Privacy policy

What we collect

Your name and profile photo from the Google, Apple or Facebook account you sign in with, the meals you add — a name, a day, a time of day, and a photo or video if you add one, including any sound in the video — and the comments you write on meals. If you manage a brand account, the product names and links you upload, used to generate meal ideas for your catalogue. If you turn on notifications, a device token so we can send them. No location, no contacts, no tracking of you across other apps or sites.

Crashes

When YUM crashes, we receive a crash report through Firebase Crashlytics — what went wrong, and what device and app version it happened on — so we can fix it. Those reports are tied to your account id so we can tell one person’s crash from another’s, and to nothing else. The app does not use an analytics SDK: we do not record which screens you open, which features you use, or where you are.

Visiting yum.monster

The website — including brand pages like yum.monster/brands — can use Google Analytics to count visits: which pages were opened, roughly where from (country and city, worked out from the connection), the device and browser, and the site that sent you. It runs only if you tap Accept on the bar the site shows you; until then nothing is sent to Google and no cookie is set. If you accept, Google sets its own cookies (_ga) to tell a returning visitor from a new one. It is not tied to your YUM account, and the app itself never uses it. To change your mind, open yum.monster/#cookies and choose again — declining removes the cookies.

Who can see it

Your name, photo and meals are visible to your friends, and to any brand or Monster account you follow. Monsters are our two AI accounts that post automatic meal ideas — one vegan, one not — and you can unfollow either one at any time if you only want to see vegan meals, for example. Four exceptions: anyone holding your friend code can see your name and photo when they open your link, so they know who invited them; anyone you send a meal link to can open that one meal; when a friend likes one of your meals, the friends who follow their likes can be shown that meal and your name; and when a friend comments on one of your meals, their friends can see that meal, your name and the comments under it, and can comment too. The last two are how people find each other here, and you can switch both off with one setting under Privacy on the You tab. Comments you write are visible to everyone who can see the meal you wrote them on, which may include friends of the person who cooked it. Comments on a Monster’s meal are visible to everyone signed in to YUM, including people you are not friends with. One technical caveat, because it is the honest way to describe how photos work: a photo you upload is stored at its own unguessable web address, and anyone who has that exact address can open it. That is what lets an avatar show next to a friend request and a shared meal open for the person you sent it to. Nothing is listed publicly, indexed by search engines, or shared further.

Family

If you’re in a family group, you can share any meal you see — from a friend, a Monster, or a brand — with your family. If everyone votes yes, that meal is posted on each family member’s own account. We keep a record of who shared it and how each person voted, so the group can see how a meal got there.

How suggested meals are made

Some meals in the feed are generated automatically by our Monster accounts or from a brand’s product catalogue, and are always labelled as such. Making them may involve sending product names — never your personal data — to a third-party AI service to find likely combinations.

Tapping a brand’s product link

Brands can list what they sell, and a meal can link to a product. When you tap one of those links we record the tap — which product and brand, which screen you tapped it from, which meal it was attached to, the time, the country the request came from, and whether you are on a phone or a desktop — before sending you on to the brand’s own site. We do not attach your account to it, so it tells the brand how many people tapped, not who did. Once you arrive on the brand’s site you are on their website, under their privacy policy, not ours.

Saying you’re interested in a job

Shops and restaurants on YUM can list jobs. If you tap I’m interested on one, the people who run that shop’s account see your name and photo, the note you wrote if you wrote one, and the phone number or email address you chose to give — nothing else from your account. They use it to get back to you about that job. You can take it back from the job’s page at any time, which deletes it, and we delete every application ourselves 180 days after it was made, or as soon as the shop deletes the job.

What we do not do

We do not sell your data, we do not show ads, and we do not use your data to train anything.

Where it lives

Your data is stored using Google Firebase — Firestore for meals and accounts, Firebase Authentication for signing in, Cloud Storage for photos and videos, Cloud Messaging for notifications, and Crashlytics for crash reports — on Google Cloud infrastructure. Website visits you accepted analytics for are counted by Google Analytics.

Reports you file

If you report a meal or a person, we keep a record of the report — who filed it, who it was about, and what was posted at the time — so we can act on it. Those records outlive account deletion, because a record of why an account was removed has to.

Messages you send us

If you write to us — the support form in the app, the one at yum.monster/support, or plain email — we keep what you sent and the email address you gave, because that is what answering you means. We use it for nothing else, and we delete it once the thing you asked about is settled.

Deleting it

Delete your account from the You tab and we remove your profile, all of your meals, every comment you wrote and every comment on your meals, every job you said you were interested in, and you from everyone’s friend list. If you cannot sign in, ask us at yum.monster/support and we will do it for you — you do not need to be able to open the app.

Your rights

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it — write to hello@yum.monster and we will handle it. If you think we have mishandled your data, you also have the right to complain to Romania’s data protection authority, ANSPDCP (dataprotection.ro).

Age

YUM is meant for people 16 and older. We don’t knowingly collect data from anyone younger, and if we learn we have, we delete it.

Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top always reflects the current version.

Contact

Questions or requests: yum.monster/support, or hello@yum.monster. A person reads both, within 24 hours.