Privacy Policy
What we collect
- Account: email address, name, username, a password hash (argon2id; we never see your password), and your Apple or Google account ID if you sign in with them.
- Content: photos, captions, ratings, tags, comments, reactions, follows and blocks.
- Location (optional): only when you turn on "Tag my location" or use "Near me". It is used to tag the restaurant you are dining at and display dishes on the culinary map. We don't track your location in the background.
- Purchases: what you bought and transaction IDs from Apple, Google or Stripe. We never receive your full card details.
- Technical: IP address and request logs for security and rate limiting, kept for up to 30 days.
How we use it
To run the Service, show your posts to the audience you choose, prevent abuse, process purchases, answer support requests and, when you ask Cravely AI a question, to generate an answer.
Who we share it with
Service providers acting for us: hosting (Render), database (Neon), image storage and CDN (Cloudinary), email (Resend), payments (Stripe, RevenueCat, Apple, Google), place search (OpenStreetMap services) and AI (Anthropic, for Cravely AI requests only). We don't sell personal data.
Optional rewarded ads
If you choose to watch an ad for a reward, the ad is shown by Google AdMob. Google may collect your device's advertising ID, IP address and ad interactions to show and measure the ad, and, if you agree in the consent prompt, to personalise ads. We pass Google your Cravely user ID and the reward you picked only so that Google can confirm to us that you finished the ad. You can refuse personalised ads in the consent prompt, reset or delete your advertising ID in your phone's settings, or simply never tap “Watch an ad”. See how Google uses information from apps that use its services.
Your choices and rights
Edit your profile, change post visibility, make your account private, block users and delete posts at any time. Delete your account in Settings > Account > Delete account: your profile, posts, photos, comments, reactions and sign-in credentials are deleted, and Sign in with Apple tokens are revoked. Purchase records are kept only where tax law requires. Depending on where you live you may have rights to access, correct, export or object to processing; email us to use them.
Retention
Deleted posts stay in Recently deleted for 7 days, then are removed permanently. Unverified sign-ups are removed after 24 hours.
Children
Cravely is not directed at children under 13 and we don't knowingly collect their data.
Security
Traffic is encrypted with HTTPS, your session is stored in the device keychain, and access to production data is restricted.
Contact
Questions: cravely.support@gmail.com