Privacy Policy

1. Introduction

Welcome to Yammy ("we," "our," or "us"), an AI-powered recipe platform available at yammy.app. This privacy policy explains what information we collect, how we use it, and your rights regarding your data.

The short version: you can browse and search every recipe without an account. If you create a free account (needed to generate recipes, rate, or comment), we store your email, name, and password securely. The site shows ads through Google AdSense and uses Google Analytics and Rybbit to understand how it is used. We do not sell your personal data.

2. Information We Collect

A. Account Data (only if you sign up)

• Email address and name: used to create and identify your account and to send you transactional emails such as email verification and password resets.
• Password: stored as a secure hash via our authentication framework (Better Auth). We never see or store your plain-text password.
• Google sign-in: if you sign in with Google, we receive your name, email address, and profile photo from Google.

B. Content You Create

• Generated recipes: recipes you create are published to the public collection and linked to your account so they appear on your profile and count toward your monthly quota.
• Comments: displayed publicly alongside your name and profile photo.
• Ratings: stored only as an anonymous aggregate score per recipe — we do not keep a record of which recipes you rated.

C. Automatically Collected Data

• Server logs: IP address, browser type, device information, and request data collected by our hosting provider (Vercel) for operations and abuse prevention.
• Usage data: pages viewed, searches, and interactions, collected through Google Analytics and Rybbit (see section 6).
• Advertising data: Google AdSense may collect data through cookies to serve and measure ads (see section 6).

D. Browser Storage (localStorage)

Your cooking progress — checked ingredients and completed steps — is stored in your browser's localStorage. It stays on your device, is never transmitted to our servers, and can be cleared at any time through your browser settings.

3. How We Use Your Information

• Accounts: to authenticate you, maintain your session, show your profile, and enforce the free monthly generation quota.
• Transactional email: to send email verification and password-reset messages via Resend. We do not send marketing newsletters.
• Service operation: to keep the site running, debug errors, and prevent abuse.
• Analytics: to understand which features and recipes are useful so we can improve the service.
• Advertising: to fund the service through ads served by Google AdSense.

We do not sell or rent your personal data to anyone.

4. AI Generation & Your Prompts

Recipe text and food photography are generated by Google Gemini. When you generate a recipe, the dish description you type is sent to Google's Gemini API along with no other personal information. Please don't include personal details in recipe prompts — the resulting recipe is published publicly.

5. Cookies & Browser Storage

Yammy uses the following cookies and similar technologies:

• Session cookies (essential): set when you sign in, used to keep you signed in. These are required for accounts to work.
• Google Analytics cookies: used to measure site usage.
• Google AdSense cookies: used to serve, personalize (where permitted), and measure ads.
• localStorage: cooking progress and interface preferences, stored on your device only.

You can block or delete cookies through your browser settings; blocking essential cookies will prevent sign-in from working.

6. Advertising & Analytics

Google AdSense serves the ads on Yammy and may use cookies and similar technologies to personalize and measure them. You can control ad personalization through Google Ads Settings. Learn more in Google's advertising policy.

Google Analytics helps us understand aggregate site usage. Data is processed under Google's Privacy Policy.

Rybbit is a privacy-focused analytics service we use for aggregate usage statistics, processed under Rybbit's Privacy Policy.

Where required by law (for example in the EEA and UK), advertising and analytics cookies are used in accordance with applicable consent requirements.

7. Third-Party Services

Yammy relies on the following processors and services to operate:

• Vercel: hosting and serverless functions; collects standard server logs.
• Neon: PostgreSQL database storing recipes, account data, and comments.
• Cloudflare R2: hosts recipe images; stores no personal user data.
• Google: Gemini (AI generation), Analytics (usage measurement), and AdSense (advertising).
• Resend: sends transactional emails (verification, password reset) and processes your email address for that purpose.
• Rybbit: aggregate usage analytics.

Each service processes data under its own privacy policy.

8. Data Retention

• Account data: retained until you delete your account.
• Comments: retained until you delete them or delete your account (which removes them).
• Recipes: published recipes are retained indefinitely as public content.
• Server logs: retained by Vercel under its standard retention policies (typically around 30 days).
• localStorage: stays on your device until you clear your browser data.

9. Deleting Your Data

You can delete your account at any time from your profile page, or by emailing us at hello@yammy.app. When your account is deleted:

• Your account record (email, name, password hash, avatar) is permanently removed.
• Your comments are permanently deleted.
• Recipes you generated remain published in the public collection but are permanently unlinked from you — no personal data stays attached to them.

10. Data Security

• All connections use HTTPS/TLS encryption in transit.
• Passwords are hashed using modern algorithms; we never store plain-text passwords.
• Generation quotas and request validation limit abuse of our AI endpoints.
• Security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) protect against common web attacks.

No system is perfectly secure, but we keep the data we hold to the minimum needed to run the service.

11. Your Rights

European Economic Area & UK (GDPR)

You have the right to access, correct, delete, restrict processing of, and request portability of your personal data, and to object to processing based on legitimate interest. Our lawful bases are: performance of a contract (operating your account), legitimate interest (security and service operation), and consent where required (advertising and analytics cookies).

California (CCPA/CPRA)

You have the right to know what personal information we collect, request its deletion, and opt out of the sale or sharing of personal information. We do not sell personal information; you can limit ad-related sharing through Google's ad settings linked in section 6.

To exercise any of these rights, delete your account from your profile page or contact us at hello@yammy.app. We respond within 30 days.

12. Children's Privacy

Yammy is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will promptly delete it.

13. International Data Transfers

Our hosting (Vercel), database (Neon), image storage (Cloudflare R2), email (Resend), and AI services (Google Gemini) process data primarily in the United States. If you access Yammy from elsewhere, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country.

14. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes that affect account holders, we will notify you by email.

15. Contact Us

If you have questions about this privacy policy or wish to exercise your data rights, contact us at:

Email: hello@yammy.app