SelfMosaic Privacy Policy

1. Who is responsible for your data

SelfMosaic is operated by Archit Rajendra Khare, trading as SelfMosaic. The service operates from India. The operator is the controller of personal information used to provide SelfMosaic. Contact privacy@selfmosaic.app.

2. What we collect and why

Ingredients, photos, notes and saved meals

SelfMosaic processes the ingredient lists, selected kitchen photos and optional cooking notes you provide to generate meal ideas. The website accepts typed ingredients and selected kitchen photos. Saved meals contain the meal idea and relevant ingredient information, including whether ingredients were read from a photo or reviewed by you. In the app, optional missing-ingredient lists are derived from saved meals.

In the app, saved meals stay on the device when SelfMosaic says it saved locally. Online saving, where supported in the app, attaches meals to the relevant account or temporary session. Saving a meal from a photo may create a small thumbnail with image metadata removed in the app's device cache. That thumbnail is not uploaded or backed up and may be removed by the operating system. Deleting the saved meal or app removes any remaining cached thumbnail.

On the website, a signed-in account can save meals to that account. Without an account, the website saves meals only in this browser's local storage, as text without photos. Those meals are not sent to SelfMosaic and stay until you remove them, clear this site's browser data, or delete your data. Some browsers, such as Safari, may also clear them if you don't visit the website for about a week.

The website also keeps your latest three meal ideas, the meal you opened and your cooking step in this browser's local storage for 12 hours, so reloading the page doesn't lose them. This copy is text only and is not sent to SelfMosaic. It is removed when you start over, sign out of an account, clear this site's browser data or delete your data; after 12 hours it is no longer shown and is removed the next time you open the website.

Cooking preferences you choose in the app are stored on your device and sent with AI requests to guide meal ideas. These can include vegetarian, no-pork or no-beef choices. Cooking notes can include dietary or allergy information you choose to provide; saving a meal can retain its cooking-note context with that meal.

Optional sign-in

Sign-in is optional. If you choose Sign in with Apple or Google, Clerk and the identity provider may send SelfMosaic an account or user identifier, email address, and name when the provider supplies them. SelfMosaic uses the identifier for authentication and account continuity, and uses a supplied name or email for account display, a one-time transactional account welcome email after the first verified account setup, requested contact, support, export, and deletion. The welcome email is a service message, not a marketing subscription. Billing entitlement is connected through viewer, account, and store identifiers—not your name or email. None of these details is used for advertising or cross-app tracking.

Device and session information

SelfMosaic creates a stable, random pseudonymous device identifier and keeps it in local app storage. The app sends that identifier when it creates or recovers a preview or account viewer, when you submit a waitlist or support request, when you report an AI result, during purchase or restore safety checks, and—only after optional analytics consent—when it records an App Store or Product Hunt link opening. SelfMosaic stores the waitlist copy for abuse control; for a link-opening receipt, the server immediately replaces the received identifier with a daily scoped SHA-256 hash before storing the receipt. SelfMosaic uses the identifier for app continuity, request and billing integrity, abuse prevention, security, support, and consented product analytics—not advertising or cross-app tracking. The app also sends and stores the device timezone so dated meals and account activity use the expected local day.

Support and launch updates

We use the support messages and AI-result reports you submit to investigate and respond to problems.

If you choose to join the launch waitlist, SelfMosaic sends and stores the email address you enter, the app-scoped pseudonymous device identifier, the page or placement where you joined, a sanitized referrer path, and available UTM campaign values. SelfMosaic uses the email to send the launch update you requested, the device identifier to limit waitlist abuse, and the source details to understand which SelfMosaic launch surfaces work. Separately, after optional analytics consent, opening an App Store or Product Hunt link sends the device identifier and source details to create a launch-link receipt; the server immediately replaces that identifier with a daily scoped SHA-256 hash before storing the receipt. SelfMosaic does not share this information with advertising networks or use it for cross-app tracking.

Optional analytics and diagnostics

Optional product analytics remain off until you enable them. In the app, use Privacy to change the setting. Crash diagnostics stay on so the app can report breakage without prompts, media URLs, tokens, or raw kitchen photos.

The website uses Vercel Web Analytics to count visits. It uses no cookies. It tells visits apart by a hash of the incoming request that resets daily, so it cannot follow you across days or other websites. We see only totals, such as pages viewed, referring sites, country, browser and device type. It is not used for advertising profiles.

We also count tries, meals and saves in aggregate from our own service records.

If you enable optional analytics, SelfMosaic's sanitized product events can include the current plan tier, a subscription package or product identifier, purchase or restore step and outcome, active-entitlement count, server-sync state, and a bounded failure category. PostHog receives those consented events, and Sentry can include the same consented event as a breadcrumb if a later diagnostic report is sent. These events contain no full payment-card data, store receipt, transaction token, or order reference and are used to understand subscription-flow reliability, not for advertising or cross-app tracking.

Subscription information

RevenueCat connects subscription access with the relevant SelfMosaic account. The information SelfMosaic receives can include a pseudonymous App User ID, product, store, environment, entitlement, expiry, cancellation and refund status. SelfMosaic does not receive or store full payment-card data.

If you subscribe through the Apple App Store, Apple handles your purchase. If you subscribe through Google Play, Google handles your purchase. When website checkout is available, Paddle acts as merchant of record.

Legal bases where applicable

Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases:

• Contract: to provide the service you ask for, including accounts, saved meals and purchases.
• Consent: to send the ingredients, photos or notes you choose to the AI service after you allow it, for optional analytics in the app, and for launch emails you sign up for.
• Legitimate interests: to keep the service secure and working, to diagnose crashes, to investigate support requests, to prevent abuse and fraud, and to count usage in aggregate.
• Legal obligation: to keep records the law requires and to respond to lawful requests.

You can withdraw consent at any time in Privacy in the app, with the unsubscribe link in a launch email, or by contacting privacy@selfmosaic.app. Under India's Digital Personal Data Protection Act, 2023, we rely on your consent or on a legitimate use that the Act allows.

3. AI processing and your choices

Before AI processing, SelfMosaic asks permission to send the inputs you select to Microsoft Azure OpenAI. These may include kitchen photos, cooking notes or reviewed ingredients.

Permission applies to the account or temporary session and the relevant disclosure version. SelfMosaic asks again when permission is missing, reset or needs renewal.

For each live ingredient-scan or meal-plan request, SelfMosaic's backend derives a stable SHA-256 pseudonym from the internal viewer ID and sends that pseudonym to Azure OpenAI as a safety identifier for abuse detection. It contains no email, username, device ID, or raw SelfMosaic viewer ID and is not used for advertising or cross-app tracking.

The original selected photo bytes are not retained on SelfMosaic's servers. SelfMosaic does not use your kitchen photos, prompts or saved meals to train SelfMosaic models. Microsoft may retain prompts for abuse monitoring under its own terms.

In the app, open Privacy and use “Ask again next time AI is used” to reset the permission for the displayed session or account scope. SelfMosaic asks again before the next covered AI request. Resetting permission does not delete saved meals. For help with a website permission or a data request, contact the privacy inbox.

4. Service providers and international processing

SelfMosaic uses outside services to operate the product:

• Vercel for website hosting, and Convex for the database and backend.
• Microsoft Azure OpenAI for AI processing of typed ingredients and photos, cooking notes and meal ideas.
• Clerk, Google and Sign in with Apple for sign-in.
• Sentry for crash diagnostics and PostHog for product analytics only after consent.
• Resend for transactional account messages, requested launch updates and support-email delivery.
• Paddle as merchant of record for website payments, when available; RevenueCat for subscription status.
• Google Workspace for our email inboxes, including privacy and support mail.
• Expo to build the apps.

• Apple App Store for store purchases; Google Play if you subscribe through Google Play.

Each service provider we use is bound by contract to protect your personal data at least as well as this policy describes.

Some providers process data in the United States, and your information may be processed outside the country where you live.

When we transfer personal data protected by EU or UK law to a country without an adequacy decision, such as the United States, we rely on the EU–US Data Privacy Framework where the provider is certified and the transfer is covered by that certification, including the UK Extension for UK data. Otherwise, we use the European Commission's Standard Contractual Clauses plus the UK Addendum for UK data. To ask about these safeguards, contact privacy@selfmosaic.app.

5. How long information is kept

Different records have different purposes and deadlines. Data can be removed earlier where the relevant workflow allows it.

AI retry records

To prevent an exact retry from running or counting the same action twice, SelfMosaic temporarily stores a random request ID, a SHA-256 input digest, and the parsed ingredient read, meal-plan result, or recipe-visual result content for a 24-hour retry window. Optional generated images and storage metadata use the same window and appear in your export while retained. The retry record never contains the original selected photo bytes.

Retry data becomes inaccessible after 24 hours and the next hourly sweep clears it, including generated images, normally within 25 hours. Retained retry data can appear in a user-requested export, but an export cannot extend its deadline.

Support and AI-result reports

Support-request content—including text submitted with an AI-result report—is scheduled for deletion or irreversible redaction within 365 days after submission and may be removed earlier. Final cleanup normally completes within one additional hour.

Email and launch-link records

Bounded email send and delivery-event records older than 90 days are removed by the next hourly cleanup, normally within 90 days plus one hour. An email action already in flight remains subject to the same cleanup. Consented launch-link receipts are kept for 90 days and normally removed by the next daily cleanup.

We keep a launch-waitlist signup until you ask us to delete it, or until you delete a SelfMosaic account that uses the same email address. Unsubscribing stops launch emails but does not delete the signup.

If you unsubscribe from launch emails or delivery is suppressed, a restricted record containing the normalized email address and suppression history can remain to prevent future marketing sends. In the waitlist deletion workflow, attribution and device fields are removed from that retained suppression record. We keep this minimum record for as long as we need it to keep honouring your opt-out.

Saved meals and account data

The app explains whether a meal is saved locally or online. Removing a meal or requesting account/temporary-session deletion starts the relevant deletion process. Ending a temporary session is different from deleting its server data; see section 6.

Exports

Exports requested in the app normally remain downloadable for up to 7 days. If an export includes AI retry data, the whole export expires no later than the earliest included retry record. Every download rechecks identity, ownership and the deadline. SelfMosaic does not expose a reusable storage URL for the export.

Vendor-held records

Providers apply their own retention schedules to logs, backups and other records. A provider-held copy may remain for a time after we delete the original. Purchase providers keep records as their own legal and tax duties require. We keep records the law requires us to keep for as long as it requires.

6. Deleting your data

In the app, start account deletion from More. For temporary app use, use “Clear my data” before ending the preview. For website data requests, or if sign-in is unavailable, use the deletion page or contact the privacy inbox.

Account deletion signs you out immediately. Queued server cleanup is designed to finish in about 30 days, subject to the disclosed background-processing, backup, support-record and legal exceptions.

Deleting your account, app or data does not cancel a subscription. Cancel with the provider where you purchased.

For website purchases, use the management link in your Paddle receipt or Paddle buyer support.

Restricted billing records during deletion

When account deletion begins, SelfMosaic may temporarily keep copies of the exact pseudonymous RevenueCat App User ID already carried by restricted deletion, billing-event, webhook, and operator records while it creates a one-way billing-quarantine anchor or removes provider-linked billing data. These deletion-carried copies—including short-lived queued billing callback arguments—have a fixed, non-renewable 30-day recovery/provider-use deadline. After it, they are used only by bounded cleanup to locate and erase old copies; never for anchor creation or retry, provider calls, entitlement reconciliation, logging, or new durable state. Bounded cleanup starts immediately and erases them sooner when they are no longer needed. If scheduled redaction is delayed, physical redaction continues across the next bounded cleanup executions until complete; if anchor setup still fails, only cleanup waiting on that anchor is released. Unrelated export, support, or deletion stalls remain unchanged. The one-way anchor can remain for up to 30 days to quarantine delayed billing events and contains no raw provider identifier. New RevenueCat webhook metadata received later follows a separate lifecycle: it can temporarily include a provider identifier and event details, expires after 24 hours, and is normally removed within 25 hours.

Information left on the device

After account or preview deletion, viewer-owned server product data follows the deletion workflow and stated retention exceptions. The stable pseudonymous device identifier, device-level appearance and onboarding settings, and the optional analytics choice remain in local app storage. They contain no meal, prompt, or kitchen-photo content. If you use SelfMosaic again, the app may send the same device identifier during a new bootstrap, waitlist or support request, AI-result report, purchase or restore safety check, or consented link-opening receipt; it does not restore the deleted account data.

Ending a temporary session

Ending a preview or temporary session removes access from the device; it does not by itself delete online data. Delete the data before leaving if you want deletion. If you have already left, contact the privacy inbox. Help depends on whether the old data can be securely identified and remains subject to the disclosed retention and legal limits.

7. Your rights and contact

You can request access, correction, export or deletion by contacting privacy@selfmosaic.app. Where applicable law provides these rights, you can also request restriction, object to processing or request data portability. We may need enough information to verify that a request concerns your data.

You can withdraw optional analytics consent through the available Privacy controls. For AI permission, see section 3. Withdrawing consent does not make earlier lawful processing unlawful. You may raise a complaint with the relevant data-protection authority where you have that right.

Grievance Officer: Archit Rajendra Khare, privacy@selfmosaic.app. We acknowledge grievances within 48 hours and resolve them within one month.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects. Meal ideas are generated automatically; you choose what to cook. The service also uses automated usage limits and security checks.

8. Age requirements and policy changes

You must be at least 13 to use SelfMosaic. If local law requires a higher minimum age or parent or guardian permission, that stricter rule applies.

Important policy changes will be shown in the product before they affect you. The effective date at the top identifies this version of the policy.