Privacy Policy

1. Data controller

CHENG MING TRADING LIMITED, RM 502C, 5/F, Ho King Commercial Centre, 2-16 Fa Yuen Street, Mongkok, Kowloon, Hong Kong. Privacy contact: [email protected].

2. What we collect

• Account data: email address, an optional display name, and a hashed password. If you sign in with Google we receive your email address and name, not your Google password.
• Ingredient photos you upload, and the ingredient list derived from them.
• Service data: recipes generated, history, favourites, fridge items and shopping list.
• Usage data: daily quota counters, page events, approximate device type and language.
• Billing data: plan, subscription status and Stripe customer identifier. Card numbers go to Stripe, never to us.

3. Why we use it

• To run the scan and generate the recipes you asked for.
• To keep your history, favourites and fridge list on your account.
• To enforce free and paid usage limits and to prevent abuse.
• To take payment, issue receipts and handle refunds.
• To understand which features are used, in aggregate.

4. Photos

Ingredient photos are processed to produce the ingredient list for that scan. They are not used to train models and are not sold or shared for advertising. Please do not upload photos of people, documents or anything you would not want processed by a third-party AI provider.

5. Who we share data with

• An AI model provider, which receives the photo or ingredient list needed to answer the request.
• Stripe, for payment processing and subscription management.
• Resend, to send verification and password-reset emails.
• Google Analytics, for aggregate usage statistics.
• Hosting and database providers that store the data on our behalf.

6. International transfers

Our providers may process data outside your country, including in the United States and the European Economic Area. Transfers use standard contractual clauses or an equivalent safeguard.

7. How long we keep it

Account, history and favourites are kept while your account is open and deleted within 30 days of a deletion request. Billing records are kept as long as tax and accounting law requires. Aggregate analytics may be kept indefinitely in a form that does not identify you.

8. Cookies

We use cookies that are needed to keep you signed in and to count free usage, and Google Analytics cookies for aggregate statistics. You can block cookies in your browser; sign-in will stop working if you block the essential ones.

9. Your rights

Depending on where you live you may ask us to access, correct, export or delete your data, or to object to a particular use. Email [email protected] from your registered address and we respond within 30 days.

10. Security

Traffic runs over HTTPS, passwords are stored hashed, and access to production data is limited to the people who need it. No online service can promise perfect security, so please use a unique password.

11. Children

The service is not aimed at children under 13. If we learn that we hold data about a child under 13, we delete it.

12. Changes

If this policy changes materially, we post the new version here and update the date at the top before the change takes effect.