Privacy Policy

1. About this policy

This Privacy Policy explains how Korin collects, uses, stores, and deletes personal data. It applies to the Korin iOS app, website, waitlist, and related services. For privacy questions or requests, contact feedback@eatwithkorin.com.

2. Data we collect

• Account and profile: email address, user ID, sign-in provider identity, display name, optional profile image, submitted profile changes and review decisions, and notification preferences. If you choose Google or Apple sign-in, that provider authenticates you and provides an identity token to Supabase; Apple may give you a private relay email address.
• Your activity: saved restaurants and foods, ratings, reviews and review images, historical restaurant combinations, likes, reports, blocked users, and in-app notifications. Historical beta check-ins and retired restaurant combinations remain private until account deletion.
• Nutrition and dietary records: age, sex, height, weight, activity level, nutrition goals and plan versions you enter; meals, foods, quantities, consumption percentages, meal times and timer records; and calculated energy, nutrients, and dietary summaries. These records may reveal health and fitness information.
• Food and AI features: meal photos, product and label photos, food names, cooking descriptions, ingredients and nutrition facts you submit; generated estimates and assessments, analysis history, correction feedback and revised results; personal foods and any contribution you choose to send for catalogue review.
• Membership: Apple subscription product and transaction identifiers, signed transaction records, subscription periods and status, an account token used to associate purchases with your Korin account, membership gifts and claims, and feature usage reservations and counters. Apple handles payment details; Korin does not receive your card or bank details.
• Optional usage analytics: with your consent, account-linked page visits and feature actions, meal creation events and meal types, and operation outcomes used to improve Korin. Necessary membership metering, business records, security and troubleshooting are handled separately.
• Search and device data: searches sent to the Korin API and, if you enable push notifications, an app-specific APNs device token linked to your account.
• Feedback: restaurant suggestions, feature requests, bug reports, and information you include in them.
• Waitlist: the email address you submit before launch.
• Technical data: short-lived request metadata, approximate network information, errors, and security events recorded by our hosting provider.

If you allow location access and use nearby restaurant features, your current coordinates may be sent to the Korin API to find and sort restaurants by distance. Map requests also include the visible map area. The current app does not submit restaurant check-ins or use location for check-in verification.

3. How we use data

We use this data to authenticate you, provide and personalise app features, calculate nutrition goals and dietary records, recognise meals and foods and generate food assessments you request, provide dietary summaries and exports, verify membership and administer gifts and feature limits, understand feature usage, review public content and profile changes before publication, calculate rating summaries, send required review decisions and optional like notifications, operate the waitlist, respond to feedback and reports, enforce user blocks, prevent abuse, diagnose failures, maintain security, and meet legal obligations. Nutrition goals and estimates are informational and are not medical advice.

4. Public content

Your approved display name and profile image, ratings, approved review text and images may be visible to other Korin users. A rating appears immediately; new review text and images appear only after approval. When you edit approved review content, the previous approved version remains visible until the replacement is approved. Pure rating reviews have no like option. Pending or rejected profile images and review content are visible only to you and authorised moderators. Your email address, favorites, historical check-ins, nutrition plans and dietary records, meal photos and correction feedback, private foods and food analyses, membership and feature usage records, device token, notifications, reports, and blocked-user list are not published. You can separately choose to contribute eligible food information and evidence for public catalogue review. You can report public content or block a user in the app. Do not include sensitive personal information in public content.

5. Service providers and external links

We use Cloudflare for application hosting, database, file storage, and operational logs; Supabase for authentication; Google and Apple when you choose their sign-in options; and Apple for iOS distribution, TestFlight, subscriptions, and push notifications. These services process data under their applicable terms. If you open an external map, restaurant, Lazada, or Shopee link, that third party receives the request and its own privacy policy applies.

When you request an AI feature, Korin sends the relevant submitted photos, food names, cooking descriptions, ingredient and nutrition information, selected language, and, for a correction, the original photo, analysis results, current edited record and your feedback to the provider configured for that feature: directly to OpenAI, Google Gemini (Gemini API) or DeepSeek (DeepSeek API), or through OpenRouter to Google Gemini (Google AI Studio or Google Vertex). This supports recognition, analysis and food text translation. Only information needed for the requested feature is sent; your account profile and full dietary history are not included in these model requests. If the primary model cannot complete the task, a configured backup model may receive the same necessary inputs through one of these disclosed routes. The app asks for explicit permission before this sharing. Your choice is saved for your account and loaded when you sign in; you can withdraw it in Settings, and a changed disclosure requires permission again. Declining leaves manual recording, saved foods and existing records available. Withdrawing permission stops future requests; it does not undo earlier sharing. Provider processing, retention and use of API data depend on the applicable service terms, account settings and service tier. See OpenAI API data controls and Gemini API terms for the relevant API services; Google distinguishes paid and unpaid services in those terms. DeepSeek API processing is subject to its applicable service terms and account arrangements; its published privacy policy does not itself define processing rules for end users of developer-built applications. DeepSeek may process and store the information sent to it in China. Korin does not promise zero retention or exclusion from training across all providers. Account deletion in Korin does not itself delete provider-held copies.

After sign-in and before profile setup, Korin presents basic service, AI sharing and optional usage analytics choices. Individual choices start unchecked. You can explicitly accept all three, or choose individually; only basic service is required to continue. Choices are saved only after confirmation. You can change AI sharing and usage analytics in Settings under Privacy and consent. Declining analytics does not prevent activation or paid features, and does not stop necessary membership metering, security or troubleshooting.

6. Retention and deletion

Account data is kept while your account is active. You can permanently delete your account from Settings in the iOS app; this removes the active Supabase account, profile, preferences, device tokens, notifications, likes, favorites, check-ins, feedback, reviews, restaurant combinations, food-label analysis histories and contributions, waitlist entry with the same email, nutrition plans and versions, dietary records, meal photos and revisions, personal foods, account-linked AI request records and encrypted result receipts, feature usage and membership records, and associated user-uploaded images. Limited membership reward audit entries remain in operational audit records after deletion. Account deletion does not cancel an Apple subscription; manage or cancel it in your Apple subscription settings. Feature usage events have a 90-day retention window and are removed by routine cleanup, or with account deletion. You can also remove individual food-label analysis histories and withdraw eligible pending contributions in the app. Cloudflare D1 Time Travel may retain recoverable database history for up to 7 days on a Free plan or 30 days on a Paid plan. Worker operational logs are retained for up to 3 days on a Free plan or 7 days on a Paid plan. Waitlist data is kept until launch communications are complete or you ask us to remove it.

7. Security and international processing

We use HTTPS, access controls, encrypted secret storage, and restricted administrator accounts. No online service is completely risk-free. Our providers may process data in countries other than yours, subject to their safeguards and applicable law.

8. Your choices and rights

You can edit your profile, export your dietary records from Settings, remove your own editable content where the app permits, withdraw AI sharing permission in Korin Settings, withdraw optional location or photo access in iOS Settings, manage Apple subscriptions with Apple, and delete your account in the app. You may contact us to ask for access, correction, deletion, or information about how your data is handled, subject to applicable law.

9. Children and changes

Korin is not intended for anyone who cannot consent to this data processing under the law that applies to them. We may update this policy as the service changes and will revise the date above; material changes will be communicated where required.