Your Privacy & Data Rights

1. Overview & Data Controller

This Privacy Policy describes how WeeknightBite ("WeeknightBite," "we," "us," or "our") collects, uses, stores, and protects personal data when you use our mobile application for iOS, iPadOS, macOS, and Android (the "App"), our website at weeknightbiteapp.com, and related cloud services (the "Service").

For the purposes of the General Data Protection Regulation (EU GDPR / UK GDPR) and applicable data protection legislation worldwide, the data controller responsible for your personal data is the WeeknightBite Data Protection Office (hello@weeknightbiteapp.com).

2. Information We Collect

We collect only the minimum personal data required to deliver smart meal planning and family recipe management:

• Account & Identity Data: When you authenticate via Sign in with Apple (iOS), Sign in with Google (Android), or email, we receive your unique Firebase Authentication UID, your email address (or Apple private relay address), and your optional display name.
• Family Library & Culinary Preferences: Recipes you create, import, or bookmark, ingredient lists, customized instructions, serving sizes, cookware selections, and dietary preferences (e.g., vegetarian, gluten-free, nut-free).
• Calendar Availability (Apple EventKit / Android Calendar Provider): With your explicit device permission, the App queries your local device calendar (Apple Calendar via EventKit on iOS; the Android Calendar Provider on Android) for a rolling 14-day window and syncs each busy interval's start and end time, along with basic calendar metadata (such as whether an event is all-day, recurring, or a holiday, and which calendar it came from), to your account so we can schedule faster dinners on busy nights. By default, we do NOT read, transmit, or store private event titles, descriptions, notes, or attendee lists — only the busy-interval timestamps and metadata described above. On Android, you may optionally enable an "Include event titles" setting; if turned on, event titles are also synced. This setting is off by default and requires an explicit opt-in.
• Camera & Facial Gesture Data (Hands-Free Cook Mode):
  • Data Collected: Real-time facial motion cues (e.g., mouth opening, head nodding, winks) captured via the front-facing camera while Hands-Free Cook Mode is active — using Apple's TrueDepth API on iOS, and CameraX with Google ML Kit Face Detection on Android.
  • Purpose: Exclusively to advance recipe steps and start cooking timers hands-free without touching the screen with messy hands.
  • Storage & Retention: On both platforms, all facial tracking is processed 100% locally on your device in volatile memory (RAM). Zero facial data, biometric templates, images, or video frames are ever recorded, saved to disk, or transmitted to any server.
  • Third-Party Sharing: Facial data is never shared with, sold to, or accessible by third parties.
• Apple Health and Health Connect (optional, Savvy):
  • What We Write: Only if you turn it on and allow it in the system permission prompt, the App writes the estimated nutrition (energy, protein, carbohydrates, fat, fibre, sugar, salt, and vitamins and minerals) of the dinners you choose, for your portion, to Apple Health (HealthKit) on iOS, and to Health Connect on Android once available. The values are estimates from USDA data, not a nutrition label.
  • What We Read: Nothing. We ask for write access only and never read your health data.
  • Storage & Sharing: What we write stays on your device and in your health store. It is never sent to our servers, our analytics or crash reporting, advertising, or any third party, and is not stored in iCloud. A list of what was sent is kept on your device only, so you can review and remove it.
  • Removing It: In the App, Settings > Apple Health > Remove everything WeeknightBite added. Or in the Health app: your profile > Apps > WeeknightBite > Delete All Data; on Android: Health Connect > App permissions > WeeknightBite > Delete app data. You can withdraw permission at any time in the same places.
• Siri, Spotlight & Shortcuts (iOS): On iOS, the App indexes your recipes, meal plan and grocery list on your device so you can find them and act on them from Siri, Spotlight and the Shortcuts app. The index stays on your device: we never receive it. Our analytics record only which action ran, how it ended (for example, done or needs Savvy) and whether Siri or a widget ran it, never your recipes, grocery items or what you said. Requests you make to Siri are handled by Apple under Apple's privacy policy. Signing out of the App clears the index, and you can turn WeeknightBite's Siri and search suggestions off in Settings > Apps > WeeknightBite > Siri.
• Clipboard Detection: When the App opens, it inspects clipboard metadata (such as whether the copied content is a URL or text) without reading the payload. The clipboard content itself is only accessed if you explicitly tap the "Import" prompt. This behavior is the same on iOS and Android.
• Device & Push Notification Tokens: Apple Push Notification service (APNs) device tokens on iOS, and Firebase Cloud Messaging (FCM) registration tokens on Android, used to notify you when background Smart Recipe Imports finish or weekly meal prep plans are ready.
• Technical Diagnostics & Telemetry: Aggregated, anonymized crash reports and feature engagement metrics via Firebase Analytics (GA4) and Sentry.io, on both iOS and Android.
• Waitlist & Recipe Links (website): If you join the waitlist or send us recipe links on our website, we collect your email address and the links you send us, together with your discount status. If you arrived through a campaign link (for example an ad or a newsletter), we also keep that link's campaign labels (its utm_ parameters: source, medium, campaign, content, term) with your signup, so we know which campaign brought you. We also keep the name of the website that linked you to us (for example google.com or reddit.com, never the page you were on there), or which of our own pages you came from, and the page you signed up on. We do not keep advertising click identifiers. We use this information to retrieve those recipes, add them to your account at launch, email you your discount, and measure which of our campaigns and channels work. If you tick the box to get our newsletter, we also keep that choice, when you made it and the wording you agreed to, so we can send it to you; you can unsubscribe at any time.

3. AI Data Processing & Zero-Training Commitment

When you use AI features (such as Smart Recipe Import or Automated Schedule Synthesis), data is transmitted over encrypted connections to the enterprise Google Gemini API. Requests are processed transiently to output structured recipe schemas and nutritional estimates, and are governed by Google Cloud Enterprise AI Terms and Google Gemini Developer Terms.

4. How We Use Your Data & Lawful Bases (GDPR Art. 6 & 9)

We process personal data only under valid legal grounds recognized by data protection laws:

5. Sub-processors & International Data Transfers

We partner with trusted enterprise service providers who act as data processors under strict Data Processing Agreements (DPAs) incorporating EU Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework (DPF) (along with the UK and Swiss extensions):

• Google LLC (Firebase / Google Cloud / Gemini API / Google Play): Cloud Firestore database, Cloud Functions, Auth, enterprise AI inference, and — for Android users — Google Play Store distribution, Google Play Billing, Sign in with Google, and Firebase Cloud Messaging (FCM) notification routing. (Data hosted in US/EU regions; DPF certified). Google Firebase Privacy Policy
• Apple Inc.: App Store distribution, StoreKit 2 subscriptions, Sign in with Apple, and APNs notification routing (iOS/iPadOS/macOS only). Apple Privacy Policy
• RevenueCat, Inc.: In-app purchase receipt validation and subscription lifecycle management for both the Apple App Store and Google Play Store. RevenueCat Privacy Policy
• Cloudinary Ltd.: Secure image CDN hosting and optimization for recipe photography. Cloudinary Privacy Policy
• Functional Software, Inc. (Sentry.io): Application crash reporting and diagnostic logs. Sentry Privacy Policy
• Upstash, Inc.: Serverless Redis for distributed API rate limiting and security gating. Upstash Privacy Policy
• Axiom Inc.: Server-side observability and structured audit logging. Axiom Privacy Policy
• Resend, Inc.: Email delivery for waitlist, discount and account emails, and our newsletter. Resend Privacy Policy
• PostHog, Inc.: Product analytics on our website (US region), which records events only after you accept "Analytics & Performance" in our cookie banner. PostHog Privacy Policy

6. Cookies & Web Tracking Technologies

When you visit our website at weeknightbiteapp.com:

• Essential Storage: We store minimal local storage keys solely to preserve your visual theme and UI preferences.
• Aggregated Analytics: We load Google Analytics 4 (gtag.js / _ga cookies) to measure anonymous traffic, landing page performance, and link attribution. IP addresses are anonymized.
• Cookie Choices: Our cookie banner lets you accept or reject "Analytics & Performance". Until you accept, Google Analytics runs in a restricted mode that does not use analytics cookies, and PostHog does not record events.
• Zero Third-Party Advertising Trackers: We DO NOT use third-party behavioral advertising cookies, remarketing pixels (e.g., Meta Pixel, TikTok Pixel, Google Ads tags), or cross-site tracking scripts.
• Managing Cookies: You can block or delete cookies through your web browser settings. Disabling cookies will not impact your ability to browse the website.

7. Security, Encryption & Data Retention

We implement comprehensive technical and organizational measures (TOMs) in accordance with GDPR Article 32:

• Encryption in Transit: All data exchanged between your devices and our backend uses TLS 1.3 encryption.
• Encryption at Rest: All database documents in Google Cloud Firestore are encrypted at rest using AES-256 encryption.
• Granular Access Rules: Firestore security rules strictly isolate family data so that only authenticated members of your household can read or write your recipes.
• Data Retention: We retain your personal data only as long as your account remains active. If you delete your account, your data is permanently purged from production databases within 30 days.
• Waitlist Data: We keep your waitlist email address, recipe links, discount status, campaign labels and referring website until you create an account and claim your recipes, or until you ask us to delete them by emailing hello@weeknightbiteapp.com.

8. European & UK Privacy Rights (GDPR / UK DPA)

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, you possess the following statutory rights under the General Data Protection Regulation:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete profile or recipe information.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data and family library.
• Right to Restriction of Processing (Art. 18): Restrict how your data is processed under certain circumstances.
• Right to Data Portability (Art. 20): Receive your recipe data in a structured, machine-readable JSON format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Revoke permissions (e.g., Calendar access or Notifications) at any time via your device's iOS or Android system Settings.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local EU Data Protection Authority.

9. California & US State Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and similar state laws in Virginia (VCDPA), Colorado (CPA), Texas (TDPSA), and Connecticut:

• Right to Know & Access: Request disclosure of the categories and specific pieces of personal information collected.
• Right to Delete: Request permanent deletion of personal data collected from you.
• Right to Correct: Request correction of inaccurate personal information.
• Limit Use of Sensitive Personal Information: We only process dietary and allergen flags with your consent to fulfill core cooking functionality.
• Non-Discrimination: We will never discriminate against you (in price, service quality, or availability) for exercising your privacy rights.

10. International Compliance (Canada, Brazil, India & Australia)

• Canada (PIPEDA & Quebec Law 25): We collect personal data solely with consent, limit use to disclosed purposes, ensure equivalent protection during cross-border transfers, and provide access through our Privacy Officer (hello@weeknightbiteapp.com).
• Brazil (LGPD — Law 13.709/2018): Brazilian users may exercise rights of confirmation, access, correction, anonymization, and consent revocation by contacting our Data Protection Office.
• India (DPDP Act 2023): We process personal data solely with user consent or for legitimate uses under Section 7 of the Digital Personal Data Protection Act.
• Australia (Privacy Act 1988): We handle personal information in accordance with the 13 Australian Privacy Principles (APPs).

11. Account & Data Deletion Workflow (Apple Guideline 5.1.1 / Google Play Account Deletion)

In compliance with Apple App Store Review Guideline 5.1.1 and Google Play's Account Deletion requirement, WeeknightBite provides the same seamless, direct in-app account deletion mechanism on iOS and Android:

1. Open the WeeknightBite App on your device;
2. Navigate to Settings > Account > Delete Account;
3. Confirm your deletion request.

Upon confirmation, your Firebase Authentication record is deleted, your family membership is revoked, and your stored recipes and calendar slots are permanently removed from production databases. Alternatively, you may submit a deletion request via email to hello@weeknightbiteapp.com.

Dinners sent to Apple Health or Health Connect live only on your device and in your health store, which our servers cannot reach. Deleting your account does not remove them: remove them first in Settings > Apple Health, or later in the Health app or Health Connect as described in section 2.

12. Children's Privacy (COPPA & GDPR Art. 8)

WeeknightBite is designed for household kitchen managers and is not directed to children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal information without parental consent, please contact us immediately, and we will delete the data.

13. Data Protection Contact & DSAR Inquiries

To exercise any of your privacy rights, submit a Data Subject Access Request (DSAR), or ask questions about our privacy practices, please contact our Data Protection Officer: