Privacy Policy

Who we are

Yummika (“we”, “us”) operates yummika.com, a dietary-aware culinary travel service. We are the data fiduciary / controller for the information described here. For any privacy question, or to exercise any right below, contact privacy@yummika.com.

The short version

• We collect your dietary profile because it is the entire point of the service — we cannot decode a dish for you without knowing what you avoid.
• We do not sell your data, and we do not run advertising or tracking pixels.
• Free-text notes about your allergies are encrypted in our database.
• Your dietary details are never included in links you share with other people.
• You can ask us to export or delete your data at any time.

What we collect

Information you give us

• Account details — name, email address, and a password (stored only as a scrypt hash; we never see or store the password itself).
• Allergies — the allergen, a severity level, whether you are concerned about cross-contamination, and any free-text notes you add.
• Dietary preferences — for example vegetarian, vegan, gluten-free, keto, along with how strictly each applies to you.
• Religious dietary requirements — for example halal, kosher, Jain, or avoiding beef or pork. We explain this category separately below.
• Free-text notes — anything you add for a kitchen to read.
• Trips and wishlists — destinations you plan to visit and dishes you save.
• Messages you send to venues through our inquiry feature, including the dietary brief attached to them.
• Meal check-ins and corrections — whether a dish worked out, and any report that our information was wrong.
• Your chosen language, used to generate output in that language.

Information we generate

• Safety cards built from your profile, in two languages.
• Verdicts comparing dishes against your profile.
• Credit ledger entries recording usage of metered features.
• Audit records of significant actions, for security and accountability.
• A record of your disclaimer acknowledgement, with a timestamp.

What we do not collect

We do not use advertising trackers, we do not set marketing cookies, and we do not build advertising profiles. The only cookies we set are the one that keeps you signed in and a small preference cookie remembering which dashboard cards you collapsed. We do not collect payment card details.

We do use Vercel Analytics to count page visits. It is cookieless, it does not follow you between sites, and it does not build a profile of you or record which pages any individual person viewed. We see how many people opened a region page; we do not see that you did.

We deliberately keep no browsing history against your account. There is no “recently viewed” record. The things we store about what you did are the things you chose to do — saving a dish, sending an inquiry, generating a safety card — because the feature needs them, not because we wanted to watch.

Health and religious information

Allergy information is health information. Religious dietary requirements can reveal religious belief. Many privacy laws treat both as sensitive categories deserving extra protection, and we agree.

We collect these only because you ask us to decode food against them. We process them on the basis of your explicit consent, given when you add them to your profile. Every one of these fields is optional. You can use Yummika with only the categories you are comfortable sharing, you can remove any of them at any time, and leaving them blank simply means we will not check dishes against them.

We do not use this information to target advertising, we do not share it with data brokers, and we do not use it for any purpose other than the ones listed on this page.

How we use your information

• To compare dishes and menu items against your profile and show you what conflicts.
• To generate bilingual safety cards you can show to kitchen staff.
• To translate questions for you to ask a venue.
• To pass a dietary brief to a venue when you choose to send an inquiry.
• To match you to venues whose stated capabilities fit your needs.
• To improve the accuracy of our dish and ingredient data, including through your corrections and check-ins.
• To send you service email — invitations, notifications you asked for, and password resets.
• To keep the service secure and to investigate misuse.
• To understand which regions and features are used, so we know what to build next. This uses aggregate counts only.

Who we share it with

We do not sell your data. We share it only with the following, and only as needed to run the service:

• Venues you contact. When you send an inquiry or share a safety card, the venue sees the dietary details relevant to that request. This only happens when you choose to do it.
• Anthropic, whose AI models we use to generate dish and region content and to translate text. Where a request relates to you, it may include the dietary terms needed for that translation. It is not used to train their models.
• Open Food Facts, a public ingredient database we query to verify allergen information. We send ingredient names only — never anything about you.
• Supabase (database hosting, Mumbai region) and Vercel (application hosting, and the cookieless page analytics described above).
• Our email provider, to deliver service messages.
• Authorities, if we are legally required to disclose something.

When you share a safety card with someone over a messaging app, we deliberately share a link rather than the contents, so your allergy details are not sitting in a chat thread.

Community features

If you join a Circle or community, other members can see your display name and what you choose to post there. Your allergy profile is not shared with other members. If you invite someone, we tell them who invited them.

How we protect it

• Free-text allergy notes are encrypted in our database using AES-256-GCM. Structured allergen codes remain readable to our systems because the safety engine has to be able to act on them.
• Passwords are stored as scrypt hashes, never in plain text.
• Sessions use signed tokens that cannot be forged or altered.
• Access to production data is limited and logged.
• Traffic is encrypted in transit.

No system is perfectly secure. If we ever discover a breach affecting your information, we will tell you and the relevant authority as required by law.

Where your data lives

Our database is hosted in India (Mumbai region). Some of our service providers — including our hosting, AI and email providers — operate from other countries, so your information may be processed outside India when those services are used.

How long we keep it

We keep your account data for as long as your account exists. If you ask us to delete your account, we remove your personal data, though we may keep minimal records where the law requires it. Aggregate, anonymised information about dish accuracy — which does not identify you — may be retained to keep our data correct for other travellers.

Your rights

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that is wrong;
• delete your account and its data;
• withdraw consent for any category of dietary information, by removing it from your profile;
• explain how a particular verdict was reached.

Most of this you can do yourself in your profile. For anything else, email privacy@yummika.com and we will respond within 30 days. If you are unhappy with our response, you may complain to the Data Protection Board of India.

Children

Yummika is not intended for children under 18, and we do not knowingly create accounts for them. If you believe a child has an account with us, contact us and we will remove it. An adult may of course record a child’s dietary needs within their own account when travelling as a family.

An important limitation

Yummika reports information supplied by venues, publishers and our research process. It cannot guarantee that any food is safe for you. Nothing on this page changes that. Always confirm allergens directly with the kitchen.

Changes

If we change this policy in a way that materially affects you, we will tell you by email or in the app before the change takes effect.

Contact

privacy@yummika.com