SafeYum Privacy Policy

SafeYum ("SafeYum," "we," "our," or "us") provides tools that help families track food exposures, food trials, and dietary reactions. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website and services (the "Service").

This policy describes the website and SafeYum apps. The V2 permission and deletion controls described below apply to the release with "Share with OpenAI" in Settings; earlier versions may have different controls. That release asks for your separate agreement before sharing information with OpenAI, and the app cannot be used without it. Reading this policy or accepting the Terms does not give that agreement.

1. Who We Are

SafeYum is a United States based company providing a consumer health tracking app for families. You can contact us at: support@safeyum.com.

2. Who Can Use SafeYum

• You must be 18 or older to create an account.
• Parents and legal guardians may create profiles for their children to track food exposures and trials.
• Children cannot create their own accounts and do not interact directly with SafeYum.
• The app is currently unavailable for download from the App Store in the United Kingdom, European Union, Iceland, Norway, and Switzerland, among other regions. Check your local App Store for availability.

3. Information We Collect

A. Information You Provide

This includes:

• Account information: In V2, your mobile phone number and any display name you provide. V2 signs you in with a one-time code sent by text message. Earlier SafeYum accounts use an email address and password.
• Importing from a previous version: If you used an earlier version of SafeYum, you can optionally bring your old data across. To confirm that the old account is yours, we ask for the email address you used for it and send a six-digit code to that address. This step is optional and can be skipped. Importing copies your records; it does not delete the earlier account. Contact support if you want help deleting records held in the earlier service.
• Family member details: Names, ages, relationships, and other information you enter for each family member.
• Child / trial user information: For children, you may enter age or birthdate, foods being tested, trial logs (passed, failed, symptoms, notes), and any reaction details that you choose to record.
• Journal entries and free text: You can describe meals, foods, symptoms, and reactions in your own words. With your agreement, SafeYum uses OpenAI to help organize that text, count foods toward trials, and answer questions about your journal. You review proposed entries before saving. See "AI Processing and Your Choice" below.
• Support and website requests: Your email address and the information you choose to send when contacting us or using a website form.

Because food reactions and dietary responses relate to health, what you enter, including your journal text, is health information about you or your children. United States privacy laws treat it as sensitive, and so do we. It is the most private thing in SafeYum and we handle it accordingly.

AI Processing and Your Choice

SafeYum runs on AI. Before V2 shares information with OpenAI, it explains what will be shared and asks you to choose "Agree and continue" or "Sign out." The app cannot be used without this agreement. Once you agree, requests may include the text you enter, family member names and health notes, and relevant meals, symptoms, food lists, trials, and journal history. This includes information about children when you record it. If you use a voice feature, audio is also sent to OpenAI. The context depends on the feature, such as family setup, organizing an entry, counting foods toward a trial, or answering a journal question. Information you type or speak is not guaranteed to be anonymous.

If you do not want to share information with OpenAI, you can sign out instead, and you can delete your account in Settings at any time. Your journal is stored with Supabase. If OpenAI is temporarily unavailable, SafeYum may fall back to basic keyword parsing on our Supabase backend so you can keep logging.

You can withdraw your agreement in Settings under Privacy by turning off Share with OpenAI. This stops new OpenAI requests from your account after the change is saved and returns you to the agreement screen, where you can agree again or sign out. It does not recall information already sent or undo a request already in progress. The agreement applies to your account; other adults in a shared household give their own agreement and may use shared household records with AI features.

OpenAI processes requests under its applicable API terms and data controls. We do not promise that a request is never retained or is immediately deleted by a provider. For the provider's current practices, see OpenAI's API data controls. You can contact support@safeyum.com about information already shared or a deletion request.

B. Automatically Collected Information

SafeYum does not use third-party advertising networks or behavioral tracking cookies. We collect essential technical information necessary to operate and secure the Service, such as:

• IP address and basic device information.
• Basic browser or app version details.
• Limited log data used for security, debugging, and reliability.

C. Usage Analytics

We use our own first-party analytics to understand how the app is used and to improve it, for example which features are opened and how often. These analytics are privacy-conscious by design: they record product usage events and are stored in our backend hosted by Supabase. An event records what happened (for example "an entry was saved"), your account id, your app version and platform, and short counts or yes/no values. They do not include the contents of your journal entries, food lists, trials, symptoms, or other health information, and we do not sell this data or share it with advertisers.

You can turn product analytics off. There is a switch in Settings. Turning it off stops these events immediately and discards any that have not been sent yet. The app works exactly the same either way.

Our website uses Vercel Web Analytics for traffic statistics such as page views, referring pages, approximate location, and browser/device type. This website service is separate from the app's usage-analytics switch. See Vercel's analytics privacy information.

D. Error Reports

When something goes wrong in the app, we record a diagnostic report so we can fix it. A report contains the error message and its technical stack trace, the screen or action it happened in, your app version and platform, and your account id. Because a stack trace can occasionally include fragments of what the app was working on at the time, we treat these reports as confidential, keep them in our own infrastructure, and use them only to diagnose faults. Error reports are separate from product analytics and are not covered by the analytics switch, because without them we cannot keep the app working.

4. How We Use Your Information

A. Providing and Maintaining the Service

• Managing and authenticating accounts.
• Storing and organizing food trials and trial days.
• Managing family member and child profiles.
• Saving notes and observations about food exposures.
• With your agreement, using OpenAI to help organize text, count foods toward trials, and answer questions about your journal, as described in Section 3.
• Creating PDFs on your device, such as a caregiver food sheet or a summary for your allergist. You choose where to send them; we do not receive a copy.
• Enabling household sharing so that adults you invite can view and contribute to the data you share with them.
• Managing your subscription and free trial.
• Sending necessary account-related messages, such as the one-time code that signs you in and, if you use the import flow, the code that confirms your old email address.

B. Security and Abuse Prevention

• Maintaining system security and integrity.
• Preventing fraud, misuse, and unauthorized access.
• Detecting and addressing technical issues.

C. Legal Compliance

• Responding to lawful requests and legal processes.
• Complying with applicable laws and regulations.

We do not sell personal information, do not share personal information with third parties for their own marketing, and do not use behavioral tracking or advertising cookies.

5. Children's Privacy

SafeYum does not knowingly permit children to create accounts or use the Service directly. The Service is intended for use by parents and legal guardians.

Parents and legal guardians may enter information about their children solely for personal tracking of food exposures and dietary reactions. When you create a child profile or "trial user" profile, you represent that:

• You are the child's parent or legal guardian, and
• You consent to SafeYum processing information about your child for the purposes of providing the Service as described in this Privacy Policy.

Parents may access, edit, download, or delete their children's information at any time using in-app features (where available) or by contacting us at support@safeyum.com.

6. How We Share Information

We share personal information only in the following circumstances:

A. Service Providers

We use trusted third-party service providers to help us operate the Service, such as providers for:

• App authentication, database storage, and backend hosting (Supabase).
• Website hosting and website traffic analytics (Vercel).
• AI processing (OpenAI), with the agreement and information described in Section 3.
• Subscription management (RevenueCat) and App Store purchases and billing (Apple). RevenueCat receives account identifiers and purchase/subscription information to determine access. SafeYum does not receive or store your full payment card details; these are handled by Apple.
• Text message delivery (Twilio), used to send sign-in codes, and email delivery providers for account verification, website requests, and support.

These providers are allowed to access personal information only as necessary to provide services to SafeYum and are obligated to protect it and use it solely for that purpose.

B. Household Sharing

SafeYum lets you build a shared household so that more than one adult (for example, two parents or a parent and a caregiver) can keep track of the same family members. When you invite another adult to your household, or accept an invitation to join one, the people in that household can view and contribute to the family member profiles, food lists, trials, journal entries, and related information that is shared within it. Only invite people you trust with this information. You can manage or remove household members in the app, and removing someone stops their future access to shared data.

C. Legal and Safety Reasons

We may disclose information if we believe it is reasonably necessary to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of SafeYum, our users, or the public.

7. Where Your Information Is Processed

SafeYum is based in the United States, and your information is processed there and in other countries where our service providers operate infrastructure on our behalf. App Store availability does not limit requests concerning information we already hold. Contact us to exercise your privacy rights under applicable law.

8. Data Retention

We retain personal information only for as long as necessary to provide the Service and for legitimate and lawful purposes, such as record keeping or legal obligations.

In general:

• Journal entries, family profiles, food lists, and trials are retained while the household uses the Service, unless deleted. The account-deletion rules below distinguish a household you use alone from one shared with other adults.
• To prevent duplicate saves and imports, we retain technical records containing account, household, and journal record identifiers, counts, timestamps, import and access status, and a fingerprint of each save request. These records do not keep a second copy of journal text or family member names. They remain after an individual journal entry is deleted and are removed with the related account or household.
• A nightly cleanup deletes app product analytics and error reports older than 90 days. These account-linked records are also removed when your V2 account is deleted. Turning off app product analytics stops new product-usage events; it does not disable error reporting or the website's separate analytics.
• A nightly cleanup deletes AI usage records older than 400 days. These records are also removed when your V2 account is deleted. They record feature, model, request size, timing, status, and cost metadata rather than raw journal prompts. This is our usage log, separate from provider-held data.
• Infrastructure logs and database backups are held by our hosting provider on its own schedule, and backups are overwritten in the normal course.

You can delete your V2 account in Settings. This removes your sign-in account, profile, household membership, invitations you sent, notification preferences, and account-linked app telemetry. If no other adult remains in a household, its records are deleted. If other adults remain, shared family profiles, journal entries, food lists, trials, and insights are retained for them, including records you created; responsibility for those records transfers to a remaining participant. Account deletion cannot be undone and does not cancel an App Store subscription.

You can also request deletion, or ask what we hold, by contacting us at support@safeyum.com.

9. Your Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Request access to the personal information we hold about you.
• Request deletion of your personal information, subject to certain exceptions required by law.
• Request information about the categories of personal information we collect and disclose.
• Not be discriminated against for exercising your privacy rights.

SafeYum does not sell or share personal information as those terms are defined by the CCPA and CPRA.

Health-related information counts as sensitive personal information under California law. We use it only to provide the Service you asked for, which is one of the permitted purposes, and never to infer characteristics about you, for advertising, or for any purpose you would not expect from a food journal. You may contact us to ask us to limit our use of it.

Everyone

Privacy laws differ from place to place. Rather than sort you by address, we extend the same rights to everybody using SafeYum, wherever you are. You may:

• Ask what personal information we hold about you and get a copy of it.
• Ask us to correct anything that is wrong.
• Delete your V2 account in Settings, subject to the shared-household retention described above.
• Withdraw your OpenAI-sharing agreement in Settings. SafeYum then stops sharing and cannot be used until you agree again; you can also sign out or delete your account.
• Turn off product analytics in Settings.
• Ask us questions about any of the above and get a real answer.

Washington, Nevada, and Connecticut Residents

What you record in SafeYum is consumer health data under the Washington My Health My Data Act and comparable laws in Nevada and Connecticut. We collect it only to provide the Service, with your consent, and we do not sell it. If you live in one of these states you may ask us for a list of the third parties we have shared your consumer health data with, and you may withdraw your consent and have that data deleted.

To make any of these requests, contact us at support@safeyum.com.

10. Security

We use reasonable technical and organizational measures to protect personal information, including encryption, access controls, and secure infrastructure. However, no system is completely secure, and we cannot guarantee absolute security of your information. V2 sign-in uses a one-time code sent to your phone. Keep access to your phone number secure, never share sign-in codes, and contact us if you suspect any unauthorized access to your account.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If changes are significant or required by law, we may provide additional notice through the Service or by email. Changes to this policy do not give your agreement to OpenAI sharing. V2 records your separate in-app agreement before allowing that processing.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

support@safeyum.com