Privacy Policy

1. Introduction

Welcome to Yammy ("we," "our," or "us"), an AI-powered recipe discovery platform available at yammy.app. This privacy policy explains what information we collect, how we use it, and your rights regarding your data.

The short version: Yammy collects minimal data. We don't require accounts, don't collect email addresses, don't use advertising or tracking cookies, and don't sell your data to anyone. The data we do collect (like your IP address) is used solely to operate and protect the service.

2. Information We Collect

A. Automatically Collected Data

When you visit Yammy, certain information is collected automatically by our hosting infrastructure:

• IP Address: Used for rate limiting recipe generation (3 requests per hour) and abuse prevention. Your IP is stored temporarily in server memory and is not persisted to a database.
• Technical Data: Browser type and version, operating system, device type, and screen resolution. This is collected by our hosting provider (Vercel) as part of standard server logs.
• Usage Data: Pages viewed, recipes accessed, search queries, request timestamps, and performance metrics. This helps us understand how the service is used and identify issues.

B. Browser Storage (localStorage)

Yammy stores recipe progress data in your browser's localStorage. This includes which ingredients you've checked off and which instructions you've completed for each recipe. This data stays entirely on your device and is never transmitted to our servers. You can clear it at any time through your browser settings.

C. What We Do NOT Collect

To be clear about our minimal data practices, we do not collect:

• Email addresses, names, or contact information
• Account credentials or passwords (no accounts exist)
• Payment or financial information
• Precise geolocation data
• Advertising or third-party tracking cookies
• Social media profile information

3. AI-Generated Content

Yammy uses Google Gemini AI to generate recipe content and food photography images. Specifically:

• Gemini Flash generates recipe text including titles, ingredients, instructions, and descriptions.
• Gemini Pro Image generates styled food photography for each recipe.

When you generate a recipe, your search query (e.g., "pasta carbonara") is sent to Google's Gemini API. No personal information is included in these requests. Your data is not used to train Google's AI models. Our daily recipe generation uses publicly available seed recipes from TheMealDB API.

4. How We Use Your Information

We use the limited data we collect for the following purposes:

• Rate Limiting: Your IP address is used to enforce fair usage limits (3 recipe generations per hour) and prevent abuse of our AI generation service.
• Service Operation: Technical and usage data helps us keep the website running, debug errors, and optimize performance.
• Security: Request logs help us detect and respond to malicious activity, such as denial-of-service attacks or automated scraping.
• Improvement: Aggregated, anonymized usage patterns help us understand which features are useful and where the service can be improved.

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

5. Third-Party Services

Yammy relies on the following third-party services to operate. Each may collect or process certain data as described:

• Google Gemini AI: Receives recipe search queries for content and image generation. No personal data is sent. Subject to Google's Privacy Policy.
• Vercel: Hosts the website and serverless functions. Collects standard server logs including IP addresses, request data, and performance metrics. Subject to Vercel's Privacy Policy.
• Supabase: Stores recipe metadata and hosts recipe images. Does not store personal user data. Subject to Supabase's Privacy Policy.
• TheMealDB: Provides seed recipe data for our daily generation pipeline. We only fetch data from their API; no user data is sent to them.

6. Cookies & Browser Storage

Yammy does not use advertising cookies, analytics cookies, or third-party tracking cookies. We currently do not set any cookies.

We use your browser's localStorage to save your recipe progress (checked ingredients and completed instructions). This data:

• Is stored only on your device
• Is never transmitted to our servers
• Contains no personally identifiable information
• Can be cleared at any time via your browser's "Clear browsing data" settings

7. Data Retention

• Server Logs: Retained by Vercel according to their standard retention policies (typically 30 days).
• Rate Limiting Data: Stored in server memory only. Automatically cleared on server restart and is not persisted to any database.
• Recipe Content: AI-generated recipes are stored indefinitely as public content. This is not personal data.
• localStorage: Retained on your device until you clear your browser data. This is entirely under your control.

8. Data Security

We implement reasonable security measures to protect the limited data we handle:

• All connections use HTTPS/TLS encryption in transit.
• Rate limiting prevents abuse of our AI generation endpoints.
• Request size validation blocks oversized or malformed payloads.
• Security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) protect against common web attacks.

Because we do not collect passwords, payment information, or other sensitive personal data, the risk profile of our data collection is low. No system is perfectly secure, but our minimal data practices reduce the potential impact of any incident.

9. Your Rights

Depending on your location, you may have certain rights regarding your personal data:

European Economic Area (GDPR)

If you are located in the EEA, you have the right to access, correct, delete, restrict processing of, and request portability of your personal data. You also have the right to object to processing based on legitimate interest. Our lawful basis for processing is legitimate interest (operating and securing the service).

California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell personal information to any third party.

To exercise any of these rights, please contact us at the email address listed in the Contact section below. We will respond within 30 days.

10. Children's Privacy

Yammy is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will promptly delete it.

11. International Data Transfers

Yammy is operated from the United States. Our hosting (Vercel), database (Supabase), and AI services (Google Gemini) process data in the United States. If you access Yammy from outside the US, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country.

12. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page will reflect the most recent revision. Since we do not collect email addresses, we cannot notify you directly of changes. We encourage you to review this page periodically.

13. Contact Us

If you have questions about this privacy policy or wish to exercise your data rights, please contact us at:

Email: privacy@yammy.app