Daily Bite Privacy Policy

Effective date: October 11, 2026 (last updated November 2, 2026: Apple Ads measurement, and copies of Ask Nib conversations; November 1, 2026: Ask Nib uses Anthropic's Claude and can look online for recipes; October 30, 2026: Ask Nib; October 27, 2026: the shared import cache keeps entries for about one year instead of about 90 days; October 19, 2026: Daily Discover, websites, creator pages, public profiles, plates, reviews, comments, reports and blocks, and recreating a dish from a photo; October 15, 2026: recipe share links, Android app version 1.0.6, and Superwall paywalls on Android; October 14, 2026: session recordings; October 13, 2026: shared import cache; October 12, 2026: Fix it, import reports, background imports)

1. Who We Are

Daily Bite ("Daily Bite," "we," "us," or "our") is a recipe app for iPhone (App Store) and Android (Google Play), operated by Successfitness, a sole proprietorship based in Saskatchewan, Canada (brand: Success Recipes / Success Fitness). We are the data controller responsible for your information.

You can reach us about privacy at any time: dailybiteapp12@gmail.com

This policy explains exactly what we collect, why, who processes it on our behalf, how long we keep it, and how you can access or delete it. We do not sell your personal information for money, and Daily Bite shows no ads inside the app. Starting with version 1.0.4 of the iPhone app, we use Meta (the company behind Facebook and Instagram) to measure our own ads for Daily Bite. Your iPhone asks before the app can use your advertising identifier for this, and saying no changes nothing in the app. The Android app does not include this. From version 1.0.7, the iPhone app also asks Apple whether you downloaded it from one of our App Store ads (Apple Ads); this does not use your advertising identifier. See "Ads measurement (Meta)" and "Ads measurement (Apple Ads)" in Section 3, and Section 7. The app uses PostHog to understand which features people use and Sentry to report crashes and errors; see "App analytics" and "Crash reports" in Section 3. Starting with version 1.0.6, the iPhone and Android apps also use Superwall to show and test most Daily Bite Pro screens, and on the iPhone, PostHog records about 1 in 10 sessions as a screen recording that shows the app as you saw it, including what you type, your own photos once they are in the app, and pages you open in the in-app browser, with only your password and your email address hidden on the app's own screens. We do not record sessions on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone. See "Paywalls (Superwall)" and "Session replays" in Section 3. Our website, trydailybite.com, uses a cookieless website analytics service to count visits and button taps; see "Website analytics" in Section 3. When you share a recipe as a link, its page on trydailybite.com shows the recipe's title, its creator credit and, for some recipes, a photo to anyone who has the link; see "Recipe share links" in Section 3. Starting with version 1.0.7 of the iPhone app, Daily Discover shows recipes, creators, and food websites that are popular with Daily Bite cooks, counted anonymously, and you can choose to have a public profile and share plates, reviews, and comments with other Daily Bite users; nothing is public unless you choose it. See "Daily Discover" and "Public profile, plates, reviews, and comments" in Section 3.

2. What Daily Bite Does

Daily Bite lets you create an account, browse a curated recipe library, save and organize recipes into cookbooks, plan meals and keep a grocery list, import a recipe from a link (pasted, shared from another app, or found in the in-app browser), a photo, or pasted recipe text, ask our AI to recreate a recipe from a photo of a dish, discover recipes, creators, and food websites in Daily Discover, choose to share plates (photos of dishes you cooked), reviews, and comments with other cooks from a public profile, and subscribe to Daily Bite Pro for premium features such as nutrition estimates and recreating dishes. We collect only what these features need.

3. Information We Collect

Account information

You can sign in with an email address and password, with Sign in with Apple (on iPhone), or with Google Sign-In (on iPhone and Android).

• Email address: when you sign up with email and password, when you use Google Sign-In, or when you use Sign in with Apple (including an Apple private-relay address ending in @privaterelay.appleid.com, which we treat as your real email and never block or alter).
• Password: only when you choose email and password sign-up. Your password is handled solely by Google Firebase Authentication. It is never written to our database and we cannot see it.
• Apple sign-in identifiers: when you use Sign in with Apple, we receive a stable Apple user identifier and an identity token, which we exchange for a secure login session. We also store an Apple refresh token on our server, only so we can ask Apple to revoke Daily Bite's access to your Apple ID when you delete your account.
• Google sign-in information: when you use Google Sign-In, Google confirms who you are and gives us your Google account's email address, name, a link to your Google profile photo when you have one, and a Google identity token, which we exchange for a secure login session. From iPhone app version 1.0.7, that photo can become your Daily Bite profile photo (see "Your profile photo" below).
• First name: your first name (from Sign in with Apple's first authorization, from your Google account, or as you enter it), used to personalize the app.

Profile and onboarding answers (you provide these during setup; used to personalize recipes): your goals, how many recipes you save per week, how many recipes you actually cook, where you save recipes today, how often you order takeout, who you cook for, dietary preferences, your usual dinner time, allergies you enter, pantry items you list, how you heard about Daily Bite, and when you usually decide what's for dinner (which sets the time of your Daily Bite reminder). Your profile also records the choice you make at sign-up about receiving marketing emails from Daily Bite, and when you accepted the Terms of Service and Privacy Policy (with the versions that were in effect). Your marketing-email choice is stored so we can respect your choice; the app does not send it to our email service provider.

Recipes you pick during setup. Setup can show you recipes from our library to swipe through. The ones you mark "I'd cook this" are saved to your account when you create an account, sign in, or turn a guest account into a full one, so they appear in the app as Your picks. The recipes you pass on are not saved to your account.

Sample recipe. Setup can show you how saving a recipe works, using one of our own sample recipes. When you create an account or sign in, that sample recipe is added to your recipes, so it is there when you start. Which sample you get depends on where you told us you save recipes.

Setup log. While you go through setup, the app also sends a record of the setup screens you reach to an onboarding log in our Firebase database, so we can understand where people drop off in setup. Some entries carry the answer you picked, such as how many recipes you save or actually cook, how often you order takeout, who you cook for, your usual dinner time, how you heard about Daily Bite, where you save recipes, when you usually decide what's for dinner, whether you allowed notifications, the recipes you pick or pass on in setup, which version of setup you were shown, whether your App Store or Google Play account can still get the free trial, your marketing-email choice, and which sign-in method you chose. Each log also carries your platform (iPhone or Android), a random setup-session ID, and, once you sign in, your Daily Bite account ID. Your dietary preferences, allergies, and pantry items are not sent to this log.

We treat dietary preferences and allergies as sensitive lifestyle information. We use them only to filter and personalize recipe suggestions inside the app. Daily Bite does not provide allergy-safety, medical, or nutritional health guarantees, and you should not rely on it for medical decisions.

Recipes and cookbooks you create or import

• A link (URL) you paste, share into the app from another app, or import from the in-app browser to import a recipe. The link goes to our recipe-import service (a Google Cloud Function). For Instagram, TikTok, and Facebook posts, the service reads the post's public caption through ScrapeCreators and, when the recipe is not in the caption, the post's public images or the video's transcript. For other web pages, it fetches the public page through Firecrawl. That content is then sent to Google's Gemini AI to turn it into a recipe. If the post or page has a cover image, we try to copy that image into our Firebase file storage so your saved recipe keeps its picture. If that fails, the recipe keeps a link to the original image, which your phone loads from the source site (so that site receives your IP address, as it would for any image it serves). So your recipe can credit the person who made it, we also save the creator details the post or page already shows publicly: for Instagram, TikTok, and Facebook, the creator's handle, display name, and a copy of their profile photo; for other web pages, the site's name and the author's name when the page lists one. These are stored with your imported recipe. What our service read from a public post or page may also be kept for about one year in our shared import cache, which is not linked to you or your account, so the next person who imports the same link gets it faster (see "Shared import cache" in Section 6). See Section 6 ("AI Recipe Import").
• A photo you take or choose to import. In Add a photo, you can tap Camera to take a picture or tap Image to pick one image with your phone's photo picker. The camera opens only when you tap Camera and allow camera access. The app shrinks that one image on your device and sends it to our recipe-import service and to Google's Gemini AI (vision) to read the recipe from it. The app then keeps that shrunken copy in its temporary storage on your phone as the recipe's picture. The photo is never uploaded to your account and does not sync, so it will not appear if you open the recipe on another device, and your phone may clear it to free up space. The one exception is a screen recording: about 1 in 10 iPhone sessions are recorded, and a recording can show the photo while it is on screen, kept by PostHog for 30 days (see "Session replays" below). See Section 6 ("AI Recipe Import").
• Recreating a dish from your photo (app version 1.0.7 and later). If the photo you import shows a finished dish rather than a written recipe, the app can offer to recreate it: when Gemini finds no written recipe in a photo you import, our server may ask Gemini once more, about the same photo, whether it shows a finished dish, and only then shows the offer. When you tap Recreate it with AI, the same shrunken photo is sent again to our recipe-import service and to Google's Gemini AI, which writes a recipe for a dish like the one in the photo. The recipe is saved to your account with an "AI recipe" label, because its ingredients, amounts and steps are the AI's best guess, not the recipe of whoever made the dish. As with any photo import, the photo itself is never uploaded to your account: it stays in the app's temporary storage on your phone as the recipe's picture (a screen recording of about 1 in 10 iPhone sessions can show it while it is on screen; see "Session replays" below). The first one is free on each account, and we keep a record on our server that you have used it so it works once.
• Your own cover photos. If you choose your own cover photo for a recipe, from your photo library or your camera, we upload that photo and store it with the recipe in Google Firebase Storage, so the recipe shows it on every device you sign in to. A photo you pick in the recipe editor is uploaded only when you tap Save; if you leave without saving, it is never uploaded. We never show it to other users and never put it on a shared recipe page. Choosing another photo, or choosing "Use original photo" or "Remove photo", deletes it. If you delete the recipe, the photo is usually deleted a few seconds after the option to undo closes. If the app is offline or closes before then, or the recipe is deleted in an older version of the app, it is deleted when you delete your account. Deleting your account deletes all of them.
• Pages you open in the in-app browser. The import flow includes a browser that opens Google search and websites directly from your phone. Google and the sites you visit receive your searches and visits (including your IP address) under their own privacy policies. Daily Bite does not receive what you search for or browse, except in a screen recording: about 1 in 10 iPhone sessions are recorded, and a recording shows the pages you open there and what you type into them, kept by PostHog for 30 days (see "Session replays" below). Otherwise, we receive a page only when you choose to import it.
• Recipe text you paste. When you paste recipe text to import it, that text is sent to our recipe-import service and to Google's Gemini AI to pull out the recipe.
• Fix it (iPhone and Android app version 1.0.6 and later). When you use Fix it on an imported recipe, we send that recipe, and the screenshot if you add one, to Google's Gemini AI to fill in what is missing. We do not keep the screenshot, except that a screen recording of about 1 in 10 iPhone sessions can show it while it is on screen in the app, kept by PostHog for 30 days (see "Session replays" below).
• Ask Nib (iPhone and Android app version 1.0.8 and later). When you ask Nib about a recipe, we send your question, up to your last 16 messages in that chat, and the recipe (its title, servings, cook time, ingredients, and steps) to Anthropic's Claude AI to write the answer (some Nib tasks, such as nutrition estimates, use Google's Gemini AI, and Gemini also answers when Claude is unavailable). When you ask Nib from the home screen, we also send today's date and day of the week, whether you have Daily Bite Pro, the short list of food preferences Nib keeps for that chat from what you tell it (such as your diet, foods to avoid, what you have on hand or ate recently, how much time you have, servings, and budget), and, for the recipes Nib looks through to answer you, short details of your recipes or our library recipes that match your question (title, cook time, protein, and main ingredients) and how many recipes you have saved. When you ask Nib to plan, we also send which days and meals in this week's and next week's meal plan are already filled (not what is in them), and which of the recipes Nib found are already on your grocery list. For Daily Bite Pro users, Nib can also look online for a recipe: it uses Anthropic's web search on a set list of recipe websites, with search words the AI writes from your request. When Nib picks a recipe page, we read and import it the same way as a link you import (via our import providers and Google's Gemini AI) and copy its photos to your account's storage; it becomes a recipe in your library only if you tap Save or add it to your meal plan, and it keeps a link to the original page. Nib only changes your recipes, meal plan, or grocery list when you tap to accept the change. While Nib works, the app shows the steps it is taking (such as what it searched for). We do not send your whole library, your notes, your ratings, your photos, your name, your email address, or your account ID. We keep your chats with Nib, with the food preferences above, on your account so Nib can pick up where you left off (see Section 9). We also keep a log of the questions people type to Nib, with no account ID, so we can see what people ask, find answers that fail or run slow, and improve Nib. We also keep a copy of your conversations with Nib (what you type and Nib's replies, with email addresses, @handles, phone numbers and links removed), without your name or account ID, so we can see where Nib's answers go wrong and improve it. It is deleted after 90 days, or when you delete your account. If you tap Report this answer, we keep a copy of that answer and your reason, with no account ID. Nib's answers are written by AI and can be wrong, nutrition figures are estimates, and Nib is not medical advice. Please do not share personal health details with Nib.
• Reports about an import (iPhone and Android app version 1.0.6 and later). If you report a problem with an imported recipe, we keep what you send (the choice and any note you add) together with that recipe's link, title and what was imported, linked to your account, only to check and improve imports, and we delete it when you delete your account.
• Background imports and notifications (iPhone and Android app version 1.0.6 and later). On iPhone, if you turn on notifications, we store a push token for your phone with your account so we can tell you when an import is ready. Notifications are delivered through Expo's push service, which receives the token and the notification text, including the recipe's title. We remove the token when you sign out on that phone, when you delete your account, or when it stops working. While a recipe imports in the background, we keep its status with your account (the link you shared, whether it finished, and the recipe's title) until about a day after it finishes, so My Recipes can show it. So a dropped connection never imports a recipe twice, we keep a record of each import from a link with your account (the link, the recipe's title and the import's result) for about 3 days. All of this is deleted with your account.
• Feedback you send us. If you answer "How's Daily Bite going?" or use Send feedback in the app, we receive the reaction you pick and anything you type, with your account ID (or an anonymous ID if you are not signed in), app version and phone type. It is stored with our app analytics (PostHog) and read only by the Daily Bite team to improve the app. Please leave out personal details you don't want us to have. You can ask us to delete it at dailybiteapp12@gmail.com.
• The parsed recipe (title, description, ingredients, steps, nutrition, cook time, servings, picture, category, source) and the source URL, which we save to your account so you can return to them.
• Cookbooks you create (their names and timestamps) to organize your saved recipes.
• Your plans and cooking activity: your meal plan, your grocery list, the library recipes you save, the recipes you mark as cooked, the star ratings and private notes you add to recipes, your cooking streak, and recipes you ask us to suggest more or less of, which we use to tailor suggestions. Your notes are never shown to other users. Your star ratings are never shown to other users with your name or account; from iPhone app version 1.0.7 they can count, anonymously, toward the average rating Daily Discover shows for a Recipe of the day (see "Daily Discover" below), and you can choose to turn them into public reviews (see "Public profile, plates, reviews, and comments" below). A screen recording can show your ratings and notes (see "Session replays" below).
• Recipe share links. When you share a recipe you imported from a link, or a recipe from our library, from its recipe page or after marking it as cooked, the app asks our server (a Google Cloud Function) for a share link: trydailybite.com/r/ followed by a random 10-character code. The server stores a public share record that holds only what the share page shows: the recipe's title as you saved it (with any web links taken out, and shortened to 120 characters), whether it is an import or a library recipe, the creator credit (the creator's public handle for Instagram, TikTok, and Facebook posts, or the site's name for a web page; library recipes credit Success Recipes), and a photo when there is one: our own photo for a library recipe or, for an Instagram, TikTok, or Facebook post, a copy of the cover image we saved when you imported it, used only when we can confirm it came from that post and the post shows its creator's handle. A cover photo you chose yourself is never used. The share record never holds your name, email address, or account ID, the ingredients, steps, notes, or ratings, or the link to the original post or page. Anyone who has the link can open the page, including anyone your recipient passes it on to, and the record can be read by anyone who has its code. Messaging apps that show link previews (such as iMessage, WhatsApp, Instagram, and Messenger) fetch the page to build the preview. Share pages are not listed on our site, and we ask search engines not to index them. When someone opens a share page, Cloudflare (our website host) serves it and the photo loads from Google Firebase Storage, so both receive the visitor's IP address and browser details, as they would for any page or image. A separate private record, never shown to anyone, connects the link to your account ID, the recipe, the original link in a cleaned form (without tracking tags or sharing codes), and when the link was made and last updated, so that sharing the same recipe again keeps the same link and so we can remove your links. We also keep daily counts of the links you make and open, to limit misuse. When someone opens a share link in the Daily Bite app while signed in, our server sends their app the recipe's title, photo, and credit and, for an imported recipe, the cleaned original link so their app can import the recipe from there as their own import (for a library recipe, which library recipe it is), and it checks their saved recipes for the same post or recipe so the app can tell them they already have it. It never tells them who shared the link. Recipes imported from a photo or pasted text, or from a shared document, file, or private page, are shared as text and get no link (see "What sharing shows" on our Copyright page).

Daily Discover (iPhone app version 1.0.7 and later). The first tab of the app shows a Recipe of the day, what is popular right now, trending recipes, creators, food websites, and recipes from our library. Some of it is picked by our team. The rest is counted by our server about once an hour from what Daily Bite cooks save, as anonymous totals:

• What is counted. Library recipes saved to your shelves; recipes imported from a public Instagram, TikTok, or Facebook post or a public web page, counted from October 19, 2026 onward only (imports from a photo, pasted text, a file, a shared document, or a private or shortened link are never counted); and, for the Recipe of the day, the star ratings of recipes marked as cooked. Our server reads, for this count, which library recipes are saved and when, an import's original link, its creator credit and when it was made, and those ratings, together with the account ID they belong to, only to count each person once.
• How it is counted. Each count is the number of different people, with the Daily Bite team's own accounts left out: saves and imports from the last 30 days (we may shorten this to 7 days), and ratings from any time, each person's ratings averaged first so everyone counts once. A number is shown only when at least 5 different people are counted (3 for an average rating), and an item that needs a count and stays under that is not shown.
• What anyone can see. Daily Discover shows recipes (title, photo, cooking time, and the creator's public handle or the site's name), creators (their public handle, name, and, only for our own accounts and creators we work with, their profile photo), food websites, and those numbers. It never shows who saved, imported, or rated anything, and it never shows your account, your notes, your edits, your own photos, or the links you saved. The Daily Discover pages hold no account IDs and can be read by anyone, signed in or not. For a post, the photo is the cover image our shared import cache copied from that public post (see "Shared import cache" in Section 6).
• Recipe of the day ratings. The Recipe of the day can show an anonymous average of the star ratings people gave it, only when 3 or more people rated it. It never shows who rated it.
• Filters. To sort recipes by cuisine, meal, diet, cooking method, occasion, and ingredients, our server sends the recipe our shared import cache read from a public post or page (its title, ingredients, and steps, never anything a person added or changed, and no account ID or link) to Google's Gemini AI, which picks labels from a fixed list. Library recipes are labeled the same way, by our team.
• Saving from Daily Discover. When you tap Save on a post or website recipe, the app asks our server for its original link (only then, and only when you are signed in) and imports it as your own import, exactly as if you had pasted the link. We keep a daily count of these requests with your account, to limit misuse.
• Creator pages. Daily Discover has pages for our own accounts (Success Recipes, Success Meal Prep, Success Keto, and our founder's account) with their bio, links to their social profiles, and folders of recipes from our library. Opening one sends nothing about you to anyone; tapping a link opens that profile in your browser or the platform's app.
• A creator or website can ask to be left out of Daily Discover at dailybiteapp12@gmail.com, and we remove them at the next count.

Food websites in Daily Discover (iPhone app version 1.0.7 and later). For a short list of food websites that Daily Bite cooks import from most, our server checks each site's public recipe feed about every 6 hours and keeps its newest recipe posts (title, link, the address of the post's photo, and the date). It identifies itself as Daily Bite's importer, follows each site's robots.txt, and sends nothing about you. When you open one of those recipes, the app sends our server only that recipe's link; our server reads the public page and sends back the recipe it finds. What it read is kept for up to 7 days (1 day when the page has no recipe) in a shared cache that is not linked to you, so the next person who opens the same recipe gets it faster, and we keep a daily count of your reads with your account, to limit misuse. The recipe photos and site icons on these screens load on your phone directly from each website's own servers, and Original opens the site's own page in the in-app browser (see "Pages you open in the in-app browser" above), so that website receives your IP address and device details, as it would for any visit. Save imports the recipe like any link you paste. A website can ask to be left out at dailybiteapp12@gmail.com.

Public profile, plates, reviews, and comments (iPhone app version 1.0.7 and later, as we switch each feature on). These are optional: Daily Bite works the same without them, and nothing you do in the app is public unless you choose it.

• Your public profile. To go public you pick a username (3 to 20 letters, numbers, periods, or underscores, which you can change twice in 30 days), and you can add a display name, a short bio, and a profile photo. When you set it up, you give your birth year and accept our Community Guidelines. We keep your birth year, the age group it puts you in (under 13, 13 to 17, or 18 and over), and when you accepted, in a private record that only our server can read; it is never shown to anyone. You cannot have a public profile if you are under 13. Other signed-in Daily Bite users can see your public profile: your username, display name, bio, profile photo, and how many public plates, reviews, and saves you have. It never shows your email address, your age or birth year, or anything you have not made public, and it is not on our website. You can pause your profile at any time, which hides it and your public posts and keeps your username. When you change your username or delete your account, your old username stays reserved for 90 days so nobody else can take it right away.
• Your profile photo. If you signed in with Google and your Google account has a profile photo, our server copies it once, from the link Google gave us at sign-in, into private storage with your account as your Daily Bite profile photo. You can also take or choose a photo of your own, or remove it. Your profile photo stays private until you have a public profile, and it becomes public only after it passes the automatic photo check below. Accounts without a photo show their initial.
• Plates. A plate is a photo of a dish you cooked, with an optional caption (up to 140 characters), linked to the recipe. You choose public or private for each plate (on a 13 to 17 profile, plates start as private). Plate photos are stored in our Firebase file storage; a public plate's photo is also stored as a public copy that anyone who has its link can load, and that copy is deleted when the plate is made private, removed, or deleted.
• The automatic photo check. Before a plate photo or profile photo can be public, our server removes its hidden details (such as location and camera information) and sends the photo to Google's Gemini AI, which answers only whether it looks like food and whether it shows anything our Community Guidelines do not allow (for plates, also whether it shows people). If the photo is flagged, or the check cannot run, it stays private and the app tells you why. The answer itself is not kept, only whether the photo passed and the reason shown to you.
• Reviews, comments, and likes. A review is a star rating with optional text (up to 500 characters) on a recipe; you can write one, or turn ratings you already gave into reviews. Comments (up to 300 characters) go on plates and reviews, and you choose whether others can comment on yours (on a 13 to 17 profile, comments start turned off). Your public plates, reviews, and comments show your username, display name, and profile photo to other signed-in Daily Bite users. Before any display name, bio, caption, review, or comment is posted, our server checks it against our own list of words that break our Community Guidelines and then sends the text (never your account ID) to Google's Gemini AI for the same check (usernames are checked against the list only). Text that breaks the guidelines is not posted, and a review that might is held back from others. A comment that may be offensive is posted but hidden for people who keep "Hide offensive comments" on, which it is by default. When you like a post, its like count goes up; who liked it is kept privately. The owner of a post sees likes and comments in their Activity, with the username and photo of up to 3 recent likers and the comment text. Activity is shown in the app only; it does not send notifications.
• Sharing a save to Daily Discover. You can choose to show a recipe you saved on Daily Discover with your username. It shows the recipe's title and the creator's credit, which links to the creator's profile (for a website, its home page), never the link you saved, and never your notes or your rating. For an Instagram, TikTok, or Facebook post, it also shows the post's own photo: our server makes a public copy of the cover image we saved when you imported it (only when we can confirm it came from that post and the post shows its creator's handle, never a cover photo you chose yourself), after Google's Gemini AI checks it for unsafe content. The copy is kept in our Firebase file storage at an address that does not include your account ID, and anyone who has its link can load it. A recipe from a website, or a photo the check flags, shows a Daily Bite cover instead. The copy is deleted when you make the save private or delete it, when it is hidden or removed after reports, when your account is banned or deleted, or when the creator asks us to take it down. A creator who wants a shared save of their recipe or photo taken down can report it from its menu (choose "This is my recipe or photo") or email dailybiteapp12@gmail.com.
• Reports. You can report a profile, plate, review, shared save, or comment from its menu, choosing a reason, or report a problem with a note of up to 500 characters. We keep the report with your account ID, what you reported, the account that posted it, the reason, and any note. The person you report is never told who reported them. Some reasons hide the item at once, and others hide it after several different people report it, until our team reviews it; our team may remove content and suspend accounts that break the Community Guidelines. To keep one person from reporting the same item twice, we also keep coded records of who reported what, which do not store your account ID.
• Blocks. When you block someone, we keep privately with your account who you blocked (their account ID and username), and a matching private record on their account that their app uses to hide your profile and posts from them and yours from you. The app does not tell them, and you can unblock them at any time.

Subscription and purchase information. Daily Bite Pro is sold through Apple In-App Purchase on iPhone and Google Play Billing on Android, and your subscription status is managed by RevenueCat. We receive your subscription/entitlement status and basic device/transaction information. Starting with version 1.0.4 of the iPhone app, Meta's software in the app also records App Store purchases made in the app, and the app may give RevenueCat device identifiers and your tracking choice so RevenueCat can report subscription events to Meta for ads measurement; when that happens, and what a "no" means, is explained under "Ads measurement (Meta)" below. We never receive or store your credit-card or payment-card details; Apple or Google handles payment.

Information stored only on your device. We keep small convenience caches on your device (using local app storage) so the app loads quickly: a copy of your profile basics, the titles of your imported recipes, your cookbook names, and a snapshot of the curated recipe library. Starting with version 1.0.6, the iPhone and Android apps also keep a copy of your paywall history (see "Paywalls (Superwall)" below), and the iPhone app also keeps whether you turned off the reminder for a free trial. Photos you import from your camera or photo library are also kept only in the app's temporary storage on your device, which your phone may clear. These stay on your device and are not separate transfers of your data. The profile cache is cleared when you sign out. The copy of your paywall history stays until you uninstall the app.

Limited technical/log data via our backend. Our backend provider, Google Firebase, processes standard technical information such as your IP address and device/user-agent for security and to deliver the service (for example, Firebase Authentication retains login IP addresses for a short period). Our server functions also write error logs that may include your Daily Bite account ID, but not your name or email address; these are kept for a limited period. We do not use this for advertising.

App updates. Each time the app launches, it checks Expo's servers (EAS Update, run by 650 Industries, Inc.) for an update to the app. That check sends Expo your IP address, your platform (iPhone or Android), the app's runtime version, and a random installation ID used for update delivery. If a previous update failed to start, it also sends a short technical error message. It does not include your name, email address, or Daily Bite account ID.

App analytics. The Daily Bite app uses PostHog, a product analytics service, to see which features people use and where they get stuck, so we can fix and improve the app. The app sends PostHog events about how you use it: the screens you view; when you create an account or sign in, and which sign-in method you used; when a recipe import starts, succeeds, or fails, labeled with the kind of source (Instagram, TikTok, another link, a photo, or pasted text), and, for a success, how long the import took and whether a video transcript filled in part of the recipe, or, for a failure, a short error code; when you are offered, start, finish or close a recreate of a dish from a photo, with counts and fixed labels only (such as how long it took, how many ingredients and steps came back, and whether it was your free one), never the photo or the recipe; when you save a recipe, and whether it came from our library or an import; when you search, with counts and fixed labels only (such as how many characters you typed, how many results came back, and the sort you chose), never the text you typed; which onboarding steps you finish, but not your answers, and how many recipes you picked during setup (the number only); when a Pro screen is shown or closed, and which Pro screen it was; when you see a special offer or start a trial (with the plan you picked); on iPhone and Android, from version 1.0.6, when a Pro screen is requested, whether Daily Bite Pro already on your App Store or Google Play account moved to your Daily Bite account when you signed in, and, if your free trial starts while notifications are off, whether you turned them on when the app offered a reminder; on iPhone, from version 1.0.6, when you cancel a purchase on the App Store screen or switch to a yearly plan, which free tries of Pro features you used, and whether you turned the trial reminder on or off on a Pro screen; on iPhone, your answer to the tracking question (allowed or not), and whether Meta's software was started at launch or waited for your answer, with the region set on your phone and its time zone; when you mark a recipe as cooked, rate it (the number of stars), or share it, never your note or the recipe itself; whether a share used a share link (or, if not, why it sent text instead), and when you open or save a recipe someone shared with you, never the recipe's title, the link, or its code; when you open the recipe editor and what kind of change you saved, with counts and yes-or-no answers only (such as how many steps you added or whether you changed the cover photo), never the text; which buttons you tap on the Daily Bite home screen, and whether the recipe was from our library or your own, never which recipe; when you open a reminder notification; from iPhone app version 1.0.7, when you view Daily Discover and which of its sections showed, open, save, or share one of its recipes, creators, or websites (the section, the kind of recipe, whether it was locked, and a website's domain, never the link or the recipe), search it (whether you typed, picked a filter, or tapped a popular tile, and whether anything came back, never your words), open a creator page, one of its folders, or its links, and community actions such as setting up a public profile, setting a profile photo, posting a plate, review, or comment (whether it was public and whether it had text or a photo, never the text or the photo), liking, reporting (the reason you picked), and blocking; a few feature taps such as starting Cook Mode; and, only if you choose to send us feedback in the app, the reaction you pick and the text you write (see "Feedback you send us" above). Each event also carries your platform (iPhone or Android), app version, screen size, and which version of setup you were shown (we sometimes test two versions of setup, and the app asks PostHog which one to show you). Starting with version 1.0.6 of the iPhone app, each event also carries which version of the Daily Bite Pro screen at the end of setup you were shown (we test two, chosen the same way). Before you sign in, events are tied to a random anonymous ID. After you sign in, they are linked to your Daily Bite account ID, a random identifier that is not your name or email address. These events never include your recipe titles, links, ingredients, cookbook names, search text, or onboarding answers (session replays, described below, show the app's screens as you saw them). The only text you type that PostHog receives as an analytics event is feedback you choose to send us; session replays can show what you type, as described below. PostHog also receives the IP address the events come from and may use it to estimate a rough location, such as your country, city, or approximate postal code. PostHog keeps some facts on its record of your account ID until we delete them. These include whether you have Daily Bite Pro, which version of setup you were shown, your device type, app version, and screen size, and the rough location (country, region, city, approximate postal code, approximate map coordinates, and time zone) it estimated from your IP address the first and last time it saw you. We do not use PostHog analytics for advertising, and PostHog data is not sent to Meta. This data is processed by PostHog in the United States (PostHog Cloud US).

Session replays. Starting with version 1.0.6 of the iPhone app, PostHog also records a share of app sessions (about 1 in 10) as screen recordings: a series of pictures of the screens you move through and where you tap, so we can find bugs, see where people get stuck, and improve the app. We do not record sessions on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone. A recording shows the app as you saw it, including the recipes and cookbooks you view and their photos, photos from links you import, the choices you tap during setup, your first name where the app shows it (if you signed up with email, that name is the start of your email address until you change it in About You), Daily Bite Pro screens, and what you type into the app, such as recipes you write or edit, searches, grocery items, notes, links you paste, feedback you send us, and reports about a problem with an import, and, from iPhone app version 1.0.8, the messages you send to Nib, Nib's answers, and the steps Nib shows while it works. It also shows your own photos once they appear in the app (for example a photo or scan you import, a screenshot you add in Fix it, a cover photo you choose, and any picture made from one of those photos) and the web pages you open in the app's built-in browser. Two things you type or see on the app's own screens are always covered with a solid block on your phone before anything is sent: your password, and your email address, both where you type it (such as when you sign in or sign up) and wherever the app shows it (such as on the Profile and About You screens, in sign-in notices, and where the app says which account you are signed in as). The box where you type to Nib is also covered while you type; a message appears in a recording once you send it. The app cannot cover parts of a web page, so anything you type into a website in the built-in browser (for example, an email address to sign in to that site) can appear in a recording. Your phone's camera screen is never recorded, and its photo picker, which can show your whole photo library, appears only as a blank block; a photo you take or pick can appear once it is in the app. Replays do not include the app's logs or its network activity. Replays are linked to the same anonymous ID or account ID as the events above, are processed by PostHog in the United States, and are kept for 30 days. The Android app does not record replays.

Paywalls (Superwall). Starting with version 1.0.6 of the iPhone and Android apps, most Daily Bite Pro screens and offers in the app are shown by Superwall, our paywall tool. Each time you open or leave the app, and when it shows one of these screens, Superwall's software sends Superwall your Daily Bite account ID once you sign in (a random ID before that, which Superwall links to your account ID when you sign in), an identifier for the app on your device, on an iPhone also Apple's ID for your App Store download of the app (which is the same on any device that uses your Apple Account), which screens you were shown and what you tapped on them, whether you subscribe, and the store's records of your Daily Bite purchases: on an iPhone, Apple's records of the purchases made with your Apple Account (product, purchase and expiry dates, price, currency, App Store country, and transaction IDs), and on Android, Google Play's records of the purchases made in the app (product, purchase date, price, currency, and order IDs). It also sends your device model, operating system, app version, language, region and currency settings, time zone, when you installed the app, and other technical details, such as text size, network type and display settings. To pick the right screen, the app also tells Superwall: whether you have Daily Bite Pro, whether you have had a free trial or a paid plan before, which plan you are on and roughly how many months you have paid for it, whether you can still get a free trial, whether notifications are on for the app, which of your free tries of Pro features (Cook Mode, unit conversion, one import from a photo or screenshot, and one dish recreated from a photo) you have used, whether you are signed in, whether this is your first time using the app, and which Pro screens you have seen or closed before, how often, and when. Superwall estimates a rough location (country, region, and city) from your IP address. Superwall also uses the details it receives to estimate how likely you are to subscribe, and that estimate can be used to choose which screen or offer you see. We use this to choose which screen or offer to show you, to compare two versions of a screen, and to see which work best. Your purchase is still made through Apple or Google Play and managed by RevenueCat, which also sends Superwall your subscription events, with your account ID, or with RevenueCat's random ID for you, for example if you bought before signing in. We also keep a record of the Pro screens you have seen and closed, and whether you have had a free trial or a paid plan before (your paywall history), with your account, or only on your phone until you sign in, and a record on our server of the free tries you have used, so offers are not shown too often and each free try works once. Other than whether notifications are on, Superwall never receives your answers from setup, and it never receives your name, email address, or recipes. We do not use Superwall data for advertising or send it to Meta. On Android, the Daily Bite Pro screen at the end of setup is still shown by RevenueCat, not Superwall. The Android app keeps your paywall history in the same way.

Trial reminder. Starting with version 1.0.6 of the iPhone and Android apps, some Daily Bite Pro screens let you choose whether to be reminded before your free trial ends. The reminder is a notification scheduled on your phone, not sent from our servers. On iPhone and Android, from version 1.0.6, if your trial starts while notifications are off, the app may ask whether you want to turn them on. What you choose is recorded in our app analytics, as described in "App analytics" above.

Crash reports. The app uses Sentry to report crashes and errors in the versions we publish on the App Store and Google Play (it is turned off in our development builds). A report includes what went wrong and where in the app it happened, technical details about the app's state at the time, and your device model, operating system, and app version. We filter out one kind of harmless network error that happens while the app is in the background, so real problems stand out. Crash reports may include your Daily Bite account ID, but not your name or email address. This data is processed by Sentry in the United States.

Ads measurement (Meta). We run ads for Daily Bite on Facebook and Instagram. Starting with version 1.0.4 of the iPhone app, the app includes software from Meta (the Facebook SDK) so we can see which of those ads lead to installs, free trials, and subscriptions, and so Meta can show our ads to people more likely to want the app. Daily Bite shows no ads inside the app. This applies to the iPhone app only: the Android app does not start Meta's software and does not collect the Android advertising ID.

The tracking question. After setup is finished, your iPhone asks once whether to allow Daily Bite to track you across other companies' apps and websites. The question reads: "Daily Bite uses this to see which of our Instagram and Facebook ads bring people to the app. Your recipes are never shared." Only if you tap Allow does the app receive your iPhone's advertising identifier (IDFA) and give it to Meta and RevenueCat. Nothing in Daily Bite changes either way. Every feature works the same.

What is sent at launch, on every iPhone. When the app launches, Meta's software contacts Meta's servers to fetch its own settings. That request carries our Meta app ID and, like any internet request, your IP address. It carries no identifier about you and no events. What happens after that depends on where your iPhone is set.

If your iPhone is set to a UK, EU, EEA or Swiss region, or to a European time zone. The app sends Meta no events and no identifiers unless you tap Allow. If you tap Allow, Meta's software starts and sends Meta a record that the app was installed and of each time it is opened, with an anonymous ID it creates for this install, your advertising identifier (IDFA), your IP address, and technical details about your device (such as model, operating system and app version, screen size, language, time zone, and mobile carrier), plus a record of each App Store purchase it detects in the app, such as a free trial starting or a subscription purchase, with the product, price, and currency. The app also gives RevenueCat that anonymous ID, your iPhone's identifier for our apps (IDFV), your advertising identifier, your IP address, and your tracking choice, and RevenueCat reports your subscription events to Meta from its servers: a free trial starting, a purchase, or a renewal, with the price, currency, those identifiers, and the ID RevenueCat holds for you (your Daily Bite account ID, or RevenueCat's random ID if you are not signed in), sent as is (or in a coded, hashed form if we later move RevenueCat to Meta's Conversions API). If you tap Ask App Not to Track, nothing about you is sent to Meta, including your subscription events.

Everywhere else, including the United States, Canada, and Australia. From the first time you open the app, Meta's software sends Meta a record that the app was installed, of each time it is opened, and of each App Store purchase it detects in the app, such as a free trial starting or a subscription purchase, with the product, price, and currency. These records carry an anonymous ID it creates for this install, your IP address, and the technical details about your device listed above, but not your advertising identifier, unless you tap Allow. The app also gives RevenueCat that anonymous ID, your iPhone's identifier for our apps (IDFV), your IP address, and your tracking choice. If you tap Allow, your advertising identifier (IDFA) is added to what Meta's software sends and to what the app gives RevenueCat, and RevenueCat reports your subscription events to Meta from its servers: a free trial starting, a purchase, or a renewal, with the price, currency, those identifiers, and the ID RevenueCat holds for you (your Daily Bite account ID, or RevenueCat's random ID if you are not signed in), sent as is (or in a coded, hashed form if we later move RevenueCat to Meta's Conversions API). Meta matches this with what it knows about ads you saw or tapped on Facebook or Instagram. RevenueCat forwards a subscription event to Meta only if you tapped Allow before that event happened. If you tap Ask App Not to Track, or have not yet been asked, iOS does not give the app your advertising identifier and RevenueCat sends Meta none of your subscription events. Meta still receives the install, app-open, and in-app purchase records above from Meta's software, which carry no advertising identifier. Apple may also send Meta a delayed install report that does not identify you or your device.

What is never sent to Meta: your name, email address, recipes, saved links, cookbooks, meal plans, grocery lists, onboarding answers, dietary preferences, or allergies.

Who receives it. Meta Platforms, Inc. receives this data and uses it for its own purposes, under its own terms and privacy policy, to provide measurement and to target, deliver, and improve ads. RevenueCat handles the identifiers and forwards subscription events as our service provider.

Your choices. You choose when your iPhone asks, and you can change your answer at any time in iPhone Settings > Privacy & Security > Tracking. To stop every app from asking, turn off Allow Apps to Request to Track on the same screen. Declining changes nothing in the app. You can also review the activity other apps send to Meta in your Facebook or Instagram settings.

Ads measurement (Apple Ads). We may also run ads for Daily Bite on the App Store through Apple Ads, Apple's advertising service. Starting with version 1.0.7 of the iPhone app, the app asks Apple's software on your iPhone for an attribution token, a code that lasts 24 hours, and gives it to RevenueCat. RevenueCat sends the token to Apple, and Apple answers whether you downloaded Daily Bite after tapping or seeing one of our Apple Ads and, if you did, which campaign, ad group, keyword, and ad it was, where on the App Store it appeared, the campaign's country or region, and, when Apple provides it, the time you tapped or saw the ad, to the minute. RevenueCat keeps Apple's answer on your RevenueCat subscriber record, with your Daily Bite account ID (or RevenueCat's random ID if you are not signed in), so we can see which of our App Store ads lead to free trials and subscriptions. Apple's answer comes only from Apple's own App Store data. It does not use your advertising identifier (IDFA), it is not tracking as Apple defines it, and your iPhone does not ask your permission for it. It is never sent to Meta. RevenueCat may include it with the subscription events it sends Superwall (see "Paywalls (Superwall)" above). If your iPhone is set to a UK, EU, EEA or Swiss region, or to a European time zone, the app does not ask for the token. The Android app does not include this.

Website waitlist and Android tester sign-up. If you join the waitlist or the Android tester list on trydailybite.com, we collect the email address you enter, the time you signed up, and which form on the site you used. We use your email to tell you when the app launches or when your tester install link is ready, and to send occasional recipes and updates, and you can unsubscribe at any time. The list is stored with Cloudflare (our website host). When you join the Android tester list, your tester invite email is sent automatically through Resend, and we add your email address to our Google Play tester list so you can install the test app. Launch news, recipes, and updates are sent through Flodesk, our email service provider. We do not sell the list. These sign-ups are not linked to a Daily Bite app account.

Website analytics. On trydailybite.com we use PostHog, a product analytics service, to see which pages are visited and which buttons are used, so we can improve the site. PostHog receives the page you view, when you leave a page, the site that referred you, your device type, browser and operating system, whether you opened the site inside another app's browser (for example Instagram or TikTok), and taps on the download buttons and FAQ questions. On recipe share pages it also receives that a share page was viewed (whether it showed an imported recipe, a library recipe, or a missing page) and taps on Open in Daily Bite with your device type; the link's code is replaced with a placeholder and the recipe's title is never sent. We run it in cookieless mode: it stores nothing in your browser (no cookies, no local storage), and it counts visitors with a one-way hash of your IP address, your browser and our site name that changes every day and cannot be turned back into any of those values. The IP address itself is discarded before anything is stored, so no location data is kept. Session recording is turned off, and PostHog never receives your email address or anything you type into a form. This data is processed by PostHog in the United States (PostHog Cloud US) and kept for one year on our current plan; we can delete it earlier at any time. The site shows no cookie banner because nothing is stored in your browser.

What we do NOT collect

We want to be explicit. The Daily Bite app does not collect or access:

• Your device's location. The app never asks for location permission and never reads GPS. (PostHog and, from iPhone and Android app version 1.0.6, Superwall may estimate a rough location from an IP address, as described in "App analytics" and "Paywalls (Superwall)" above.)
• Health or HealthKit data (the "allergies" field is a self-typed onboarding answer, not health-app data).
• Your contacts.
• Your photo library or camera, beyond the one photo you choose. Daily Bite does not browse or scan your photo library, and it uploads only a photo you choose as a recipe's cover photo or, from iPhone app version 1.0.7, as your profile photo or a plate. The photo picker gives the app only the single image you pick, and the camera opens only when you tap Camera in Add a photo, Take photo for a cover photo, or the camera button for a profile photo or plate. A photo you import is used only to read the recipe and as the recipe's picture on your device; a cover photo you choose is stored with that recipe (see Section 3, "Recipes and cookbooks you create or import"). The one exception is a screen recording: about 1 in 10 iPhone sessions are recorded, and a recording can show a photo you imported or chose while it is on screen in the app, kept by PostHog for 30 days. The camera screen is never recorded, and the photo picker appears in a recording only as a blank block (see "Session replays" above).
• Ads inside the app. Daily Bite shows no ads, and your recipes, saved links, onboarding answers, dietary preferences, and allergies are never used for advertising or sent to Meta. On Android, the app does not collect the advertising ID at all. On iPhone, it receives your advertising identifier only if you tap Allow on the tracking question (see "Ads measurement (Meta)" above).
• Your recipe content in analytics events. Recipe titles, links, ingredients, cookbook names, and search text are never sent to PostHog as analytics events. Session replays (iPhone app version 1.0.6 and later) are different: they show the app as you saw it, including your recipes, what you type, your own photos once they are in the app, and pages you open in the in-app browser, but never your password or your email address on the app's own screens (see "Session replays" above).

Starting with version 1.0.4 of the iPhone app, Daily Bite does one kind of tracking, as Apple defines that word: measuring our own Facebook and Instagram ads with Meta (see "Ads measurement (Meta)" above). Measuring our own App Store ads with Apple Ads (see "Ads measurement (Apple Ads)" above) is not tracking as Apple defines it: Apple answers from its own App Store data, and the app does not use your advertising identifier for it. Your iPhone asks for your permission first for Meta, and what Meta receives before and without that permission depends on where your iPhone is set, as that section explains. The Android app does no such tracking. App analytics and crash reports cover only how the Daily Bite app itself works and are not sent to Meta. Website analytics is limited to our own site and is not connected to your app account.

4. How We Use Your Information

We use your information only to: create and secure your account and log you in; personalize recipe recommendations and filtering using your onboarding answers and cooking activity; save, display, and organize the recipes, cookbooks, meal plans, and grocery lists you create or import; import a recipe from a link, photo, or pasted text (via our import providers and Google's Gemini AI), recreate a recipe from a photo of a dish when you ask (via Google's Gemini AI), answer your questions with Ask Nib, look online for recipes with Ask Nib for Daily Bite Pro users (via Anthropic's web search), suggest changes, translations, meals, and grocery lists, and save the versions you choose (via Anthropic's Claude AI and Google's Gemini AI), count the Nib asks you have used and keep their daily limits, and answer a link someone already imported from our shared import cache; make the recipe share links you ask for, show their pages, and open the ones shared with you; show Daily Discover, with anonymous counts of what Daily Bite cooks save, import, and rate, and read a food website's public recipe when you open it; show your public profile, plates, reviews, and comments to other signed-in users when you choose to make them public, check them against our Community Guidelines (including the automatic photo and text checks, via Google's Gemini AI), and handle reports and blocks; estimate a recipe's nutrition when a Daily Bite Pro user asks for it (via Google's Gemini AI); provide and manage Daily Bite Pro subscriptions, including restoring purchases; choose which Daily Bite Pro screens and offers to show you, compare two versions of a screen, keep offers from showing too often, and, from iPhone and Android app version 1.0.6, make each free try of a Pro feature work once; remind you before a free trial ends; understand where people drop off in setup; tell you when the app launches and send occasional recipes and updates if you joined the website waitlist or tester list; understand how the app and our website are used (which screens and features are used in the app, screen recordings of a share of iPhone sessions, and which pages are viewed and which buttons are tapped on the site) so we can find bugs and improve them; read the feedback you choose to send us in the app; measure and improve our own ads for Daily Bite on Facebook and Instagram and on the App Store (see "Ads measurement (Meta)" and "Ads measurement (Apple Ads)" in Section 3); find and fix crashes and errors; and maintain security, prevent abuse, and operate the service. We do not use your recipes, profile, or onboarding answers for advertising, we do not build profiles of you for other companies, and we do not sell your information for money.

What the Daily Bite team can see. The Daily Bite team (the people who build and run the app) can view account and app data, including your name, your email address, and the recipes you save or import, including cover photos you choose for your recipes, and the screen recordings of about 1 in 10 iPhone sessions (none on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone) described in Section 3 ("Session replays"). We look at this data to run and support the app, fix problems, prevent abuse, and understand what people save so we can improve our recipes and features. The team may also keep a working copy of this data on its own computer to review what people save. From iPhone app version 1.0.7 the team also sees reports, plates, reviews, and comments that were reported, flagged, or hidden, and the private copies of photos the automatic check held back, so it can review them. That copy is rebuilt from current data, so a deleted account drops out of it the next time it is rebuilt. The team's private admin page, which shows the same kind of data, is protected by sign-in and relayed through Cloudflare. So that some cover images display in a web browser, the admin page may save a converted copy of a cover image (for example, a HEIC image turned into a JPEG) in our Firebase file storage; these converted copies are removed when you delete your account. We never sell this data for money, and we never show your information, or the recipes you save, edit, or create, to other users, except what you choose to share: a share link's page shows the recipe's title as you saved it, its creator credit, and, for some recipes, a photo (see "Recipe share links" in Section 3); and, from iPhone app version 1.0.7, your public profile and the plates, reviews, comments, and saves you make public, which other signed-in users can see (see "Public profile, plates, reviews, and comments" in Section 3). Daily Discover's counts never identify you. Otherwise, the only thing another person can receive from one of your imports is what our shared import cache kept from a public post or page (see Section 6), which never includes anything you added or changed and never says who imported it.

5. Legal Bases for Processing (GDPR/UK GDPR)

For users in the EU/UK, we rely on: performance of a contract (creating your account, syncing and saving your recipes/cookbooks, importing a recipe you asked to import, making and opening the share links you ask for, showing what you choose to make public, and providing subscriptions); legitimate interests (keeping the service secure, preventing abuse, finding and fixing crashes, measuring how our app and website are used (including session recordings of a share of iPhone sessions; we do not record sessions on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone), answering a link someone already imported from our shared import cache, counting saves, imports, and ratings anonymously for Daily Discover, checking public content against our Community Guidelines and handling reports and blocks, and choosing and testing which Daily Bite Pro screens and offers to show); and consent for ads measurement with Meta (on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone, the app sends Meta no events and no identifiers unless you tap Allow on the tracking question) and anywhere else consent is legally required. You can withdraw it at any time (Section 10).

6. Third-Party Services (Sub-Processors) and AI Recipe Import

We use a small number of trusted service providers to run Daily Bite. Each processes your data only to provide its service to us, under its own privacy policy and data-processing terms. There is one exception: Meta receives ads measurement data and also uses it for its own purposes, as its row below explains. We require that any third party with whom we share user data provides the same or equal protection of that data as stated in this policy and as required by Apple's App Store guidelines and Google Play's policies.

AI Recipe Import: details. When you import a recipe from a link, our recipe-import service first gets the public content: Instagram, TikTok, and Facebook posts are read through ScrapeCreators (the caption and, when needed, the post's images or the video's transcript), and other web pages are fetched through Firecrawl. That content is sent to Google's Gemini AI to convert it into a structured recipe. We use the paid Gemini API tier, under which Google does not use your prompts or the responses to train or improve its models, and retains data only for a limited period for abuse and policy enforcement. We do not store the fetched content itself (the caption, the page, the images, or the transcript). We save the resulting recipe, the source link, and the cover image to your account: a copy in our Firebase file storage when the copy succeeds, or otherwise a link to the original image on the source site. The recipe our service read may also be kept in our shared import cache (below). ScrapeCreators and Firecrawl may cache the public content they fetch under their own policies; ScrapeCreators may cache and reuse a video's transcript for up to 30 days. When you import from a photo instead, the single image you took or chose is sent to Gemini in the same way; we do not send any of your other photos, and the photo itself stays in the app's temporary storage on your phone as your new recipe's picture (a screen recording of about 1 in 10 iPhone sessions can show it while it is on screen; see "Session replays" in Section 3). When Gemini finds no written recipe in that photo, we may send the same image to Gemini once more to ask whether it shows a finished dish, so the app can offer to recreate it; we keep nothing from that check except, when the offer is made, a short note on your account of when it was made (so a recreate can use that photo's import instead of a second one). If you ask Daily Bite to recreate a dish from that photo, the same image is sent to Gemini once more to write a recipe for a similar dish; we save that recipe to your account with its "AI recipe" label and keep nothing else from the photo except a short fingerprint worked out from it (16 characters of a one-way hash), which cannot be turned back into the photo, is used only so that a retry of the same request must send the same photo, and is kept with that request's record on our server until you delete your account. Pasted recipe text is sent to Gemini in the same way. When a Daily Bite Pro user taps Calculate nutrition on a recipe, that recipe's ingredient list and number of servings are sent to Gemini to estimate its nutrition. Ask Nib (app version 1.0.8 and later) sends your question and the recipe it is about (and, from the home screen, the details described in Section 3) to Anthropic's Claude API to write the answer, and uses the same paid Gemini API tier for some tasks and when Claude is unavailable; neither Anthropic nor Google uses them to train or improve its models.Please do not import links, photos, or text that contain sensitive personal information, since their content is sent to our providers for processing.

Shared import cache. So a link that someone already imported comes back in about a second instead of being read and processed again, our recipe-import service keeps a shared copy of what it read from public posts and pages. When an import from a link succeeds and the result is complete, we may keep, for about one year: the recipe as our service read it (title, description, ingredients, steps, nutrition, cook time, servings, and category), the titles of the recipes in a roundup post, which part of the recipe (if any) came from the video's transcript, the post's or page's public creator credit (platform, handle, display name, site name, and profile link), copies of the cover image and of the creator's profile photo, and the link in a cleaned form (without tracking tags or sharing codes), with its site and platform. A cache entry is not linked to any account: it never holds your account ID, the link exactly as you pasted it, how many imports you have used, or anything you add or change later (edits, notes, ratings, cover photos you choose, or cookbooks). When anyone imports the same post or page while the entry is kept, they receive their own copy of that recipe with their own copies of the photos; it counts as one of their imports, and nothing tells them who imported it before. The cache only takes links that name one public post or page. It never takes photo imports or pasted text; links to shared documents, notes, photo albums, or file storage (for example Google Docs, Drive, Keep, Sites, or Photos, Dropbox, iCloud, Notion, OneDrive, SharePoint, Box, Evernote, Canva, Quip, Airtable, Coda, MEGA, WeTransfer, or cloud storage links); Facebook share links; link shorteners or pages reached through a redirect; links with a fragment after #, other than a jump to the recipe; or web links that carry anything beyond the page's own address and tracking tags (such as a session, a sign-in token, or an email-campaign ID). It never keeps a recipe the import marked as possibly incomplete. Entries are deleted automatically after about one year (their photos a few days later), and sooner when someone reports a problem with an import of that link or when a creator or site owner asks us to stop: email dailybiteapp12@gmail.com and we delete what the cache holds from their posts or site (including its subdomains) and stop keeping it. On iPhone app version 1.0.6 and later, choosing Import again on the "Already in My Recipes" card always reads the link fresh.

7. Data Sharing

We do not sell your personal information for money, and no one pays us for your data. We disclose your information to the service providers listed in Section 6 so they can operate the app for us, to Meta for ads measurement as described in Section 3, and where required by law. Some privacy laws, including California's, define these words broadly: sending device identifiers, Meta's anonymous ID for this install, your account ID or RevenueCat's random ID, and subscription and in-app purchase events to Meta so it can measure and improve our ads can count as "sharing" personal information for cross-context behavioral advertising, and under some readings as a "sale", even though no money changes hands. We began doing this with version 1.0.4 of the iPhone app, released on September 24, 2026. Before that release we did not, and the Android app does not. To opt out, see "Your choices" under "Ads measurement (Meta)" in Section 3.

From iPhone app version 1.0.7, what you choose to make public (your public profile, and the plates, reviews, comments, and saves you make public) is visible to other signed-in Daily Bite users, and the photo of a public plate or shared save to anyone who has its link. Daily Discover shows only anonymous totals, never who saved, imported, or rated a recipe.

8. International Data Transfers

Daily Bite's providers (Google Firebase, Google Gemini API, Anthropic, Google Sign-In and Google Play, Apple, RevenueCat, Superwall, Meta, PostHog, Sentry, Expo, ScrapeCreators, Firecrawl, Cloudflare, Flodesk, and Resend) process and store data on infrastructure in the United States and other countries. Where data is transferred out of the EU/UK/Canada, our providers rely on recognized transfer mechanisms such as the EU-U.S. / Swiss-U.S. Data Privacy Frameworks and/or Standard Contractual Clauses. By using Daily Bite you understand your information may be processed in these locations.

9. Data Retention and Deletion

• Account and profile data (including your marketing-email choice and Terms acceptance), saved recipes, cookbooks, meal plans, and grocery lists: kept until you delete them or delete your account.
• Setup log entries: entries tied to your account are kept until you delete your account, which removes them. Entries that were never linked to an account (for example, if you closed the app before signing in) carry no account ID and are not removed.
• Cover images copied from links you import, and converted copies of them made for the team's admin page: kept in our Firebase file storage while your account exists, and removed when you delete your account. If a cover image could not be copied, the recipe keeps a link to the original image instead, and that image stays on the source site. Separate copies kept in our shared import cache are not linked to your account and are deleted automatically about one year after they were made (see "Shared import cache" below).
• Recipe cover photos you choose: kept in our Firebase file storage until you replace or remove the photo, delete the recipe, or delete your account, as described in Section 3 ("Your own cover photos").
• Photos you import from your camera or photo library: kept only in the app's temporary storage on your phone, never uploaded to your account, not synced, and may be cleared by your phone. A screen recording of about 1 in 10 iPhone sessions can show one while it is on screen, kept by PostHog for 30 days (see "Session replays" below).
• The content sent for AI import, nutrition estimates, or Ask Nib (captions, transcripts, page content, photos, pasted text, and ingredient lists): not stored by us as such; processed transiently and retained for a limited time by Google (and, for Ask Nib, Anthropic) under their own policies, for safety/abuse purposes. Our link import providers may cache the public content they fetch under their own policies; ScrapeCreators may cache video transcripts for up to 30 days. The recipe our service reads from a public post or page may be kept in our shared import cache (next item).
• Shared import cache: recipes our service read from public posts and pages, their public creator credit, copies of their cover images and creator profile photos, and their cleaned links (see "Shared import cache" in Section 6). Not linked to any account. Kept for about one year (the photos a few days longer), and deleted sooner when someone reports a problem with an import of that link or a creator or site owner asks us to stop. Because entries are not linked to an account, deleting your account does not remove an entry made from one of your imports; the entry holds nothing that identifies you.
• Recipe share links: the public share record, its copied image, and the private record behind it are kept until you delete your account, or until we remove the link sooner (when you ask us to, when someone reports it, or when a creator asks us to take down pages that credit them). Deleting or renaming the recipe does not remove or change its share page; sharing it again updates the page. A removed page can stay visible for up to about 5 minutes while Cloudflare's cache clears, and messaging apps may keep the previews they already showed. The daily counts of links you made and opened are kept with your account and deleted with it. To remove a single link, email dailybiteapp12@gmail.com with the link.
• Technical/auth log data (e.g., IP): retained by Firebase for a short period (typically a few weeks).
• Server error logs: may include your account ID, but not your name or email address, and are kept for a limited period.
• Purchase records: retained by Apple and Google per their policies, and as we are required to keep for tax and accounting obligations. When you delete your account, we also ask RevenueCat to delete your subscriber record, and Superwall to delete the subscription events and paywall data it holds for your account (see "Paywall data" below).
• Paywall data (Superwall): Superwall, our paywall tool, receives your subscription events from RevenueCat (product, price, currency, country, dates, and transaction IDs, tied to your Daily Bite account ID, or to RevenueCat's random ID for you, for example if you bought before signing in), with the device and technical details on your RevenueCat subscriber record, which can include the identifiers listed in RevenueCat's row in Section 6, and, from iPhone and Android app version 1.0.6, the data the app sends it (see "Paywalls (Superwall)" in Section 3). Superwall keeps this data while we use Superwall. When you delete your account, we ask Superwall to delete the data it holds for your account, whether or not you ever subscribed. Superwall handles these requests by email, so this can take up to 30 days. Subscription events RevenueCat sent Superwall under a random ID rather than your account ID (for example, for a purchase made before you signed in), and, from iPhone and Android app version 1.0.6, paywall data Superwall's software sends before you sign in, may not be removed.
• Paywall history and free tries (iPhone and Android app version 1.0.6 and later; free tries on iPhone only, except the one free dish recreate, which is recorded on iPhone and Android): your paywall history (the Pro screens you have seen and closed, and whether you have had a free trial or a paid plan before) and the record of free tries you have used are kept with your account and deleted when you delete your account. The copy of your paywall history on your phone stays until you uninstall the app.
• Recreate it with AI records (app version 1.0.7 and later): the record of each request to recreate a dish from a photo, with the short photo fingerprint described in Section 6, and the note of when you were last offered to recreate a dish from a photo are kept with your account and deleted when you delete your account.
• Ask Nib chats (app version 1.0.8 and later): the last 20 messages of each chat, kept on your account until you tap Clear chat, 90 days after the chat's last message, or when you delete your account. The food preferences Nib keeps for a chat follow the same rules. A change Nib suggests that you do not save as a copy is deleted after 24 hours. A copy you save is a recipe like any other.
• Nib's working steps (app version 1.0.8 and later): the steps the app shows while Nib works on an answer (such as what it searched for), kept on your account for about a day, then deleted automatically, or when you delete your account. A recipe page Nib picked online that you did not save is not added to your library; its copied photos stay in your account's storage until you delete your account.
• Copies of Ask Nib conversations (app version 1.0.8 and later): what you typed and Nib's replies, with email addresses, @handles, phone numbers and links removed, the titles of the recipes Nib showed, and no name or account ID. Each copy is filed under a one-way coded tag made from your account ID, which cannot be turned back into it, so we can delete your copies when you delete your account. Deleted 90 days after the chat's last message, or when you delete your account.
• Nib question log: the questions people type to Nib, with email addresses, @handles, phone numbers, and links removed, and with no account ID, name, recipe, or answer. Deleted after 90 days.
• Reported Nib answers: the answer and the reason you picked, with no account ID. Deleted after 180 days.
• Nib ask counts: how many of your 3 asks you have used and how many asks you made each day (for daily limits), kept on your account until you delete it.
• Public profile, plates, reviews, comments, shared saves, likes, blocks, and Activity(iPhone app version 1.0.7 and later): kept until you delete them, or your account. Your birth year and age group are kept with your account and deleted with it. The private copy of a photo the automatic check held back, or of a post that was reported, is kept for our review until you delete that post or your account. When you change your username or delete your account, your old username stays reserved for 90 days.
• Reports (iPhone app version 1.0.7 and later): kept so we can act on them and on repeated reports. When you delete your account, your account ID is removed from the reports you made; what was reported, the reason, and any note stay.
• Daily Discover and food websites (iPhone app version 1.0.7 and later): the totals are worked out again about once an hour from current data, so a save you remove, or your whole account once deleted, drops out of the next count. A website's newest posts are replaced at each check, and recipes read from websites are kept for up to 7 days. The daily counts of your requests are kept with your account and deleted with it.
• Push tokens, background import status and link import records (iPhone and Android app version 1.0.6 and later; push tokens on iPhone only): a push token is removed when you sign out on that phone, when you delete your account, or when it stops working; a background import's status is kept until about a day after it finishes; the record of an import from a link is kept for about 3 days. All of them are deleted when you delete your account.
• Reports about an import (iPhone and Android app version 1.0.6 and later): kept with your account and deleted when you delete your account.
• Session replays (iPhone app version 1.0.6 and later): kept by PostHog for 30 days. We do not record sessions on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone. Replays linked to your account ID are not removed automatically when you delete your account; they expire after 30 days. Email dailybiteapp12@gmail.com and we will delete your replays sooner.
• On-device caches: cleared when you sign out (profile cache) or uninstall the app.
• App and website analytics events: kept by PostHog for one year on our current plan, and deletable by us at any time. Website events are not linked to your app account. App events linked to your account ID are not removed automatically when you delete your account. This includes feedback you send in the app; email dailybiteapp12@gmail.com and we will delete yours sooner, along with any session replays that show it. PostHog also keeps some facts on its record of your account ID until we delete them. These include whether you have Daily Bite Pro, which version of setup you were shown, your device type, app version, and screen size, and the rough location (country, region, city, approximate postal code, approximate map coordinates, and time zone) it estimated from your IP address the first and last time it saw you. Email dailybiteapp12@gmail.com to have them removed.
• Crash reports: kept by Sentry for up to 90 days so we can fix bugs. They may include your account ID, but not your name or email address.
• Ads measurement data: the identifiers the app gives RevenueCat while you are signed in sit on your RevenueCat subscriber record, which we ask RevenueCat to delete when you delete your account. RevenueCat also passes them to Superwall with your subscription events, and we ask Superwall to delete those too. If you allowed tracking, Meta also receives your subscription events with your Daily Bite account ID (or RevenueCat's random ID for you), sent as is (or in a coded, hashed form if we later move RevenueCat to Meta's Conversions API). Data Meta has already received is kept by Meta under its own policy. We cannot delete it for you, but you can manage it in your Facebook or Instagram settings. The Apple Ads attribution RevenueCat keeps for you is on the same subscriber record and is deleted with it.
• Website waitlist and Android tester sign-ups: your email address, the time you signed up, and the form you used are kept in our Cloudflare D1 database (for a tester sign-up, also when your invite email was sent). Your email address may be added to Flodesk so we can send launch news, recipes, and updates, and, if you joined the Android tester list, it is sent through Resend for your tester invite and added to our Google Play tester list. We keep sign-ups until you ask us to remove them, and you can unsubscribe from our emails at any time. Deleting your app account does not remove a website sign-up, because the two are not linked; email dailybiteapp12@gmail.com to have it removed.

Deleting your account. You can delete your account and its associated personal data directly in the app: open Settings from your profile, then tap Delete account at the bottom and confirm. This permanently deletes your Daily Bite account, your profile and onboarding answers, your saved recipes and cookbooks, your meal plan and grocery list, your cooking activity, the setup log entries tied to your account, the cover images copied from links you imported, including converted copies made for the team's admin page, and recipe cover photos you chose, the recipe share links you made (their public pages and the images copied for them), your paywall history and free tries (iPhone and Android app version 1.0.6 and later; free tries on iPhone only, except the one free dish recreate, which is recorded on iPhone and Android), and your Recreate it with AI request records (with their short photo fingerprints) and the note of your last offer to recreate a dish from a photo; your Ask Nib chats and the copies of them we keep to improve Nib, Nib's working steps, the photos copied for recipe pages Nib picked online, and Nib ask counts (app version 1.0.8 and later); and, from iPhone app version 1.0.7, your public profile, birth year and age group, profile photo, plates and their photos (private and public copies), shared saves and their photo copies, reviews, the comments you wrote anywhere, your likes, blocks in both directions, and your Activity. We also ask RevenueCat to delete your subscriber record and Superwall, our paywall tool, to delete the subscription events and paywall data it holds for your account, whether or not you ever subscribed (Superwall handles these requests by email, so this part can take up to 30 days), and if you signed in with Apple, we ask Apple to revoke Daily Bite's access to your Apple ID. Deletion does not remove: link previews that messaging apps already made from your share links; from iPhone app version 1.0.7, a record that your username was released, with your account ID, which keeps the name reserved for 90 days, the reports you made (without your account ID) and the coded records that stop duplicate reports (which do not store your account ID), and copies of your public photos other people's apps already loaded; entries in our shared import cache made from links you imported (they hold only what a public post or page shows, are not linked to your account, and are deleted after about one year, their photos a few days later); PostHog analytics events (tied to a random account ID and kept for up to one year); the facts PostHog keeps on its record of your account ID until we delete them; session replays from iPhone app version 1.0.6 (screen recordings of about 1 in 10 iPhone sessions, none on an iPhone set to a UK, EU, EEA or Swiss region, or to a European time zone, that can show your first name, your recipes, what you typed, your own photos once they were in the app, pages you opened in the in-app browser, and the screens you used, but not your password or your email address on the app's own screens, kept for 30 days, or deleted sooner if you email dailybiteapp12@gmail.com); subscription events RevenueCat sent Superwall under a random ID rather than your account ID (for example, for a purchase made before you signed in), and, from iPhone and Android app version 1.0.6, paywall data Superwall's software sent before you signed in (these may not be removed); RevenueCat records under a random ID that were never linked to your account (for example, from a phone where you used the app before logging in to an existing account), which can hold the device identifiers and purchases described in Section 3; Sentry crash reports (which may include your account ID, kept for up to 90 days); ads measurement data Meta has already received; short-lived server error logs and Firebase sign-in logs; setup log entries never linked to an account; the copy of your paywall history on your phone (iPhone and Android app version 1.0.6 and later), until you uninstall the app; the Daily Bite team's working copy until its next rebuild, which contains names, email addresses, and saved recipes; purchase records kept by Apple and Google and those we must keep for tax and accounting; and website waitlist and Android tester sign-ups, which are not linked to your app account. Those PostHog facts include whether you have Daily Bite Pro, which version of setup you were shown, your device type, app version, and screen size, and the rough location (country, region, city, approximate postal code, approximate map coordinates, and time zone) PostHog estimated from your IP address the first and last time it saw you. The Nib question log and reported Nib answers hold no account ID, so they cannot be linked back to you and are deleted on their own after 90 and 180 days. Deletion is processed immediately; residual copies in routine backups are purged on our normal backup cycle. This option is available to all users regardless of location, with no phone call or support request required. If you have trouble, email dailybiteapp12@gmail.com.

10. Your Rights and Choices

Depending on where you live, you have some or all of these rights:

GDPR/UK GDPR (EU/UK): access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent.

CCPA/CPRA (California): the right to know/access, delete, and correct your personal information; to opt out of the sale or sharing of your personal information (we do not sell it for money); to limit the use of sensitive personal information; and to non-discrimination for exercising your rights. To opt out of the sharing with Meta described in Section 7, tap Ask App Not to Track when your iPhone asks, or turn tracking off for Daily Bite in iPhone Settings > Privacy & Security > Tracking. This stops your advertising identifier, your account ID, and RevenueCat's subscription events from reaching Meta. Meta's software still sends the install, app-open, and in-app purchase records described in Section 3, with its anonymous ID for this install and no advertising identifier. You can also email us with any of these requests.

PIPEDA (Canada): the right to meaningful consent, to withdraw your consent at any time, including for ads measurement, to access and correct your information, and to direct a complaint to us as the responsible business.

To exercise any right, use the in-app Delete account option or email dailybiteapp12@gmail.com. We will respond within the timeframe required by your local law. You also have the right to complain to your local data-protection authority (in Canada, the Office of the Privacy Commissioner of Canada).

11. Security

We protect your information with industry-standard safeguards. Data is encrypted in transit and at rest on Google's infrastructure. Our database security rules make sure that, inside the app, only you can read or write your personal records. Beyond that, access is limited to our server-side functions and to the Daily Bite team through our administrator access, used only for the purposes described in Section 4. Your password is handled only by Firebase Authentication and is never stored by us.

12. Children's Privacy

Daily Bite is intended for users 13 and older (16 in parts of the EU) and is not directed to children. We do not knowingly collect personal information from children under that age. From iPhone app version 1.0.7, setting up a public profile asks for your birth year: if it shows you are under 13, you cannot have a public profile, and on a profile for ages 13 to 17, plates start as private and comments on your posts start turned off. Your birth year and age group are never shown to anyone. If we learn we have collected such information, we will delete it. A parent or guardian who believes their child has provided us information can contact dailybiteapp12@gmail.com to request deletion.

13. Changes to This Policy

We may update this policy as the app evolves or the law changes. We will post the updated version with a new effective date, and for significant changes we will provide notice in the app. Your continued use after an update means you accept the revised policy.

14. Contact Us

Questions, requests, or complaints about your privacy:

Successfitness
Saskatchewan, Canada
dailybiteapp12@gmail.com