Privacy Policy

Effective 28 September 2026

FOODVIBE is a place to share what you're eating. This policy explains what we collect, why, and what you can do about it. It is written to be read.

Who is responsible

The service is operated by FOODVIBE from Spain. For anything about your data, write to hello@foodvibe.app.

What we collect

Account. When you sign in with Apple we receive a stable identifier for your Apple ID and, only if you choose to share them, your name and email address. There are no passwords.
Profile. Your handle, display name, bio, city and avatar. These are visible to other people.
What you post. Photos, dish names, captions, recipes (ingredients, steps, time and servings), the places you attach, cook-off entries, comments, likes, saves, the recipes you ask for, the dish a dish of yours was cooked from, and who you follow. Public accounts are visible to anyone; a private account shows dishes only to approved followers.
Public recipe pages. A dish with a recipe that you share from a public account has a page on the web that anyone with its link can open, search engines included. It shows the photo, the recipe, your name and your handle. A private account's dishes never have one, and the page goes away when you take the recipe off, delete the dish or make your account private.
Finding friends (optional). If you allow access to your contacts, phone numbers and email addresses are scrambled on your phone with a one-way hash before anything is sent. We store those scrambled codes to find matches; your contacts themselves never leave your phone. You can remove the codes at any time from Settings.
Phone number (optional). If you add your number so friends can find you, we verify it with a text message and store it with your account. You can remove it from Settings.
Time zone and meal time. The app sends the name of your phone's time zone (for example Europe/Madrid) so that a day starts and ends on your clock, and we store the meal time and the reminder switches you choose in Settings. We use them to count your streak and to send the reminders you left on at the right hour. Nobody else sees them.
Your streak. Counted from the days on which you shared a dish. The days in a row, your longest run and whether you have shared today appear on your profile for the people who can see your dishes.
Challenges among friends. The theme you write, the people you invite and the dishes entered. A challenge is seen only by the people in it and the people invited to it; its link shows its theme, your name and how many people are in to whoever you send it to, and search engines are asked not to list it. The likes that decide a challenge are the ordinary likes of the people in it.
Plans. When you make a plan we store the place you picked from Apple Maps (its name, address, phone number, position and Apple's identifier for it, so it can be reopened in Maps), the time, the name and note you write, the people you invite and each person's answer. A plan is seen only by the people in it and the people invited to it; someone who asks to join through its link sees nothing of it until the host lets them in. The link's page shows only that the host invited someone to a plan, and search engines are asked not to list it. A dish you share from a plan names the plan only to its people. Nothing is booked for you and nothing is sent to the place.
Vibes and your level. Counted from what you do here: the dishes you share, the recipes you write, the cook-offs you enter. Your level, and the frame and the profile theme you choose once a level unlocks them, appear on your profile for the people who can see it. The number of vibes and the list of what earned them are shown only to you. The app icon you pick stays on your phone.
Device. A push notification token (if you turn notifications on), your app language, and whether the app is a test or App Store build, so notifications reach the right place.
Technical logs. Our servers log requests (IP address, endpoint, time) for security and debugging. Logs are kept for up to 90 days.
Crash reports. When something breaks, an error report (device model, OS version, the failing request) is sent to Sentry so we can fix it. It never includes your photos.

Why we use it

To run the service you asked for: your account, your feed, your notifications (performance of a contract).
To keep FOODVIBE safe: rate limits, abuse prevention, moderation of reported content (legitimate interest).
Finding friends, phone verification and push notifications only happen when you turn them on (consent), and you can turn them off.

We do not sell your data, show ads or profile you for advertising.

Where it lives

Accounts and content are stored on servers in the AWS region in Spain (eu-south-2); photos are stored in Amazon S3 in the same region and served through short-lived signed links. Notifications go through Apple's push service. Error reports go to Sentry (Functional Software, Inc.). Text message codes, when enabled, go through Twilio. These providers process data on our behalf under their own data processing terms.

How long we keep it

For as long as your account exists. When you delete your account, your profile, dishes, comments, likes, follows, scrambled contact codes, phone number and device tokens are removed within 30 days; encrypted backups roll over within a further 30 days. Content you posted that other people reported may be kept in anonymised form to enforce our rules.

Your rights

Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Most of this you can do yourself in the app: edit your profile, delete dishes, remove your phone number and contact codes, or delete your account from Settings. For anything else, email hello@foodvibe.app. You can also complain to the Spanish data protection authority (AEPD) or the authority where you live.

Children

FOODVIBE is for people aged 13 and over, and under the age of digital consent where you live (14 in Spain) only with a parent's permission. If you believe a child has an account, tell us and we will remove it.

Security

Everything travels over TLS. Photos are served through signed links that expire. Access to production systems is limited to the people who run the service.

Changes

If this policy changes in a way that matters, we will say so in the app before it takes effect. The date at the top always tells you the current version.