Privacy Policy - WhiskAI

1. Introduction

WhiskAI ("we," "our," or "us") operates the WhiskAI web application and mobile application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

Account Information

When you create an account, we collect your email address and display name. If you sign in with Google or Apple, we receive the basic profile information those services share (name and email address).

Profile Information

You may optionally provide a display name and avatar photo to personalize your profile.

AI Conversations

When you chat with Curie, our AI cooking assistant, we store your messages and Curie's responses to maintain conversation history and provide a seamless experience across sessions.

Memories & Preferences

Curie may learn your cooking preferences, dietary restrictions, and taste profiles over time. These "memories" are private to your account and are used exclusively to personalize your experience.

User-Generated Content

We store recipes, meal plans, and shopping lists that you create or that Curie generates for you.

Location Data

With your permission, we access your device location solely to help you find nearby grocery stores. We do not track, store, or share your location data beyond this immediate use.

Device Information

We may collect basic device information such as platform type (web, iOS, Android) and app version to ensure compatibility and improve the Service.

3. How We Use Your Information

Provide and maintain the Service, including AI-powered cooking assistance
Personalize your experience based on your preferences and history
Generate recipes, meal plans, and shopping lists tailored to you
Find nearby grocery stores when you request it
Communicate with you about your account or the Service
Improve and develop new features
Ensure the security and integrity of the Service

4. AI Processing & Third-Party Services

Curie is powered by Anthropic's Claude AI. When you chat with Curie, your messages are sent to Anthropic for processing. Anthropic processes this data in accordance with their privacy policy and does not use your conversations to train their models when accessed via their API.

We use the following third-party services:

Supabase — database hosting, user authentication, and file storage
Anthropic (Claude) — AI processing for Curie's cooking assistance
Google Sign-In — optional authentication method
Apple Sign-In — optional authentication method

Each third-party service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

5. Data Storage & Security

Your data is stored securely using Supabase, which provides encrypted storage and row-level security to ensure that your data is only accessible to you. We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, or destruction.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

6. Data Sharing

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

With third-party service providers as described in Section 4, solely to operate the Service
If required by law, regulation, or legal process
To protect the rights, safety, or property of WhiskAI, our users, or the public
In connection with a merger, acquisition, or sale of assets (with prior notice to you)

7. Your Rights

You have the right to:

Access the personal information we hold about you
Correct inaccurate or incomplete information
Delete your account and associated data
Export your recipes, meal plans, and other content
Withdraw consent for optional data collection (e.g., location access)

To exercise any of these rights, contact us at the email address below.

8. Data Retention & Deletion

We retain your personal information for as long as your account is active and as needed to provide the Service. When you request account deletion:

You are signed out immediately and your account is deactivated
Your data is retained for a 30-day grace period during which you may contact us to cancel the deletion
After 30 days, all your data is permanently and irreversibly deleted, including your profile, conversations, recipes, meal plans, shopping lists, memories, preferences, and uploaded files
Authentication audit logs may be retained separately for security and compliance purposes

You can request account deletion from the Settings page within the app or by contacting us at the email address below.

9. AI Data Processing Details

When you use the chat feature to interact with Curie, the following data is sent to Anthropic for AI processing:

Message text only — the content you type into the chat. Your account information, stored recipes, meal plans, and personal profile data are not sent to Anthropic.
Anthropic does not use API conversation data to train their AI models, as outlined in their privacy policy.
Your conversation history is stored in your WhiskAI account so you can revisit past chats.
You can stop AI data processing at any time by choosing not to use the chat feature. You may also revoke your AI data processing consent in your account Settings.

Before your first interaction with Curie, you will be asked to provide explicit consent for AI data processing. This consent can be revoked at any time from your account Settings.

10. Tracking & Advertising

WhiskAI does not track you across other apps or websites. We do not use advertising identifiers (such as IDFA or GAID), and we do not embed any advertising networks or third-party analytics SDKs in our application. Because we perform no cross-app or cross-site tracking, an App Tracking Transparency (ATT) prompt is not required.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information.

Do Not Sell or Share

WhiskAI does not sell or share your personal information as defined under the CCPA. We have never sold personal information and have no plans to do so.

Categories of Information Collected

Identifiers — name, email address, account ID
Internet or network activity — chat messages, interaction history with the Service
Geolocation data — approximate location (used transiently for grocery store discovery, not stored)
Inferences — cooking preferences, dietary profiles, and taste preferences derived from your usage

Your California Rights

You have the right to:

Know what personal information we collect and how it is used
Request deletion of your personal information
Opt out of the sale or sharing of personal information (not applicable — we do not sell or share)
Non-discrimination for exercising your privacy rights

12. International Data Transfers

Your data is stored on servers located in the United States, hosted by Supabase. AI processing is performed by Anthropic, also based in the United States. If you access the Service from outside the United States, please be aware that your data will be transferred to and processed in the United States.

For users in the European Economic Area (EEA): these transfers are necessary to provide you with the Service in accordance with GDPR Article 49(1)(b) (performance of a contract). By using the Service, you acknowledge this transfer.

13. Third-Party Data Protection

Each third-party service provider we use (Supabase, Anthropic, Google, and Apple) is contractually obligated to protect your data to a standard equivalent to or exceeding our own. We share only the minimum data necessary for each service to perform its function, and we do not permit third parties to use your data for their own marketing or advertising purposes.

14. Cookies & Local Storage

The Service uses the following browser storage mechanisms:

Authentication cookies — managed by Supabase to maintain your login session. These are essential for the Service to function.
Local storage — used to store non-sensitive preferences such as your active conversation, shopping cart state, and UI settings. This data remains on your device.

We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

15. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will promptly delete it. If you believe a child has provided us with personal information, please contact us.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. We encourage you to review this policy periodically.

17. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

debrahjaphet17@gmail.com