Wecide Food: Privacy Policy

About Wecide Food

Wecide Food is published and operated by Wecide Support. Wecide Food is run by Carolina Campos, based in El Salvador, who is the controller of the information described in this policy under the GDPR. This policy is written to meet the EU and UK General Data Protection Regulations (GDPR), El Salvador's Ley para la Protección de Datos Personales and the other privacy laws of the places where Wecide Food is offered. "We" and "us" in this policy mean Wecide Support.

Our Terms of Service are at wecide-app.vercel.app/wecide-food/terms/.

If you have a question about this policy, email Wecide Support at wecide.apps@gmail.com.

What we collect and why

We collect only what you enter in the app and the technical data needed to run it. We do not collect your location, contacts, microphone or advertising identifier. The camera and your photos are used only when you choose to scan a shelf (see Fridge scan).

Information	Why it exists	Legal basis (GDPR)
Account: email address, password (stored only as a hash), display name (1 to 40 characters), sign-up and sign-in times, the time you confirmed you are at least 16, and the version and time of the Terms of Service you accepted	Create and secure your account, sign you in, send sign-up and password-reset codes	Contract, Art. 6(1)(b)
Profile settings: units and date format, week start, decimal separator, cooking skill, active room, onboarding status, notification switches (including planning nudges) and quiet hours, the time you last reset your taste profile	Show the app the way you set it up	Contract, Art. 6(1)(b)
Rooms: room name, 4-digit invite code, members and host, join requests, match rule, kitchen equipment, cooking-time limits per day, leftovers setting	Let a household plan together	Contract, Art. 6(1)(b)
Room rules (see below)	Leave those recipes out of the room's decks and plans, or rank them lower	Contract, Art. 6(1)(b)
Decisions: the decks your room starts, your like or pass on each card, who has finished, and the matches	Find recipes everyone agrees on	Contract, Art. 6(1)(b)
Fridge: ingredients, amounts, expiry dates, whether an item is yours or shared	Plan around what you have and flag what to use soon	Contract, Art. 6(1)(b)
Fridge scan: the photo you take or choose (sent when you scan or tap Retry, not stored by us), the items and short names found, and how many scans and tries you used today	Suggest fridge items from a photo and keep scans within the daily allowance	Contract, Art. 6(1)(b)
Meal plan and cooking: planned meals per day, who cooked and when, which fridge items cooking used (so it can be undone within 24 hours)	Build the week and update the fridge after cooking	Contract, Art. 6(1)(b)
Shopping list: ticked items and who ticked them, extra items you type (free text, up to 60 characters)	One shared shopping list for the room	Contract, Art. 6(1)(b)
Push token (Android), the phone's time zone and the time the app was last open	Deliver notifications you switched on	Contract, Art. 6(1)(b) for notifications about your room; legitimate interests, Art. 6(1)(f) for planning nudges, which you can switch off in Settings > Notifications
Online status in your room while the app is open	Show who is around during a decision	Contract, Art. 6(1)(b)
Security data: times of room-code attempts and of rooms you create, your device's network address and request details in our backend and sign-in logs	Stop code guessing and abuse, keep the service secure	Legitimate interests, Art. 6(1)(f): protecting users and the service
Messages you send us and our replies	Answer you and handle your rights requests	Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f)
Reports about a member or a recipe: the reported display name and member id, the room name and id (or the recipe id and title), and the message you write	Enforce the Terms and keep food safe. We keep a report as long as needed for the case, in the Wecide Gmail mailbox	Legitimate interests, Art. 6(1)(f): enforcing the Terms and food safety

The recipe catalogue is our own, is the same for everyone and holds no information about you. Our server combines the room's rules into one list of left-out ingredients and one list of ingredients to show less often, and counts how many members chose basic cooking skills, without saying who; ranking, the meal planner and the shopping list are then worked out on your phone. We do not use your data for advertising or marketing profiles, and Wecide Food makes no automated decisions about you with legal or similarly significant effects.

You need an email address, a password and a display name to use the app. Room rules are optional.

Room rules

A room can list the food groups and ingredients it never cooks, and single ingredients it would rather see less often. Room rules are optional.

Stored with the room. Room rules belong to the room, not to a person. The database does not record who added or changed a rule, or when.
Shared with the room. Every member sees the rules and can change them. In a room of one or two people, others may work out who added a rule.
No reasons. We do not ask why, and the app has no allergy, diet or religious labels. We do not ask for health, religion or belief data. Room rules can still hint at them, for example a room that never cooks pork or alcohol, and in a room with one member the rules are about that person. We do not use room rules to work out anything about anyone.
Not a safety feature. We tag ingredients ourselves, and tags can be wrong or incomplete. A food group covers only the listed ingredients we have tagged with it. We cannot see cross-contact, "may contain" warnings or what is inside a branded product. If you have an allergy, always read the full ingredient list and every label. Wecide Food is not a medical service.
How long they last. Room rules are deleted with the room. A room is deleted when its last member leaves or deletes their account. Leaving a shared room or deleting your account does not remove its rules, because they are not recorded as added by you.
Requests. Adding or changing a rule is a normal request. Our hosting provider's technical logs record it like any other request, including your account ID, the device's network address and the time of the request, for the limited time described under How long it lasts.

What other room members see

A room is shared by design. Members of a room can see:

your display name, whether you are the host, and whether you are online in the app;
everything in the room's fridge, meal plan and shopping list, including extra items you typed, whether a fridge item is marked as yours, who cooked a meal and who ticked a shopping item;
during a decision, how many cards each member has swiped and who has finished, never your individual likes and passes;
the room rules, never who added or changed them or when;
the matches, with how many members liked each one.

The host of a room you ask to join sees your display name and when you asked. You see the host's display name.

The room sees its rules and how many members chose basic cooking skills, but never who set what. Room rules can hint at someone's health or beliefs. In a small room others may still guess: in a room of two, a rule you did not add must be the other person's. In the same way, match counts in a small room can show how someone voted.

Fridge scan

Fridge scan fills your fridge from a photo of a shelf. It is optional, and typing items in works without it.

How it works. The app shrinks the photo on your phone and sends it to our server, which passes it to Anthropic's Claude to recognise food. Claude returns items from our catalogue, amounts, and short names of things it could not place. You confirm the list before anything is added to your fridge.
We do not keep the photo. We do not store it in our database, file storage or logs. The app deletes its temporary copy after the scan.
Anthropic. Anthropic processes the photo on our behalf under its commercial terms and data processing addendum, and does not use it to train its models. Under its current commercial terms Anthropic deletes API inputs and outputs within 30 days. It keeps them longer only when they are flagged for a usage-policy review, for up to 2 years. See how Anthropic keeps organisations' data.
Frame only the shelf. Anything else in the shot, such as medicines, people or documents, is sent too.
Scan counts. For each account and day (UTC) we store the scans and tries you used, and any extra scans you were given. They are deleted within 3 days after that day ends, or with your account.
Results can be wrong. Check every item before you add it.

What the app stores on your phone

Encrypted storage (the phone's secure store, backed by Android Keystore or the iOS Keychain): your sign-in session, a copy of your profile settings so the app can start offline, your onboarding progress, and small app flags such as whether you have seen the welcome slides or the tips.
Offline cache (app storage, not encrypted by the app): the recipe catalogue and, for the rooms you open, the fridge, the meal plan, the shopping list including extra items you typed, member display names, the room code and recent matches. It lets the app show your plan and fridge offline. It is kept for at most 7 days since it was last updated and is cleared when you sign out.
Invite you open (app storage): the room code, the host's name and the code's expiry from an invite link are kept on your phone until the room step uses them, the code runs out, or you sign out.
Fridge scan photo (temporary): the app keeps the shrunken photo only while it reads it and deletes it after the scan.
Reminders such as a cooking timer or a use-soon reminder are scheduled and shown by your phone alone. You choose whether to allow notifications in your phone's settings and can switch each kind off in the app.
Push notifications (Android only): when you allow notifications, the app sends your device's push token to our server and Google Firebase Cloud Messaging, acting as our processor, delivers the notifications. We store the push token, the phone's time zone and the time the app was last open, linked to your account. The push token is removed when you sign out; if the phone is offline, the next notification attempt removes it. All three are also deleted when you delete your account, or after 60 days unused. Notification text can include a room member's display name, the deck size and the meal. Planning nudges come on Monday at 18:00 local time when this week's plan is empty, and after 3 and 7 days without opening the app, at most one every 3 days. They are on by default and you can switch them off in Settings > Notifications. Quiet hours are respected.

Android's automatic backup is switched off for Wecide Food, so this data is not copied to your Google account. Signing out clears the cache, the profile copy and the scheduled reminders. If you sign out while offline, the session is removed from your phone only; the session on our server ends the next time you sign out while online, or when you delete your account.

Who else is involved

Supabase hosts our database, sign-in service and file storage, including recipe pictures. It processes the information above on our behalf. See Supabase's privacy policy.
Google (Gmail) sends our sign-up and password-reset emails from a mailbox used only for Wecide. Google receives your email address and the email's content, including the one-time code; codes expire within an hour. A copy of each sent email stays in that mailbox's Sent folder until it is deleted. Emails you send to wecide.apps@gmail.com are also kept in Gmail. See Google's privacy policy.
Anthropic reads the photo when you use Fridge scan and returns the food it recognises. It processes the photo on our behalf. See Fridge scan.
Vercel hosts this privacy page and the invite page that opens when someone taps an invite link without the app. When you open either, Vercel's request logs record your device's network address and, for an invite link, the room code in the link. The host's name and the code's expiry sit after the # in the link, and browsers do not send that part to Vercel. Android also checks /.well-known/assetlinks.json on Vercel so invite links open the app. The app itself does not contact Vercel. See Vercel's privacy policy.

Images in our emails are loaded from our Supabase storage. When your email app shows them, it may send your device's network address to Supabase or to your email provider's image proxy. The images are the same for everyone and carry no tracking identifier.

Things you choose to do: when you share a shopping list or a room code, it goes only where you send it, for example a messaging app. A report you send about a member or a recipe goes to us by email.

Not used in this version: Wecide Food shows no ads and contains no advertising SDK, no analytics and no crash-reporting software. Sign-up and sign-in currently show no CAPTCHA. If we add bot protection (Cloudflare Turnstile, which would receive device and network signals such as your network address when you sign up, sign in or reset your password) or ads, we will update this policy before the change reaches the app.

We do not sell your information, and we do not share it with anyone beyond what this section describes, except where the law requires it, for example a valid order from a court or authority.

We do not use your information for targeted advertising, to train large language models, or for profiling with legal or similarly significant effects. Wecide Food does not track you across other apps or websites, and no third party collects information about your activity across apps or sites through Wecide Food, so there is nothing to change when your device or browser sends a Do Not Track signal.

Where your data is processed

Our database and files run on Supabase servers in Ireland (EU). We are based in El Salvador and look after the service from there. Supabase, Google and Vercel are companies with operations outside the EU. Where they can access personal data from outside the EU, their data processing terms rely on the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. Anthropic processes fridge photos outside the EU, mainly in the United States, under the Standard Contractual Clauses in its data processing addendum.

How long it lasts

Account, profile settings and votes: until you delete your account.
Room data (room rules, fridge, plan, shopping list, decks, matches): as long as the room exists. A room is deleted with all its data when its last member leaves or deletes their account.
Room codes work for 24 hours. Pending join requests are deleted after 7 days and room-code attempt times after 24 hours.
Fridge photos: not stored by us; Anthropic as described under Fridge scan. Scan counts: within 3 days.
Push token, time zone and last-open time: until you sign out or delete your account, and at most 60 days unused.
Offline cache on your phone: at most 7 days, cleared at sign-out.
Technical logs: our hosting providers keep short logs of requests, including your device's network address, for a limited time for security and troubleshooting.
Emails with you: as long as needed to handle your request and show we handled it.

Deleted data may remain in our hosting provider's backups until those backups expire. We do not restore deleted accounts from backups.

Delete your account

You can delete your Wecide Food account and its data at any time, in the app or by email.

In the app

Open the Room tab and tap Your profile (the person icon).
Tap the settings icon to open Settings.
Tap Delete account, then Delete for good.

Deletion needs an internet connection. If you host a room, the app first tells you who becomes the next host. Deletion is immediate and cannot be undone.

Without the app

Email Wecide Support at wecide.apps@gmail.com from the email address of your account, with the subject "Delete my Wecide Food account". If you write from another address, we will ask you to confirm you own the account before we act. We delete the account within one month of your request and confirm by email. Uninstalling the app does not delete your account.

What is deleted

your sign-in account (email address and password hash) and your profile and settings;
your likes and passes, your place in every room and in every decision, and your join requests and code attempts;
any room where you were the only member, with all of its room rules, fridge, plan, shopping list, decks and matches.

What stays, without your name

Room rules stay with rooms you shared; they were never recorded as added by you.
Rooms you shared with others stay for them. If you were the host, the member who joined earliest becomes host.
Fridge items you marked as yours become shared items of that room.
Meal plans, matches, the shopping list (including extra items you typed) and decks you started stay in the room, but the link to you is removed: "cooked by", "ticked by", "added by" and "started by" are cleared, and the link to you is also removed from the cooking record of which fridge items were used.

Copies on your phone are cleared when you sign out or when the app is removed. Deleted data may remain in backups until they expire, as described above.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to receive the data you gave us in a portable, machine-readable format, by emailing Wecide Support at wecide.apps@gmail.com. You can change your name, settings and your room's rules yourself in the app. We answer within one month; for complex requests we may extend this by up to two more months and will tell you why. Where your local law sets a shorter limit, for example 45 days (extendable once by 45 days) in Washington, Nevada and Connecticut, we follow it. We may ask you to confirm that the account is yours first.

Your right to object. You can object at any time to our use of security logs, which relies on our legitimate interests. We will stop unless we have compelling reasons, such as an ongoing attack, that override your interests.

If you are unhappy with how we handled your data, tell us first at wecide.apps@gmail.com with the subject "Complaint". We acknowledge complaints within 30 days. You can also complain to a regulator at any time: in the EU, the data protection authority of the country where you live or work, or where you think the problem happened; in the UK, the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

If you live in a US state and we refuse your request, you can appeal by replying "Appeal" to our answer. We decide within 45 days. If we still refuse, you can contact your state Attorney General.

Children

You must be at least 16 to use Wecide Food. The app asks for your year of birth when you create an account and does not let you continue if you are younger; it keeps only the fact and time that you confirmed your age, not your year of birth. If you think someone under 16 has created an account, email us and we will delete it promptly.

How your data is protected

All traffic between the app and our servers is encrypted (HTTPS), and the app does not allow unencrypted connections. Passwords are stored only as hashes; sign-up and password resets are confirmed with an 8-digit one-time code, and passwords need at least 8 characters. Rules in the database let you read only your own account data and the rooms you belong to; nobody else can read your likes and passes. Every change goes through checks on the server, and no secret administrator key exists in the app. Room codes expire after 24 hours and code attempts are rate-limited. Your session is kept in the phone's encrypted secure storage.

No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. If a change is significant, such as a new recipient or a new purpose, the app will also show a notice before it takes effect and, where the law requires it, ask for your consent again.

Contact

Wecide Support

El Salvador

wecide.apps@gmail.com