Privacy Policy
Mori ("we", "our", or "us") is a recipe discovery app built by an independent developer. This policy explains what data we collect, how we use it, and your rights. We keep this simple because we genuinely don't collect more than we need.
1. What we collect
- Email address — when you join the waitlist or create an account.
- Name — optional. Only if you provide it in your profile.
- Onboarding preferences — dietary goals, cuisine preferences, skill level, budget, and ingredient dislikes. These power your personalised recipe deck.
- Swipe and interaction data — which recipes you swipe right or left on, save, add to your grocery list, or mark as cooked. Used solely to improve your recommendations and generate your taste profile.
- Pantry items — ingredients you add manually or select during onboarding.
- Meal plans and grocery lists — saved to your account so they persist across sessions.
- Recipe notes — personal notes, substitutions, quick-tags, and ratings you write on recipes you have cooked. Visible only to you.
- User-submitted recipes — if you use the Add Recipe feature, the title, ingredients, steps, description, and optional photo you provide are stored. Public recipes are visible to all users and may appear in other users' Discover feeds, with your display name shown alongside them. Private recipes are visible only to you. You can edit or delete your recipes at any time from the "Mine" tab.
- Recipe photos — if you add a photo to a recipe, the image is uploaded to our storage bucket and shown to other users when the recipe is Public. We access your photo library only when you tap "Add a photo" — we do not scan, browse, or store any other images.
- Profile photo — optional. If you set a profile picture, it is shown next to community recipes you submit and on your profile.
- Display name and username — your display name appears on community recipes you publish. Your @username is a unique handle on your profile (rate-limited to one change per 30 days).
- Reviews and recipe flags — if you write a review on a recipe you've cooked, the rating, text, and your display name are visible to other users. If you flag a recipe as inaccurate, the flag is recorded against your account so we can prevent abuse.
- Streaks and badges — number of consecutive cooking days, the date of your most recent cook, and badges you've unlocked. Used to show progress in your profile and to power streak reminders.
- Leftovers — if you log leftovers after cooking, the ingredient names and approximate spoil dates are stored to power expiry reminders and to bias future recommendations toward what you already have.
- Push notification token — if you grant push permission, Expo issues an anonymous device token that we store against your account. Used to send streak reminders, monthly taste-profile updates, and badge unlocks. Revoke at any time in iOS Settings.
- Diagnostic data — anonymised crash and error reports collected via Sentry. IP addresses, request headers, and request bodies are stripped client-side before events are sent; session replay is disabled.
2. What we do not collect
- We do not collect location data.
- We do not use advertising SDKs.
- We do not sell your data to third parties.
- We do not track you across other apps or websites.
- We do not use your data for targeted advertising.
3. How we use your data
- Recommendations — your preferences and swipe history are used entirely on-device to rank and personalise your recipe deck. No data is sent to a third party for this purpose.
- Taste profile — your swipe history is sent to Anthropic's API (see Section 4) to generate a short personalised paragraph describing your cooking style.
- Macro estimates — a recipe's ingredient list is sent to Anthropic's API to estimate nutritional values. Results are stored against the recipe and shared across all users who view that recipe. No personal account data is included in this request.
- Storage tips — after you mark a recipe as cooked, the recipe title is sent to Anthropic's API to generate storage and usage suggestions.
- Community recipe distribution — public recipes you submit are added to the shared recipe database and may be surfaced in the Discover feed for all Mori users. Your display name (and profile photo, if set) is shown alongside the recipe.
- Recipe validation — when you submit a public recipe using the Add Recipe feature, the recipe content is sent to Anthropic's API to check accuracy before publication. Your name and account details are not included.
- Account management — your email is used to authenticate your account. Transactional emails (welcome / verify-email at signup, password reset) are sent via Resend. We do not send marketing emails.
- Push notifications — if you grant permission, we send a daily streak-at-risk reminder (only if your streak would break that night), a monthly notice when your taste profile updates, and badge-unlock alerts. We do not send marketing or promotional pushes.
- Reviews and flags — reviews are publicly visible alongside the recipe and your display name. Flags are visible only to us and are used to remove inaccurate community submissions.
- Crash diagnostics — Sentry receives stack traces and minimal runtime context to help us fix bugs. PII is filtered before events are sent.
4. AI features and Anthropic
Data sent to Anthropic is governed by Anthropic's Privacy Policy. We do not send your name, email address, or account credentials to Anthropic. All AI features are processed server-side — no API keys are exposed to your device.
You can use Mori without triggering AI features. The taste profile requires at least 5 swipes before it generates. Macro estimates are cached per recipe — if another user has already triggered estimation for a recipe you view, no new API call is made.
5. Grocery delivery
You can send your grocery list to Instacart to pre-populate a cart. When you tap to order, your grocery list — ingredient names and quantities only — is sent to Instacart. You complete checkout inside Instacart's app or website. Instacart's own privacy policy governs that interaction. Mori receives an affiliate commission on attributed orders via Impact; affiliate parameters are appended to the cart URL.
6. Data storage and processors
Your data is stored on Supabase, a hosted PostgreSQL provider. Data is stored in the United States. Row-level security ensures you can only read and write your own data. Recipe images and profile photos are stored in Supabase Storage.
Other processors:
- Vercel — serverless API hosting. Standard request metadata (IP, timestamp) retained up to 30 days.
- Anthropic (Claude) — AI content generation. See Section 4.
- Expo Push Service — delivers iOS push notifications using an anonymous device token.
- Resend — transactional email delivery (welcome / verify-email, password reset). Receives only your email address and the message body.
- Sentry — crash and error diagnostics. PII (IP, headers, request bodies) is stripped client-side before events are sent; session replay is disabled.
- Instacart / Impact — grocery cart hand-off and affiliate attribution. See Section 5.
7. App Store privacy details
In accordance with Apple App Store requirements, here is a summary of how data is handled:
- Data used to track you: None. Mori does not use your data to track you across third-party apps or websites.
- Data linked to you: Email address, name / username, photos (profile + recipe), usage data (swipes, interactions, streaks, badges), preferences (dietary goals, cuisines, pantry, leftovers), user-generated content (notes, submitted recipes, reviews, flags), purchase / order data is not collected (Instacart handles checkout), and an Expo push token if you enable notifications.
- Data not linked to you: Recipe nutritional estimates (stored per recipe, not per user); diagnostic crash data (PII stripped before send).
8. Data retention and deletion
Your account data is retained until you delete your account. You can delete your account and all associated data at any time from inside the app: tap your avatar to open Profile, scroll to the bottom, and tap Delete Account. This immediately removes your account, swipes, saves, meal plans, pantry, notes, and reviews. Recipes you submitted to the community are de-attributed and retired.
If you cannot access the app, email hello@getmori.app with the subject "Delete my account" and we will process the request within 7 days.
9. Children
Mori is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.
10. Changes to this policy
If we make material changes, we will update the date at the top of this page and notify existing users via email if the changes affect how we process personal data.
11. Contact
Questions about this policy? Email us at hello@getmori.app.