한국어
Privacy Policy
- We keep what you put in — your cooking records, recipes, photos, and the account you signed in with. Nothing is collected behind your back.
- No ads, no analytics or tracking SDKs, and nothing sold to anyone.
- Your records and photos are not used to train AI models. The single exception (reported photos) is in section 3.
- Delete your account in the app and everything is gone within 30 days. Only recipe copies other people took stay with them — and your name no longer appears on those copies.
1What this is
This policy sets out what personal data JipCook handles, why, and for how long. It applies to the app and to the website. The terms of using the service are in the Terms of Service.
The information stored in JipCook — records of family meals — is personal by nature. This policy follows one principle: collect only what is needed, and delete it when it no longer is.
2What we collect
| Kind | What | When |
|---|---|---|
| Account | The email address and account identifier we receive from Google or Apple | When you sign in or link an account |
| Guest | An anonymous identifier only — no email address | When you start without an account |
| Profile | Nickname, country | When you enter or choose it |
| What you make | Recipes (ingredients, steps, notes, tags), cooking records and the journal you write for the day, photos, hearts, the labels you give family members | When you save it |
| Subscription | Subscription status and the result of validating a store receipt. We never receive card or payment details | When you start or renew Plus |
| Safety | Reports you file (reason, note, target), the people you block, and any moderation action on your account | When you report or block |
| Technical | Access and error logs (IP address, timestamp, request) | Automatically, when your app talks to the server |
What we don't collect — advertising identifiers, precise location, contacts or address book, health data, call or message history.
3What we don't do
- No advertising. There is no ad network in the app.
- No analytics or tracking. There is no behaviour-tracking SDK in the app.
- No advertising or tracking cookies. Staying signed in is handled by storage on your device.
- Nothing is sold. We do not sell or share personal information — not even under California's CCPA, whose broad definition counts passing data to ad companies as a "sale".
- JipCook does not use your records or photos to train AI models. If that ever changes we'll tell you first and ask for separate consent — and you'll be able to keep using JipCook either way. There is one exception: a reported photo is sent to Google for review, and Google may use it to improve its own models. Section 5 spells this out.
4Why we use it
- To provide the service — store and show your records, build your cookbook, calendar and stats, and show public recipes in Discover
- To identify your account — signing in, syncing between devices, linking accounts
- To keep people safe — handling reports, applying blocks, acting on violations
- To apply your subscription — validating store receipts so Plus turns on, and turning it off when expiry or a refund is confirmed
- To fix faults — diagnosing errors and stopping them from recurring
- To tell you things you need to know — moderation notices, changes to these documents
The grounds for processing are performing our agreement with you (the Terms), your consent for optional items, and our legitimate interest in keeping the service safe.
5Who processes it for us
Some processing — servers, storage and the like — is entrusted to the companies below. Each handles data only as far as the job they do requires.
| Company | What they do | Where |
|---|---|---|
| Supabase Inc. | Database, sign-in, server functions | Data stored in the Seoul, Korea region |
| Cloudflare, Inc. | Photo storage (R2), web hosting (Pages), visit statistics (Web Analytics — no cookies) | Global network |
| Google LLC (Gemini API) |
First-pass risk assessment of reported photos only (what is sent may be used to improve Google's models) |
United States |
| Telegram FZ-LLC | Private alert to the operator when a report comes in | Global |
| Apple Inc. Google LLC |
Sign-in, app distribution, payment processing | Global |
Automated review of reported photos (please read)
When someone reports a photo, that single photo is sent to Google's Gemini API for a risk assessment before a person sees it. This is so a genuinely harmful photo isn't left up for hours waiting on a human.
- We send the reported photo and the minimum needed to assess it — no account information such as email or nickname.
- Photos that have not been reported are never sent. Your ordinary records don't travel this path.
- A photo sent this way may be retained and reviewed by Google, and may also be used to improve Google's AI models. This is because JipCook uses Google's free API tier. Photos that were never reported are not affected.
- The machine's assessment can only take something down from public view. Strike points are applied by a person (Terms, section 5).
The operational alert (Telegram) contains the report's reason and note plus a short-lived link to view the photo. It goes to a private channel with only operators in it.
6International transfers
Some of the companies in section 5 are outside Korea. As required by the Personal Information Protection Act, here are the details.
| Recipient | Country | Data | When & how | Purpose | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. | USA and others | Photo files | Network transfer on upload | Storing and serving photos | Removed about 2 days after nothing references them |
| Google LLC | USA | One reported photo | API call when a report is filed | Risk assessment (may be used to improve Google's models) |
Per Google's API terms |
| Telegram FZ-LLC | UAE and others | Report reason and note, photo link | Message sent when a report is filed | Alerting the operator | Until deleted from the channel |
| Apple Inc. / Google LLC | USA and others | Account identifier, subscription receipt | On sign-in and payment | Authentication, payment | Per each company's policy |
Each company's privacy contact can be found on its own privacy policy page — Cloudflare · Google · Telegram · Apple.
If you'd rather your data weren't transferred abroad, JipCook won't work for you — the service is built on these providers. Deleting your account stops the transfers.
7How long we keep it
- For as long as your account exists.
- When you delete a record or a recipe, it disappears at once and is permanently erased within 30 days. The 30 days exist so that something lost to a bug or a mis-tap can be recovered, and so a report can be investigated. There is no trash can or undo screen — to you, it's gone the moment you delete it.
- When you delete your account, the same applies: after 30 days the data is actually deleted.
- Recipes other people took (forked) were copied into their own cookbook the moment they took them, so those copies remain with those people even after you delete your account. As your recipes leave public view with the deletion, the copies no longer show your nickname.
- Photos are removed from storage within about 2 days of nothing referencing them any more.
- Reports and moderation actions are kept as the record of a decision, but once an account is deleted they no longer identify anyone.
- Access and error logs are kept briefly under our hosting provider's log retention policy, and never longer than 30 days.
- Records that the law requires us to keep — such as payment and contract records under Korean e-commerce law — are kept for the required period.
8What stays on your device
- Cutting the dish out of a photo runs on your device using Google ML Kit. The photo does not leave your phone for that feature.
- Language and display settings, and the summary shown in the home-screen widget, are stored on the device only. Removing the app removes them.
9Your rights
- Access, correct, delete — most of it directly in the app. Records, recipes and photos on their own screens; the whole account under Settings → Account.
- Withdraw consent — deleting your account withdraws it.
- Ask for a copy — email us if you need a copy of what we hold.
- Access, correction and deletion requests are answered within 10 days of receipt. Anything else is answered within 30 days, to the address you write from.
- You may act through an authorised representative (we'll need to confirm the authorisation).
If you're unhappy with how we handle your data, you can also turn to:
- Personal Information Dispute Mediation Committee (Korea) — kopico.go.kr · 1833-6972
- Korea Internet & Security Agency privacy report centre — privacy.kisa.or.kr · 118
10How we keep it safe
- Row-level access rules in the database mean one person's records are out of reach of another's queries in the first place.
- Photos open only through short-lived signed links — knowing an address doesn't give lasting access.
- Sign-in is handled by Google and Apple; we store no passwords.
- Operator tools are limited to people on a named list, and every action is written to a log that cannot be edited.
Complete security cannot be guaranteed. If you find a security issue, please report it to the address below — security reports are handled first.
11Children under 14
JipCook is not directed at children under 14, and we do not knowingly collect their personal data. If we learn that an account belongs to a child under 14, we delete it. If you believe your child has an account, please write to us.
12Who to contact
- Data protection contact — JipCook operations
- Email — gwsticktogether@gmail.com
Access and deletion requests, appeals against a moderation decision, and security reports all go to this address.
13Changes to this policy
- When this policy changes, the new version is posted on this page with the date of the update.
- Significant changes are announced in the app at least 7 days beforehand, and changes unfavourable to you at least 30 days beforehand.
- This document is provided in Korean and English. If the two versions differ, the Korean version prevails.