking signals where enabled | Automatic |
| Marketing (optional) | Email for product updates or promotions if you opt in | You (consent) |
2. How we use personal data
- Provide and secure the service (authentication, profiles, Q&A, footprints, check-ins, credits, titles)
- Translate, summarize, recommend, rank, personalize, and improve content discovery using automated services
- Moderate abuse, enforce Terms, and respond to reports and support requests
- Improve features, analytics, reliability, search, safety systems, and service-related AI models or features
- Display, measure, and distinguish ads, sponsored placements, affiliate links, creator banners, paid boosts, and other monetization features where enabled
- Send service notices; send marketing only if you opt in
- Comply with legal obligations
Legal bases (EEA/UK): contract performance, legitimate interests (security, improvement), consent (marketing, optional location features where required), and legal obligation.
Public content, including footprints and Trips, may be used to improve COOKED features, recommendations, search, moderation, and service-related AI systems where permitted by law. If we use non-public content or personal data in a way that requires separate consent, opt-out, or additional notice, we will provide it before that use.
3. Retention
We retain data while your account is active. After account deletion, we delete or anonymize personal data without undue delay, except where retention is required for legal, security, accounting, or dispute purposes (for example, sanction or fraud records for a limited period). Credit and certification records follow the same deletion rules unless a legal exception applies.
4. Sharing within the service
Your public profile, posts, titles, social links you add, and community activity may be visible to other users according to app settings. Exact GPS coordinates are not shown to other users by default.
5. Processors & third-party recipients
| Recipient | Purpose | Data shared |
|---|---|---|
| Google LLC | OAuth sign-in | Account identifiers, email, name, avatar per Google policy |
| Supabase Inc. | Database, authentication backend | Account, profile, content, logs |
| Vercel Inc. | Application hosting, serverless APIs, Web Analytics | Request metadata, IP, page views, API payloads as needed |
| Google (Gemini API) | Machine translation and related AI-assisted service features | Text submitted for translation or processing |
| Amazon Web Services (S3) | Profile and content photo storage | Uploaded images |
| Future payment, advertising, analytics, messaging, maps, AI, creator, or affiliate partners | Payments, ad delivery and measurement, personalization, communications, maps, AI processing, creator or affiliate programs where enabled | Data necessary for the enabled feature, as disclosed when the provider is added |
We do not sell personal data. We may disclose data if required by law or to protect rights, safety, and integrity of the service. Processors act under our instructions; some disclosures (e.g. legal process) may be third-party provision under applicable law.
If behavioral or personalized advertising is introduced, we will provide additional information about the data used, retention period, provider, and how to refuse or manage such advertising where required by law. Sponsored, affiliate, or advertising content will be labeled in the service where required.
6. International transfers
We operate globally. Your data may be processed in the United States, European Union, Republic of Korea, and other countries where our providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or your explicit consent.
7. Your rights & account deletion
Depending on your location, you may have rights to access, correct, delete, restrict, object, portability, and withdraw consent. EEA/UK users may lodge a complaint with a supervisory authority. California residents may have additional rights under CPRA. Korean users may request access, correction, deletion, and suspension under PIPA.
You can delete your account in the app: Profile → Support → Delete account. The confirmation flow explains what will be removed. You may also email imcooked.app@gmail.com. We may verify your identity before responding.
8. Children
The service is not directed to children under 13 (or 16 in the EEA without parental consent). If you believe we collected data from a child unlawfully, contact us for deletion.
9. Security
We use encryption in transit, access controls, and industry-standard practices. No method is 100% secure.
10. Changes
We may update this Policy. Material changes will be notified in-app or by email. Version 2026-08-19 requires renewed consent where mandated.
11. Contact / privacy officer
Data protection inquiries: imcooked.app@gmail.com
Privacy contact for COOKED: same email address.