Template — have a qualified lawyer review before launch.

Privacy Policy

This policy explains what we collect, why, and the rights you have under the GDPR and CCPA/CPRA.

What we collect

• Account data: name, email, password hash, profile photo.
• Age confirmation and Terms acceptance timestamps (we do not store your date of birth).
• Activity: subscriptions, purchases, messages and content you post.
• Payment data is collected and stored by Stripe — we never see or store full card numbers.
• Technical data: IP address for security and rate limiting.

Why we use it (legal bases)

• To provide the service and process payments (contract).
• To prevent fraud and abuse (legitimate interests).
• To send marketing emails, only if you opt in (consent — withdraw anytime).

Your rights

You can access, correct, export or delete your data, and object to or restrict processing. California residents may request to know and delete personal information; we do not sell or share personal information for cross-context behavioral advertising. Contact privacy@onlyfoods.com.

Processors

Stripe (payments), Vercel (hosting), Supabase (database), Cloudinary (media), Upstash (rate limiting), Resend (email).

Retention

We keep account data while your account is active. Deleted accounts are scrubbed of personal data, except records we must keep for tax and anti-fraud obligations.