Feastly · 锋味十足
Privacy Policy
This policy explains what information Feastly (锋味十足, app ID com.feastly.app) collects, why we collect it, who we share it with, how long we keep it, and how you can access, export, correct and delete your data. Please read it before using the app.
1. Who processes your data
In this policy, "we", "us" and "our" mean the operator of Feastly (Chinese name 锋味十足). For the processing described here we are the data controller (GDPR) and the personal information handler (PIPL).
There is a single contact point for everything in this policy — privacy requests, data export, deletion requests, complaints and product support alike: [email protected].
This policy covers the Feastly mobile and desktop apps and their backend services. It does not cover third-party pages you may open from the app (for example an App Store product page), which are governed by their own policies.
2. What we collect
2.1 Information you give us
- Ingredient photos
- Only when you tap "Take a photo" or "Choose from library" does the app open the system camera or the system photo picker, and it receives only the single image you select. See section 3.
- Free-text descriptions
- The text you type in the "describe it" entry point (for example "quick home cooking", "light on oil") and the suggestion chips you tap.
- Cooking preferences
- Four things you fill in during onboarding and can change at any time in Preferences: region (drives cuisine defaults, measurement units and currency), household composition (how many adults, children and elders — used to scale portions), cuisine preferences (multi-select), and dietary restrictions (multi-select, including allergy and religious options — see section 7). The cuisine and dietary steps can both be skipped.
- Account credentials (optional)
- If you upgrade from a guest account to a registered account, we collect the username and password you choose. Passwords are stored irreversibly on our servers; we cannot read your plaintext password.
- Content you create
- The menus, chef's timelines, grocery lists, cooking history and favourites you generate and save.
2.2 Information the app collects automatically
- Device identifier
- On first launch the app generates a random UUID on your device and stores it in the operating system's secure store (Keychain on iOS/macOS, KeyStore on Android). It is not an advertising identifier, IDFA, IMEI, or any identifier supplied by the OS or hardware — the app generates it itself and it is meaningful only to this app. Its purpose is described in section 5 ("account anchoring and abuse prevention"). Because it lives in the secure store, it normally survives uninstalling and reinstalling the app — which is exactly why a guest account can find its data again after a reinstall.
- Device and app environment
- Sent with each network request: platform (ios / android / macos), OS version, device model identifier (e.g.
iPhone16,2), app version and build number, interface language tag, and device time-zone offset. Used to return content that fits your device and language, to diagnose compatibility problems, and to understand version distribution. - Request logs
- Our servers record the request method, path, response status, processing time and a random request trace ID, for troubleshooting, capacity planning and security auditing.
- IP address
- Visible to our servers when your device connects. Used for security (rate limiting, anomaly detection), access logs, and region inference — see below.
- Region inference signals
- So that onboarding can silently pre-select a sensible region instead of making you scroll through a hundred countries, we combine three signals: your device interface language, your App Store storefront, and the country your IP resolves to on the server. These are used only to pre-select a candidate region; you can change it at any time, and once you have changed it manually we never auto-correct it again. The app never requests or uses GPS location — the build contains no location components at all.
2.3 Purchase and billing information
- Payment itself is handled entirely by Apple. We never receive, touch or store your card number, CVV, Apple ID password or any payment credential.
- We do receive and store: Apple transaction identifiers (transaction ID / original transaction ID), our own order number, the product identifier, purchase and renewal status, and a random UUID that maps an Apple transaction back to your account (this UUID is your account identifier, attached to the transaction as
appAccountToken). - We receive Apple's server-to-server notifications (renewal, cancellation, refund, billing retry) so your entitlement stays accurate.
- We record your credit balance and the ledger of credits granted and consumed.
2.4 Identity information we do not ask for
The app never asks for a phone number, government ID, real name or date of birth. If you do not upgrade to a registered account we do not even have a username — your account is anchored solely on the device identifier described in 2.2.
3. Photos, in detail
Photos are the most sensitive content this app handles, so their full lifecycle gets its own section.
3.1 When a photo is taken
Only when you tap "Take a photo" or "Choose from library" on a scene card does the app open the system camera or the system photo picker. There is no custom camera UI inside the app, nothing is captured in the background, and we never enumerate, scan or upload any other photo in your library — we receive only the single image you selected in the system picker.
On iOS the permission strings are "Take a photo of your fridge or the market so we can identify what you have and build a menu" (camera) and "Pick an ingredient photo from your library so we can identify it and build a menu" (photo library). You can revoke either permission at any time in system Settings. Without them, photo recognition is unavailable; the rest of the app (free-text description, surprise-me, grocery list, cook-along) continues to work.
3.2 What happens on your device before upload
Before a photo leaves your device it is resized and re-encoded locally: the longest edge is scaled to 1600 pixels at JPEG quality 88. As a result:
- we never receive your original file, and what we do receive is lower resolution than the original;
- re-encoding normally strips the original EXIF metadata, including any capture location;
- regardless of whether any location data survives, we never read, parse or use location information from a photo.
3.3 How it is transmitted and where it goes
Photos are uploaded through a two-stage pre-signed direct upload: the client asks our server for a one-time upload credential, then PUTs the file bytes straight to object storage, then calls back to confirm completion. Everything runs over HTTPS/TLS. Before requesting the credential the client computes a SHA-256 digest of the file contents and submits it, which the server uses to verify integrity; if identical content has been uploaded before, the existing object is reused rather than transferred again. The client pre-validates file type and size locally (images: PNG, JPEG, WebP, GIF, HEIC, HEIF; 50 MiB per file), and the server re-validates on completion, including checking that the actual stored size matches what was declared.
3.4 What the photo is used for
Once uploaded, the photo is used for ingredient recognition only: a third-party AI service provider's vision model analyses what is in the frame and returns a list of ingredient names with confidence scores for you to confirm. Items below 0.7 confidence are flagged for you to confirm — we do not guess on your behalf. Beyond that list we extract nothing: no face detection, no person recognition, no profiling of any kind.
3.5 Who can see it
Uploaded photos are stored linked to your account, and access is limited to:
- the service processes needed to perform recognition;
- the third-party AI service provider, for the duration of the recognition request only (section 8);
- a small number of operations staff, when you report a problem or a fault needs diagnosing — such access follows the minimum-necessary principle and is audit-logged.
We never publish your photos, show them to other users, sell them, or use them for anything unrelated to recognition.
3.6 How long they are kept
An uploaded recognition photo is kept while it is linked to your account, and no longer than we need it for the purposes described in this policy. There is no separate calendar expiry you have to wait for — deleting your account (section 14) removes it. If we later introduce a fixed retention period for photos, we will state it in this section before it takes effect.
4. What we never collect
For the avoidance of doubt, the app does not collect, request or integrate any of the following:
- Location. No GPS or location permission is requested; the build contains no location components.
- Cross-app or cross-site tracking. The app's Apple privacy manifest declares
NSPrivacyTrackingasfalsewith an empty tracking-domain list. We integrate no advertising-attribution or cross-app tracking SDK, and we never present the App Tracking Transparency prompt. - Advertising identifiers. We do not read IDFA, IDFV or GAID.
- Contacts, calendar, reminders, call logs, SMS. Never requested, never read.
- Health and fitness data. No HealthKit or Google Fit integration. The allergy options in section 7 are ticked by you inside the app and come from no health data source.
- Microphone and audio. Voice narration in cook-along mode is honestly labelled "coming soon"; the current version requests no microphone permission and makes no recordings.
- Clipboard, installed-app list, hardware serial numbers. Never read.
- Payment card data. See 2.3 — payment is handled entirely by Apple.
5. How we use it
| Purpose | Information used |
|---|---|
| Recognise ingredients | The photo you upload |
| Generate the menu and chef's timeline | Recognised ingredients, free-text description, region, household composition, cuisine preferences, dietary restrictions, the scale you pick (everyday / gathering / banquet) |
| Scale portions and adjust seasoning | Household composition (counts of adults, children, elders). A non-zero child count halves portions and automatically reduces heat/spice; a non-zero elder count automatically reduces salt and oil; adults count as a normal portion. |
| Derive the grocery list and localise units | Menu contents, region |
| Save your history and favourites, support replay | Menus you generate and save |
| Account anchoring and abuse prevention | Device identifier, IP, request logs. The device identifier makes guest registration idempotent — registering twice from the same device returns the same account instead of minting a new one — and helps us spot bulk-registration and farming abuse. |
| Deliver what you purchased | Apple transaction data, orders, subscription status, credit ledger |
| Localise the interface and content | Language tag, time zone, region |
| Keep the service secure and available | Request logs, IP, device and app environment |
| Improve the product | Aggregated, non-identifying event counts (section 16) |
| Meet legal obligations | Transaction and accounting records |
We do not use your information for automated decisions producing legal or similarly significant effects on you, and we do not use it for ad targeting or to sell profiles.
6. Legal bases
If you are in a jurisdiction where the GDPR (EEA, UK) or a comparable regime applies, our legal bases are:
| Processing | Legal basis |
|---|---|
| Providing core functionality (recognition, menu generation, grocery list, cook-along), maintaining your account, delivering purchased entitlements | Performance of a contract — GDPR Art. 6(1)(b) |
| Processing photos and the allergy / religious options among dietary restrictions | Your explicit consent — GDPR Art. 6(1)(a) and Art. 9(2)(a); see section 7 |
| Security, abuse prevention, troubleshooting, aggregate statistics | Legitimate interests — GDPR Art. 6(1)(f): keeping the service secure and available. We have assessed that this does not override your rights and freedoms. |
| Keeping transaction and accounting records | Legal obligation — GDPR Art. 6(1)(c) |
Where the PIPL applies, we process personal information on a notice-and-consent basis, and obtain separate consent for sensitive personal information (section 7).
7. Dietary restrictions
Two kinds of option inside "dietary restrictions" attract heightened legal protection, so we call them out separately:
- Allergy options (e.g. "shellfish allergy", "nut allergy") are health data — a special category under GDPR Art. 9, and sensitive personal information under the PIPL;
- "Halal" may reveal your religious belief and falls into the same heightened category.
Our rules for these:
- Entirely optional. The dietary step can be skipped in full; the default is "none". Skipping it does not restrict any app feature.
- Ticking a box is your explicit consent. We never infer allergy or religious information from any other source.
- Single purpose. Used only to exclude ingredients or adjust preparation when generating a menu. Never for profiling, never for marketing, never for anything else, and never shared with third parties as such — what we pass to the AI provider is the constraint "avoid these ingredients" (section 8).
- Withdrawable at any time. Set it back to "none" under Profile → Preferences. Withdrawal does not affect the lawfulness of processing before withdrawal.
Dietary filtering is a best-effort constraint on AI generation — it is not an allergy safety guarantee. Menus are AI-generated and may omit, misjudge or fail to flag hidden ingredients (nut or shellfish derivatives in a sauce, for example). If you or a member of your household has a serious food allergy, you must independently verify every ingredient and every product label. This app does not provide medical or nutritional advice and is no substitute for a doctor or registered dietitian.
9. International transfers
Our backend runs on cloud infrastructure operated by third-party providers, and the files you upload are stored on a globally distributed object storage service rather than one pinned to a single country. The third-party AI service providers described in section 8.1 run their models on their own infrastructure. Taken together this means that your information may be processed outside the country or region where you live, including in countries whose data-protection law differs from your own. If you need to know which countries are involved in a specific request you are making to us, ask at [email protected] and we will tell you.
Safeguards we apply to such transfers include: data processing agreements incorporating the GDPR Standard Contractual Clauses or equivalent terms; where the PIPL applies, completing the statutory route for outbound transfers (notice, separate consent, and security assessment or standard-contract filing as applicable); and TLS encryption of the transfer channel end to end.
10. Retention periods
We keep information only as long as it is needed:
| Category | Retention |
|---|---|
| Uploaded ingredient photos | Kept while linked to your account; removed when you delete your account. No separate calendar expiry (section 3.6) |
| Cooking preferences (region / household / cuisine / dietary) | Until you delete your account, or clear them yourself in Preferences |
| Generated menus, grocery lists, cooking history, favourites | Until you delete your account (the on-device "recently cooked" list keeps the 10 most recent entries on a rolling basis) |
| Account and credentials | Until you delete your account |
| Server request logs | 30 days. Security, fraud-prevention and audit logs are kept longer where we are required to keep them — up to 180 days |
| Transactions, orders, subscription and credit ledger | For the period required by applicable accounting and tax law (typically longer than the life of the account, and independent of an account deletion request) |
Past those periods we delete the information or irreversibly anonymise it so that it can no longer be linked to you.
11. Security
- Encryption in transit. All communication between client and server, and between client and object storage, uses HTTPS/TLS.
- Request signing. Every business request carries an HMAC-SHA256 application signature covering a timestamp, a nonce and the request body, validated server-side against a time window and replay checks, so requests cannot be forged or replayed.
- Token authentication. Short-lived access tokens with refresh tokens. Tokens and the device identifier live in the OS secure store (Keychain / KeyStore), never in ordinary files or logs.
- Password storage. Registered-account passwords are stored irreversibly.
- Log redaction. Everything written to logs or the analytics channel passes through a single redaction layer first, which masks tokens, bearer headers, email addresses, phone numbers, signatures and long hexadecimal secrets before anything is written out.
- Least-privilege access. Internal access to production data is granted on a need-to-know basis and is audit-logged.
No system is perfectly secure. Keep your password safe and do not share your account. If you notice anything unusual or suspect a security incident, contact [email protected] immediately. If a personal data breach is likely to affect your rights, we will notify you and the competent supervisory authority as required by law.
12. Your rights
Wherever you are, you can exercise the following:
- Know and access
- Find out what we process and how. Profile → Preferences shows and edits all of your preferences directly; the complete dataset is available by export (section 13).
- Correct
- Region, household composition, cuisine and dietary restrictions can be changed in Preferences at any time, effective immediately.
- Delete
- Delete an individual history entry or favourite, or delete your entire account (section 14).
- Portability
- Receive the data you provided in a structured, commonly used, machine-readable format (section 13).
- Withdraw consent
- Withdraw consent for photos and for allergy / religious dietary options. The corresponding feature then becomes unavailable, but processing before withdrawal remains lawful. System permissions (camera, photo library) can be revoked at any time in device Settings.
- Restrict and object
- Where the GDPR applies, object to processing based on our legitimate interests, or ask us to restrict processing.
- Complain
- Lodge a complaint with the data protection authority in your country or region. We would rather you came to us first — almost everything can be resolved directly.
To exercise a right, use the corresponding in-app control or email [email protected]. We respond within 30 days. To protect your account we may first need to verify that the request really comes from you. We will never treat you differently for exercising a right.
13. Data export
We provide a single export covering all of your Feastly data — no categories held back, no "only part of it is exportable" caveat.
13.1 What the export contains
- Account. Account identifier, account type (guest / registered), username if set, creation time. It does not contain your password — we do not hold it in readable form.
- Cooking preferences. Region, whether you set the region manually, household composition (each count), cuisine preferences, dietary restrictions.
- Content you created. All menus and their dishes, chef's timelines, grocery lists, cooking history entries, favourites.
- Recognition records. For each recognition: the source (fridge / market / library), the ingredient list with confidence scores, and what you confirmed.
- Your uploaded photos. The image files themselves, for every photo we still hold for your account.
- Your text input. Every free-text description you entered.
- Purchases and billing. Order records, product identifiers, subscription status and periods, credit grant and consumption ledger.
- Device and environment. The device identifiers linked to your account, platform, app versions, language and time-zone settings.
13.2 Format
Structured data is provided as JSON (UTF-8, with stable field names documented in a readme inside the package); photos are included as their original image files. Everything is delivered as one archive.
13.3 How to request it
Email [email protected] with the subject "Data export", identifying yourself by the means tied to your account (registered account: your username; guest account: the account identifier shown on the Profile tab). We deliver the export within 30 days. Exports are free; for repeated, manifestly unfounded or excessive requests on the same account within a short period we may charge a reasonable fee or decline, giving reasons.
14. Account deletion
You have the right to delete your account and the data linked to it. You can ask us to delete it through the account settings in the app, or by emailing [email protected] with the subject "Account deletion" and enough detail to identify the account (registered account: your username; guest account: the account identifier shown on the Profile tab). Both routes lead to the same erasure described below, and neither costs anything.
14.1 What deletion erases
Once confirmed, the server cascades the deletion across everything linked to your account:
- cooking preferences (region, household composition, cuisine, dietary restrictions);
- all menus, chef's timelines and grocery lists;
- all cooking history and favourites;
- all recognition records and uploaded photos;
- all free-text descriptions;
- the account itself and its credentials;
- the binding between your account and the device identifier.
The app's on-device mirror of your preferences, the recently-cooked list and local favourites are cleared in the same operation.
14.2 What survives, and why
- Transaction and accounting records — required by accounting and tax law and needed as evidence in refund disputes. After deletion these are unlinked from your identity and reduced to the minimum fields the transaction itself requires.
- Minimal abuse-prevention records — for example an irreversible hash marker that stops one device repeatedly registering to farm new-user benefits.
- Aggregated statistics that can no longer be linked to any individual, and therefore fall outside the scope of deletion.
14.3 Timing and irreversibility
Sign-in stops working as soon as we action your request. We then remove the data listed in 14.1 from the systems that serve the app; copies held in backups fall out as those backups expire on their normal rolling schedule. If you want confirmation that a particular deletion has completed, ask at [email protected] and we will confirm it.
This matters most for guest accounts. A guest account is found again through the device identifier. Once deleted, reinstalling the app on the same device will not restore your preferences, menus, history or favourites — you get a fresh, empty account. Export your data first (section 13) if you may want it.
Deleting your account does not cancel your App Store subscription. Subscriptions are managed by Apple and must be cancelled separately in Settings → Apple Account → Subscriptions, otherwise billing continues. See the Subscription Terms.
15. Children and household size
15.1 The app is not for independent use by children
Feastly is built for adults who cook for a household. It is not directed to, and is not intended for independent use by, children under 13 (under 14 in mainland China), and we do not knowingly collect their personal information. The cooking guidance involves open flame, knives and high temperatures and is intended to be carried out by an adult.
15.2 What "household composition" actually collects — and what it does not
The household step of onboarding collects three integer counts: how many adults, how many children, how many elders (each in the range 0–12).
We do not collect any household member's name, age, date of birth, gender, photograph, health status, or anything else that could identify a specific person. We do not create a profile for a child, and we never associate these counts with any identified individual. What is stored is literally a set of numbers such as "adults 2, children 1, elders 0".
Those counts serve exactly one purpose: scaling portions and adjusting preparation. The rules are fixed and public — a child count halves portions and reduces spice; an elder count reduces salt and oil; adults count as a normal portion. You can set any of them back to 0 at any time under Profile → Preferences.
15.3 If you believe a child gave us personal information
If you are a parent or guardian and believe a child under 13 (under 14 in mainland China) has provided us with personal information without your consent, contact [email protected]. On verification we will delete the information and terminate the corresponding account promptly.
Minors must not make in-app purchases on their own; any purchase should be made with a guardian's consent. See the Subscription Terms.
16. Analytics and telemetry
The app has an event-counting channel used to measure whether features work (onboarding completion rate, recognition success rate, how many people actually start cooking after generating a menu). Three things about it:
- Event properties carry only enumerated codes and counts. For example "recognition succeeded, 7 items, 1 low-confidence", "scale = everyday". They never carry free text, photo content, your typed description, or any personal identifier. Diagnostic fields on error events record only the error type name.
- The redaction layer is mandatory. Anything written to this channel passes through the redaction layer described in section 11 before it can leave the device.
- The current release sends nothing to any third-party analytics service. The channel ships as a no-op by default in release builds. If we later integrate a third-party analytics provider, we will update this policy first, name the provider and the data categories here, and update the App Store privacy questionnaire and the in-app privacy manifest to match.
17. On-device storage
This is an app, not a website, and it uses no cookies. It uses two kinds of local storage on your device:
- OS secure store (Keychain / KeyStore) — the device identifier, access token and refresh token. This is the only storage in the app that may persist after uninstalling.
- Ordinary app preference storage — a local mirror of your preferences (so a cold start works offline), the recently-cooked list (up to 10 entries, rolling), favourites, the product catalogue cache, pending order records, and a schema version number for the local storage format. All of this is removed with the app container when you uninstall.
One further note: the app reads system facts such as the device boot time and available disk space — respectively to decide whether the startup configuration cache needs refreshing, and to check space before writing. These reads happen entirely on your device, and the calls and their reasons are declared in the app's Apple privacy manifest as Apple requires.
18. Regional terms
18.1 Mainland China
We process personal information in accordance with the Personal Information Protection Law, the Data Security Law and the Cybersecurity Law of the People's Republic of China. You have the rights to know, to decide, to access and copy, to portability, to correct and supplement, to delete, and to request an explanation of our processing rules — exercised as described in sections 12–14. We obtain separate consent for sensitive personal information (section 7). For any outbound transfer of personal information we follow the statutory route described in section 9.
18.2 European Economic Area and United Kingdom
We, as described in section 1, are the data controller. Legal bases are in section 6, transfer safeguards in section 9, and rights in section 12. You may lodge a complaint with the supervisory authority in your member state (the ICO in the UK).
18.3 California
Under the CCPA/CPRA: the categories of personal information collected in the last 12 months are in section 2, the purposes in section 5, and the categories of recipients in section 8. We do not "sell" your personal information and do not "share" it for cross-context behavioural advertising, and have not done so in the preceding 12 months; we do not sell the personal information of anyone under 16. You have rights to know, delete, correct and non-discrimination, exercised as described in sections 12–14.
18.4 Other jurisdictions
Where mandatory law in your jurisdiction grants you protection beyond what this policy provides, that law prevails.
19. Changes to this policy
When our practices change, we update the version number and effective date at the top of this page. For material changes — a new category of information, a new category of recipient, a new purpose, or integrating a third-party analytics provider — we notify you prominently in the app before the change takes effect, and where the law requires it we obtain your consent again. Continuing to use the app after the effective date means you accept the updated policy.
20. Contact us
For questions or complaints about this policy, or to exercise a right under section 12:
- [email protected]
This one address covers privacy requests, data export, account deletion, complaints and product support. Putting the subject in the subject line ("Data export", "Account deletion") helps us route it faster. We respond within 30 days, and sooner where the law that applies to you requires it.