Privacy Policy

1. Information we collect

Depending on how you use the service, we may collect the following categories of information:

• Account information, such as user ID, display name, avatar, email address, authentication provider, language preference, and membership status.
• Food and circle content, such as foods, menus, ratings, preferences, collection items, shared notes, uploaded images, comments, circle membership, invite links, and activity history.
• AI input and output, such as food photos, shared text, analysis prompts, extracted dish information, recommendation records, and user confirmations or edits.
• Device and service information, such as app version, device identifiers created for web guest collaboration, crash or diagnostic logs, security tokens, notification tokens, and approximate technical metadata needed to operate the service.
• When you use location-based features and grant permission, location coordinates may be used for weather or enabled map/place features. Granting permission alone does not mean continuous background tracking. Nearby-restaurant discovery is currently disabled.
• Payment and entitlement information from app-store billing or RevenueCat. BiteCycle does not store full payment card numbers.

2. How we use information

• Provide account login, circle collaboration, food collection management, favorites, ratings, notifications, and customer support.
• Generate AI-assisted food analysis, parse shared content, improve recommendation relevance, and help users save or edit extracted food information.
• Maintain security, prevent abuse, enforce quotas, verify membership benefits, troubleshoot errors, and protect shared invite links.
• Operate storage, synchronization, backup, analytics, diagnostics, and service availability features.
• Comply with legal obligations, respond to valid requests, and enforce our terms and policies.

3. Sharing and processors

We do not sell personal information. We may share information only as needed to operate the service, with user-directed collaborators, or where legally required.

• Firebase and Google Cloud may process authentication, database, storage, cloud functions, messaging, app check, and hosting data.
• Google Gemini and OpenAI may process food photos for image analysis. DeepSeek, OpenAI, and Google Gemini may process text, prompts, and relevant food or circle context for extraction and recommendations. If one provider fails, the request may be sent to another provider in the configured sequence. Only submit content you have permission to share.
• Apple WeatherKit may process coordinates for weather requests. Google Maps or AMap may process location or place-search requests when the relevant feature is available and used.
• RevenueCat and app-store billing providers may process subscription, entitlement, and purchase status information.
• Other users in the same circle, invite flow, or shared collection may see content you intentionally share with them.

4. User choices and rights

• You may update profile details, language preferences, notification settings, food records, collection content, and shared circle content inside the app where supported.
• You may request access, correction, export, deletion, restriction, or objection by contacting us at yaohuashi@shiyouka.com. We may need to verify your identity before completing the request.
• You may revoke device permissions, such as camera, photos, notifications, or location, through your operating system settings.
• If a privacy law grants additional rights in your region, we will process eligible requests according to that law.

5. Retention, security, and transfers

• We retain account and service data for as long as needed to provide the service, maintain backups, resolve disputes, enforce terms, and meet legal obligations.
• Deleted content may remain for a limited period in backups, logs, fraud-prevention records, or legally required archives.
• We use access controls, Firebase security rules, app-check protection, transport encryption, and operational monitoring to protect data, but no online service can guarantee absolute security.
• The service may process and store information in countries or regions different from where you live. When required, we use appropriate safeguards for cross-border processing.

6. Children and sensitive information

BiteCycle is intended for general food collection and management and is not directed to children under the minimum age required by applicable law. Users should not submit medical records, precise health diagnoses, or other unnecessary sensitive information. Food preferences, nutrition notes, and photos may reveal sensitive personal context, so users should share them carefully.

7. Changes to this policy

We may update this policy when the product, processors, legal requirements, or security practices change. Material changes will be posted on this page, and when appropriate, notified in the app or by other reasonable means.

8. Shopping, media, and shared links

Shopping content may include item names, quantities, completion state, notes, receipt images, participant names, and collaboration events. Uploaded media may include photos, videos, or Live Photo components where supported. Shared-list participants can see the content and activity made available by the owner and their permissions.

An invitation or shared shopping-list link can give its holder access to the shared content and, where enabled, guest collaboration. A web guest is assigned a browser identifier and display name; this is not the same as a registered account. Share links only with intended recipients. Expiry, revocation, membership, and editing permissions govern continued access.

9. Requesting account deletion

Submit an account deletion request through the in-app account deletion option or by contacting yaohuashi@shiyouka.com. We verify your identity before processing the request. If you cannot use the in-app option, contact us for assistance.

Deletion is processed in stages; a request acknowledgement does not mean every copy is erased immediately. Processing covers account/profile data, personally owned food records and associated media, personal menus and shopping lists, messages, assistant history, and other attributable account content. It may continue after you leave the app.

Circles you own are dissolved as part of the deletion process; membership in other circles is removed. Shared results owned by others may remain, with your attributable identity, votes, and activity details removed or anonymized as appropriate. Older shared attachments that cannot reliably be attributed to you require individual review. Copies saved independently by other participants may be outside our control.

Minimal deletion status, account identifiers needed to prevent accidental restoration, billing/security records, backups, and platform logs may remain for necessary operational or legal purposes. Their retention depends on their purpose and the relevant provider; this policy does not promise immediate deletion of all third-party records. Contact us for the status or scope of a request.

Deleting your BiteCycle account or RevenueCat customer record does not cancel an App Store subscription. Manage or cancel it separately in your Apple account subscription settings.