Privacy Policy

1. What we collect

• Account data — email address and authentication details (password hash, or your Google/Apple identifier if you sign in with them).
• Content you submit — links you paste or share, text you paste, and official Instagram/TikTok data-export archives you upload. Exports are processed to find your saved posts and are not kept longer than needed for that processing. In the app you can also share a link straight from another app’s share sheet; we receive the link and any caption that app hands us, and nothing else about that app.
• Photos you choose to add — in the app you can photograph a finished dish with the camera, or pick an existing image, and it becomes that recipe’s cover. We only ever receive the specific images you pick. We do not browse, scan, or read your photo library, and the app asks the system for one picture at a time rather than for access to all of them.
• Derived content — captions, video transcripts, thumbnails, and the structured recipes/tags the AI extracts, stored in your private library.
• Usage & billing data — counts of feature use (for plan limits), plan status, and subscription state from our billing provider. We never see or store full card numbers.
• Technical data — logs (IP address, user agent, timestamps) kept briefly for security and debugging. If analytics are enabled we use a cookieless, privacy-preserving service (aggregate page counts, no cross-site tracking, no ad profiles).

2. How we use it

To run the Service: fetch and extract the recipes you ask for, enforce plan limits, process payments, respond to support, and keep the Service secure. We send transactional email (confirmation, billing, important changes). We don’t send marketing email without your consent, and we never sell or rent personal data.

3. Who processes it for us

We use a small set of processors, each receiving only what their job requires: Supabase (database, authentication, file storage), Vercel (hosting), Anthropic (AI extraction — captions/transcripts are sent for processing), Groq or OpenAI (audio transcription of videos you submit), and RevenueCat and its payment partners (subscriptions). Data may be processed in the United States; we rely on standard contractual safeguards with these providers.

4. What we don’t do

• We never log into your social accounts and never see your passwords for them.
• We don’t scrape your saved posts — you explicitly hand us each link or export.
• We don’t rehost creators’ videos; recipes link back to the original posts.
• We don’t sell personal data or share it for advertising.

5. Retention & deletion

Your library is kept until you delete it. Uploaded export archives are deleted after processing. Deleting your account from the account page — or from the Account tab in the app — permanently removes your profile, recipes, and files; backups age out on a rolling schedule. Logs are retained briefly and rotated.

6. Your rights

Depending on where you live (GDPR, UK GDPR, CCPA and similar), you may have rights to access, correct, export, restrict, or delete your personal data, and to object to processing. Most of these you can exercise directly in the app; for anything else email us and we’ll respond within the legally required time. You may also complain to your local data-protection authority.

7. Cookies

On the website we use strictly necessary cookies only: your sign-in session and your language preference. No advertising or cross-site tracking cookies.

The app uses no cookies and no advertising identifier. It keeps your sign-in token in the device keychain and caches your own recipes on the device so the library still opens without a signal. Both are removed when you sign out or delete the app. The app contains no analytics or advertising SDK of any kind.

8. Children

The Service is not directed at children under 16 and we don’t knowingly collect their data.

9. Changes & contact

If we make material changes to this policy we’ll notify you before they take effect. Privacy questions and requests: support@scrolltotable.com.