1. What this is
SavoryMind ("we", "us") is an AI-powered food intelligence platform serving home cooks, restaurant operators, and restaurant patrons. This page explains what data we collect, why, who we share it with, and what control you have over it. Our goal is plain English — if anything here is unclear, email privacy@savorymind.net and we'll explain.
2. What we collect
2a. Account data
- Email address and password (passwords are stored hashed, not in plain text)
- Display name and account type (consumer / restaurant / diner / staff)
- Profile information you choose to add: bio, dietary preferences, cuisine preferences, music genres, restaurant business type, etc.
- Restaurant location, timezone, and operating preferences (restaurant accounts only)
2b. Authentication data
- Refresh-token identifiers ("JTIs") used to keep you logged in across sessions
- If you sign in with Google or Apple: the Google/Apple-issued user ID and the email + name they share with us. We never store your Google or Apple password.
2c. Connected services (optional)
- Spotify: if you connect Spotify, we store an encrypted copy of your Spotify access and refresh tokens (encrypted at rest with Fernet symmetric encryption) so we can fetch your top artists and tracks for personalised wine and music recommendations. Disconnect any time and we delete the tokens.
2d. Content you create
- Reviews you write, menu items you create, bookings you make, inventory adjustments you log, food journal entries, social connections.
- Photos, recipe notes, food preferences.
2e. Diagnostic data
- When the app encounters an error, we log it via Sentry along with your user ID and the API request that triggered it. We do not log your password, payment details, or the full content of your Spotify tokens.
- We capture product-usage events via PostHog (e.g. when you sign up, log in, view a recommendation, submit a review). Events are keyed on your user ID. Properties are limited to safe metadata — account type, recommendation count, rating bucket — never the content of what you wrote, your email, name, or any tokens.
We do not collect: payment information (we don't sell SavoryMind today), precise GPS location (we use city/country only, and only if you set it in your profile), contacts, calendar, or anything from other apps on your device.
3. How we use it
- Run the product: log you in, save your reviews, render your dashboard.
- Personalisation: use your stated preferences and your Spotify listening signal to make AI recommendations more relevant to you.
- AI processing: we send the text of your reviews, menu items, and product preferences to Anthropic (the company behind Claude AI) to extract themes, generate recommendations, and produce restaurant-specific marketing and training insights. Anthropic processes this data on our behalf and does not use it to train their models. See section 4.
- Notifications: we send you in-app notifications and (if email is enabled) one weekly inventory low-stock digest if you're a restaurant operator. You can disable these in your profile.
- Service improvement: aggregated, non-personally-identifying metrics help us understand which features are valuable. We do not sell or share this data.
4. Who we share it with
We share data only with service providers who help us run the product, and only the minimum needed for them to do their job:
- Anthropic (Claude AI) — receives review text, prompt context, and preferences to generate AI insights. Bound by Anthropic's commercial agreement; does not train on your data.
- Spotify — only if you connect Spotify. We use your token to call Spotify's API on your behalf; Spotify itself sees your usage of their API.
- Google — verifies your Google ID token if you sign in with Google. Receives no other data.
- Apple — verifies your Apple ID token if you sign in with Apple. Receives no other data.
- Resend — sends transactional email (e.g. the weekly inventory digest). Receives only the email address and the email body.
- Sentry — receives crash and error reports including your user ID and the failing request URL. Bound by Sentry's data processing agreement.
- PostHog — receives product-analytics events keyed on your user ID (e.g. signup_completed, login_completed, recommendation_served, review_submitted). We never send PostHog passwords, tokens, raw email/name, review text, or any free-text user content — only event names and a small set of safe properties (account_type, rating bucket, recommendations_count). Used to understand product usage so we can fix what's broken and build what you actually use.
- Google Cloud Platform — hosts the backend (Cloud Run) and database (Cloud SQL Postgres). Cloud SQL is encrypted at rest by Google.
We do not sell your personal data. We do not share it with advertisers. We do not allow our service providers to use it for their own marketing.
5. How long we keep it
- Account and content data: until you delete your account.
- Refresh tokens: 30 days from last use, then automatically expired.
- Revoked-token records: pruned after their natural expiry to keep the table bounded.
- Sentry error logs: 90 days, then automatically purged.
- PostHog product-usage events: 365 days (PostHog default), then automatically purged.
- Backups: up to 30 days for disaster recovery.
6. Your rights
You can:
- Access your data — visit your profile, or emailprivacy@savorymind.net to request a full export.
- Modify profile data via the profile screen on web or mobile.
- Disconnect Spotify and other connected services from your profile.
- Delete your account by emailingprivacy@savorymind.net — we'll delete account data within 30 days. Reviews and menu items associated with your account are also deleted; aggregated, non-personally-identifying analytics may persist.
If you're an EU/UK/California resident, you have additional rights under GDPR/CCPA including the right to data portability and to lodge a complaint with your local supervisory authority.
7. Security
- All traffic between your device and our backend is HTTPS-encrypted.
- Passwords are hashed with bcrypt before storage.
- Spotify OAuth tokens are encrypted at rest with Fernet symmetric encryption; raw tokens never appear in our database in plaintext form.
- Refresh-token rotation with revocation tracking — a stolen-then-rotated session cookie stops working after the legitimate user's next request.
- Authentication cookies use httpOnly + Secure + SameSite=Lax flags.
- We monitor for unusual error patterns via Sentry and rotate compromised credentials promptly when suspected.
8. Children
SavoryMind is not directed to children under 13 and we do not knowingly collect data from them. If you believe we've collected data from a child under 13, email us and we'll delete it.
9. Changes to this policy
We'll update the "Last updated" date at the top whenever we change this policy. Material changes will be communicated via in-app notification or email.