2.1 Information You Provide

• Account Information: Email address, password (encrypted), display name
• Payment Information: Processed and stored securely by Stripe (we do not store credit card numbers)
• Content Data: Recipes, ingredients, costs, and other business data you create in the Service
• Communications: When you contact us for support or feedback

2.2 Automatically Collected Information

• Usage Data: Features used, pages visited, time spent, actions taken (collected via Google Analytics)
• Device Information: Browser type, operating system, device identifiers, IP address
• Cookies and Tracking: Session cookies, authentication tokens, analytics cookies, advertising cookies (Meta Pixel) (see Section 8)

2.3 Information from Third Parties

• Google Sign-In: If you authenticate with Google, we receive your email and profile information
• Payment Processor: Stripe provides transaction and subscription status information
• Advertising (Free Tier Only): Google AdSense may collect information about your browsing for targeted advertising
• Marketing Analytics: Meta (Facebook) Pixel may collect information about your activity for conversion tracking and advertising optimization (with your consent)

Service Providers We Use:

• Google: Authentication, database, file storage, and hosting
• Stripe: Payment processing and subscription management
• SendGrid: Transactional email delivery
• Google Analytics: Usage analytics and service improvement
• Google AdSense (Free Tier Only): Advertising to free users (may involve data sharing with advertisers)
• Meta (Facebook): Conversion tracking and advertising optimization via Meta Pixel (with your consent)

Other Sharing Scenarios:

• Legal Requirements: To comply with laws, regulations, legal processes, or government requests
• Protection of Rights: To protect our rights, privacy, safety, or property, and that of our users
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share information

All Users:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your account and personal information
• Data Portability: Request your data in a machine-readable format
• Withdraw Consent: Withdraw consent for processing where we rely on consent

Additional Rights (California, Virginia, Colorado, Connecticut, Utah, and other applicable US states):

• Know: Know what personal information we collect and how we use it
• Opt-Out of Sale/Sharing: Opt-out of the "sale" or "sharing" of personal information (see Section 6)
• Limit Sensitive Data Use: Limit use and disclosure of sensitive personal information
• Non-Discrimination: We will not discriminate against you for exercising your rights

Additional Rights (EU/UK GDPR):

• Object: Object to processing of your personal information
• Restrict Processing: Request restriction of processing in certain circumstances
• Lodge Complaint: File a complaint with your local data protection authority

Additional Rights (Canada PIPEDA):

• Challenge Compliance: Challenge our compliance with PIPEDA
• Access Safeguards: Be informed of safeguards we've implemented

8.1 Essential Cookies (Always Active)

These cookies are necessary for the website to function and cannot be disabled:

• Authentication: Firebase authentication tokens to keep you signed in
• Session Management: Session identifiers for security and functionality
• Security: CSRF protection and secure communications

8.2 Analytics Cookies (Optional)

With your consent, we use analytics cookies to understand how you use our service:

• Google Analytics: Tracks page views, feature usage, and user journey to help us improve the service

8.3 Marketing Cookies (Optional)

With your consent, we use marketing cookies for advertising purposes:

• Google AdSense (Free Tier Only): Displays contextual and personalized ads to free tier users
• Meta Pixel (Facebook Pixel): Tracks conversions from Facebook/Instagram ads, builds custom audiences for retargeting, and measures ad campaign performance. Meta Pixel sets cookies including _fbp (Facebook browser ID) and _fbc (Facebook click ID) to track your activity across websites.

You can manage your marketing cookie preferences at any time through our Cookie Settings.

9.1 Device Push Tokens

When you enable push notifications, we store your Expo Push Token in Firestore to deliver low-stock alerts and app updates. You can disable notifications at any time in the app's Settings or your device settings. Disabling notifications removes your push token from our systems.

9.2 Camera and Photo Library

The app may request access to your camera or photo library to let you attach photos to ingredients and packaging items. Photos are uploaded to Firebase Storage and associated with your account. Camera and photo library access is optional — the app functions fully without it.

9.3 Push Notification Preferences

You can opt in or out of push notifications in Settings. Your preference is stored in your user profile and respected immediately.

9.4 Third-Party Services (Mobile-Specific)

In addition to the services listed elsewhere in this policy, the mobile app uses:

• Firebase Analytics: Usage analytics to improve the app experience. You can opt out in Settings > Privacy & Data.
• Expo Push Service: Routes push notifications to Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM). Only your push token and notification content are transmitted.
• Google AdMob: Displays advertisements to free-tier users. AdMob may collect device identifiers for ad personalization. Pro subscribers do not see ads and no ad-related data is collected.
• Sentry: Crash reporting to help us fix bugs. Crash logs may include device model, OS version, and stack traces. No personally identifiable information is intentionally collected.

9.5 Data Export and Deletion

You can request a full export of your data or delete your account in Settings. Account deletion removes all associated data from our systems, including push tokens, uploaded photos, and stored preferences.