Privacy Policy
YumYummy ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and what rights you have in relation to it. It applies to the YumYummy mobile app for iOS ("the App") and the YumYummy Telegram bot (@yum_yummybot) — together, the "Service".
1. Data Controller
The data controller responsible for your personal data is:
- Name / Brand: YumYummy
- Location: United Arab Emirates
- Email: nikikurb@gmail.com
- Phone / WhatsApp: +971 50 828 9351
2. Data We Collect
2.1 Data You Provide Directly
- Sign-in identifiers — when you create an account in the App you sign in with Apple, Google, or email. We receive a stable, provider-specific user identifier and, where you permit it, your email address. If you sign in with Apple using "Hide My Email", we only receive Apple's private relay address.
- Telegram user ID and username — used to identify your account when you use the Telegram bot or link it to the App.
- Profile information — age, height, weight, biological sex, activity level, and nutritional goals, which you provide during the onboarding process.
- Meal log entries — descriptions of food and drink you submit (text, voice transcriptions, product barcodes, or meal photos).
- Meal photos — in the App you can photograph a plate, product, or nutrition label to log a meal. Meal photos are uploaded to our cloud storage and stored together with the corresponding meal entry so you can review them later; they are deleted when you delete the meal or your account. Barcode/label images sent to the Telegram bot are processed for recognition and not stored afterwards.
- Saved meals — meals you choose to save for quick re-logging.
- Timezone preference — to display daily summaries correctly.
- Voice messages — audio you record to log meals by voice. Audio is sent to our transcription provider and is not permanently stored after the transcript is generated.
2.2 Data Collected Automatically
- Technical logs — server-side logs including timestamps and error traces, used for debugging and service monitoring. These logs do not include message content.
- Product analytics — we record in-app events (for example screens viewed, features used, onboarding and subscription funnel steps) to understand how the Service is used and to improve it. These events are linked to a pseudonymous analytics identifier and to your account, and are processed by our analytics provider (PostHog). We do not use this data for third-party advertising inside the App.
- Device & app information — app version, operating-system version, device model, and general (non-precise) region, used for diagnostics and compatibility.
- AI usage metrics — aggregate counts of AI model tokens consumed and web search queries performed per request. These metrics are linked to your account and used to enforce fair-use limits (see our Terms & Conditions, Section 7) and to monitor service costs. We do not store the content of AI responses in usage records — only numerical token counts and estimated processing costs.
2.3 Payment Data
We do not collect, process, or store your payment card details. Depending on where you subscribe, payments are handled by one of the following:
- Apple App Store (in-app purchases) — subscriptions bought in the iOS App are processed by Apple and billed to your Apple Account. Apple does not share your payment card details with us. We receive the product purchased, the subscription status, and transaction identifiers. See Apple's Privacy Policy.
- Adapty — our subscription-management provider. Adapty validates App Store purchase receipts, tracks subscription status, and links it to a pseudonymous customer identifier so the App can unlock premium access. It receives transaction and subscription metadata (not your card number). See Adapty's Privacy Policy.
- Telegram Stars (XTR) — for purchases in the Telegram bot, processed within the Telegram app. We receive only a notification that a subscription has been activated, renewed, or cancelled, along with a Telegram payment charge identifier. See Telegram's Privacy Policy.
- Paddle.com — our merchant of record for card, Apple Pay, and Google Pay payments made on the web. Paddle collects and processes your payment details on our behalf. We receive only a transaction identifier, subscription status, and billing amounts. We never see or store your card number. See Paddle's Privacy Policy.
3. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Providing and operating the Service (logging meals, calculating nutritional totals, generating AI responses) | Performance of contract |
| Managing your subscription (activating, renewing, or cancelling access) | Performance of contract |
| Sending transactional notifications (e.g., subscription status, reminders) via Telegram or app push notifications | Performance of contract |
| Diagnosing and fixing bugs; monitoring service stability | Legitimate interests |
| Enforcing fair-use limits (tracking AI token consumption per billing period) | Performance of contract |
| Complying with legal obligations (tax records, dispute resolution) | Legal obligation |
| Understanding and improving the Service through product analytics and diagnostics (screens viewed, features used, funnel steps) | Legitimate interests |
We will never sell your personal data to third parties.
4. Sub-processors & Third Parties
We share data with the following third parties only as necessary to provide the Service:
- Apple (App Store in-app purchases) — processes subscriptions bought in the iOS App and billing. Privacy Policy
- Adapty Tech Inc. (subscription management) — validates App Store receipts and stores subscription status linked to a pseudonymous customer identifier. Privacy Policy
- PostHog (product analytics) — receives in-app and website usage events tied to a pseudonymous identifier, used to measure and improve the Service. Privacy Policy
- AI processing partners — the App's core features (meal parsing, photo recognition, voice transcription, restaurant nutrition lookup, and the AI Advisor) are powered by third-party AI services. When you log a meal or ask the Advisor a question, the content you submit — meal description text, voice recordings (for transcription), food photos, and your Advisor questions, together with the nutrition context needed to answer (such as your daily targets) — is sent to one or more of our AI processing partners for analysis. The App asks for your explicit permission before the first time any data is shared with these services. Our AI processing partners currently are:
- Google LLC (Gemini API) — meal parsing and photo recognition. Data is processed under Google's API terms; it is not used to train Google's models. API Terms · Privacy Policy
- Perplexity AI, Inc. — restaurant and branded-food nutrition lookup. Processed under Perplexity's API terms; not used for model training. API Terms · Privacy Policy
- OpenAI, L.L.C. — meal parsing and voice transcription. Processed under OpenAI's API data processing agreement; your data is not used to train OpenAI's public models. Privacy Policy
- Telegram (Telegram Stars payments and bot platform) — processes subscription payments and bot interactions. Privacy Policy
- Paddle.com Market Limited (merchant of record for web card payments) — processes card, Apple Pay, and Google Pay transactions, handles invoicing, sales tax / VAT, and refunds for web payments. Privacy Policy
- Cloud hosting & storage providers (servers, database, and object storage for meal photos) — process data as data processors on our behalf under appropriate security standards.
- Advertising & attribution partners — marketing website only. Our public website (yumyummy.ai) uses the Meta (Facebook) Pixel and TikTok Pixel to measure ad campaigns. These run on the website only and are not present in the iOS App. See Meta's and TikTok's privacy policies.
5. Data Retention
- Account and meal log data — retained while your account is active. When you delete your account (in the App via Profile → Delete account, in the bot, or by contacting us) your account, sign-in identities, and diary are erased promptly from our live systems; residual copies in encrypted backups are purged within 30 days.
- Meal photos — stored with the meal entry while it exists; deleted when you delete the meal or your account.
- Voice audio files — deleted immediately after transcription; we do not store raw audio.
- Barcode/label images (Telegram bot) — deleted immediately after product recognition; we do not store them.
- Technical logs — retained for up to 90 days, then deleted automatically.
- AI usage records — aggregate token counts and cost estimates per request, retained for up to 12 months for billing and analytics purposes, then deleted automatically.
- Subscription transaction records — retained for up to 7 years as required by applicable financial and tax regulations.
6. Data Security
We use industry-standard security practices including:
- HTTPS/TLS encryption for all data in transit;
- Encrypted database connections;
- Access control — only the Service operator has access to production data;
- Regular security reviews of our infrastructure.
No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
7. Your Rights
Depending on applicable law, you may have the right to:
- Access — request a copy of the personal data we hold about you;
- Rectification — ask us to correct inaccurate data;
- Erasure ("right to be forgotten") — you can permanently delete your account and all associated data yourself at any time in the App (Profile → Delete account), or by contacting us at the email below;
- Portability — request your meal log data in a machine-readable format (CSV export is available directly in the bot via the Export function);
- Objection / Restriction — object to certain processing or request that we restrict processing in specific circumstances.
To exercise any of these rights, contact us at nikikurb@gmail.com. We will respond within 30 days.
8. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete that information.
9. International Data Transfers
Your data may be processed in countries outside your country of residence, including the United States (servers of our AI processing partners) and the European Union (some cloud infrastructure). We take steps to ensure that international transfers are protected by appropriate safeguards (such as standard contractual clauses or equivalent mechanisms).
10. Cookies & Website Tracking
The iOS App and the Telegram bot do not use cookies. Our public marketing website (yumyummy.ai), including these legal pages, uses cookies and similar technologies for analytics and advertising measurement via PostHog, the Meta (Facebook) Pixel, and the TikTok Pixel. These help us understand website traffic and measure the performance of our ad campaigns.
You can control cookies through your browser settings and opt out of interest-based advertising via your Meta and TikTok ad-preferences settings. Disabling these does not affect your ability to use the Service.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the Service or by email before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision.
12. Contact
For any privacy-related questions, data requests, or complaints, please contact:
- Email: nikikurb@gmail.com
- Phone / WhatsApp: +971 50 828 9351