Privacy Notice

Who operates this app

CulinAI is developed by Rheyven Bausas and is currently in beta testing. This notice describes the data used by the current app, including optional kitchen/health tools and third-party AI/email services. Contact details are at the end of this notice.

Information you provide

• Account: name, username, email, password hash, optional profile photo and bio, account status and login/creation timestamps.
• Community: posts, recipes, uploaded images/videos, likes, comments, ratings, follows, saves, collections, reports and notifications. Your chosen public/private setting affects who can see posts; do not treat uploads as end-to-end encrypted storage.
• Optional kitchen and health details: pantry items and expiry dates; meal/weight logs; diet, allergies, goals, birthdate, measurements, activity level and nutrition targets you choose to enter. You do not need to enter health information merely to accept this notice.
• AI and plans: prompts, selected food photos, relevant recipe/profile context, generated outputs or saved plans/drafts, AI usage/error metadata, selected beta tier, access requests and expiry, plus any admin notes you submit or that administrators record.
• Security and agreements: signup Terms/Privacy version and acceptance time, password-reset challenges/hashed codes and authorization digests, and hashed rate-limit identifiers derived from an email or IP address. The server and hosting provider may also keep operational logs.

Why the app uses it

To create and secure accounts, deliver password-reset codes, show content according to visibility, support community interactions, personalize tools you request, calculate estimates, enforce access/usage limits, review abuse reports, manage beta access and maintain the service. Agreement acknowledgment is not marketing consent and does not require you to use optional health or AI features.

What is sent to other services

• Groq AI: when you use an AI feature, the app sends the relevant prompt, selected photo and context needed for that feature. Depending on the tool this may include ingredients, conversation history, preferences, allergies or nutrition/health targets from your profile. Review what you enter; Groq processes requests under its own terms and privacy practices. Do not assume these requests stay solely on your device or that provider retention is controlled by this app.
• Google/Gmail: password-reset emails contain your recipient email address and a one-time code, sent through the developer’s configured Gmail SMTP account using PHPMailer.
• Hosting and fonts: the hosting/database service processes app data and requests. Pages that load Google Fonts connect to Google and may disclose network/browser information. Password-recovery pages omit those external fonts. Other external links or media you open are governed by their providers.
• Public sharing and administration: other users can view public posts/profile information, and authorized administrators can access records needed for moderation, beta grants and operation. Website product previews do not display your private account data.

Android app sessions

The Android app uses the same account and backend as the website. A sign-in token is stored using device secure storage; the server stores a SHA-256 digest rather than the token itself. Mobile tokens expire after 30 days and can be revoked by signing out. A password reset or account restriction invalidates associated mobile access. Native chat messages are held in memory for the current app session; submitted conversation history and selected food photos are sent to the AI service when you request an AI feature. Recipe and post photos you publish are stored with your shared app content. Activity notifications are retrieved while using the app; this version does not send background push notifications. Notification previews may retain an excerpt after a comment is removed.

Cookies and browser storage

A session cookie keeps you signed in and supports CSRF protection and recovery verification. Local browser storage remembers theme/navigation preferences and recent search choices. Chat history is kept in session storage in your browser for the current chat experience; submitted conversation history is sent to the AI service when you ask it to respond. These are not a promise that your browser is the only place submitted data exists. This update does not add third-party advertising trackers; the plan prompt is an in-app comparison.

Retention and security

App records remain while needed for your account and features, unless deleted or cleaned up. OTPs expire after 10 minutes and verified reset authorization after 5 minutes; expiry does not itself immediately erase a row. Recovery/rate-limit records are cleaned opportunistically and may also be cleaned by a scheduled server job. Other records do not have a universal automatic deletion schedule in this release. Hosting logs, email copies, external-provider records and backups may follow separate retention schedules.

Passwords and OTPs are stored as adaptive hashes; reset grants use random secrets with stored digests. Access controls and TLS for AI/SMTP connections help protect processing, but no system is risk-free. Live deployments should use HTTPS and secure server/session settings. Localhost HTTP is for development only. Avoid storing unnecessary sensitive information during beta.

Your choices and requests

Edit account/profile details and choose post visibility in the app. Optional health/pantry records have their available edit/delete controls; account deletion is in Settings (admin accounts have separate restrictions). Advanced report CSV features may depend on a plan, but that does not remove any access, correction, deletion or other data rights you may have under applicable law. Contact the operator to discuss a privacy request, verification or any feature limitation. Public copies, backups and third-party records may not be removed by deleting a post or account alone.

Changes and contact

We publish updates here with a new version when practices change. Signup records the notice version you acknowledged; it is not a blanket consent to all future changes or a claim of automatic re-consent.

For account support or privacy enquiries, contact the CulinAI administrator.