Privacy Policy

Last updated: April 21, 2026

Ovala ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your information when you use the Ovala mobile application ("App"). By using the App, you agree to the practices described here.

1. Information We Collect

Information you provide directly:

• Account information: name, email address, and password when you register
• Dietary preferences and allergies you enter during onboarding or in Settings
• Cooking verdicts and ratings you submit for recipes
• Grocery lists and meal plans you create
• Prompts and inputs you provide to the AI recipe generation feature
• Community photos you voluntarily upload after cooking a recipe

Information collected automatically:

• App usage data such as recipes viewed, saved, or added to the grocery list
• Subscription and purchase history (processed by RevenueCat)
• Device type and operating system version for crash reporting and compatibility
• General usage patterns to improve the App experience

We do not collect precise location data, contacts, or any information unrelated to the App's core functionality.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Personalise recipe recommendations based on your dietary preferences and cooking history
• Generate AI-powered recipes tailored to your inputs using Anthropic's Claude API
• Manage your grocery lists, meal plans, and saved recipes
• Process your subscription and verify entitlements via RevenueCat
• Moderate and display community-submitted food photos
• Send optional cooking reminder notifications (only if you enable them)
• Improve and maintain the App's features and performance
• Comply with legal obligations

We do not use your data for advertising, sell it to third parties, or use it to build advertising profiles.

3. Third-Party Services

Ovala uses the following third-party services which may process your data:

Supabase (supabase.com) — Our backend database and authentication provider. Your account data, recipes, grocery lists, verdicts, and community photos are stored on Supabase infrastructure hosted in the United States. Supabase is SOC 2 Type II certified. Privacy policy: supabase.com/privacy

RevenueCat (revenuecat.com) — Manages in-app subscriptions and purchase verification. RevenueCat processes your purchase history and subscription status. No payment card data passes through our systems or RevenueCat — all payments are processed by Apple via the App Store. Privacy policy: revenuecat.com/privacy

Anthropic (anthropic.com) — Provides the Claude AI model used for AI recipe generation. Prompts you submit are sent to Anthropic's API to generate recipes. Anthropic's privacy policy governs that data: anthropic.com/privacy

We do not use analytics platforms, advertising SDKs, or any other third-party data processors beyond those listed above.

4. Community Photos

If you choose to upload a photo after cooking a recipe:

• The photo is stored in our Supabase Storage bucket
• It is reviewed by the Ovala team before being made publicly visible in the App
• Approved photos may be visible to all Ovala users within the recipe detail screen
• Photos are not shared outside the App or used for any other purpose
• You may request removal of your photos at any time by contacting us

By submitting a photo, you confirm you have the right to share it and grant Ovala a non-exclusive, royalty-free licence to display it within the App.

5. Data Retention

• Account data is retained for as long as your account is active
• If you delete your account, your personal data, recipes, grocery lists, verdicts, and photos are permanently deleted within 30 days
• Anonymised, aggregated usage statistics (with no personally identifiable information) may be retained indefinitely
• Subscription records may be retained for up to 7 years for tax and legal compliance

6. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate data.
• Deletion: Request that we delete your account and associated data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain types of processing.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at baruwal.sujit@gmail.com. We will respond within 30 days.

If you are in the European Economic Area, you have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

Ovala is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Data Security

We use industry-standard security measures including encrypted data transmission (TLS), encrypted storage, and row-level security on our database. However, no method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password for your account.

9. International Transfers

Your data is stored on servers in the United States. If you are located outside the US, your data will be transferred internationally. By using the App, you consent to this transfer. We ensure appropriate safeguards are in place in accordance with applicable data protection laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this document. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us at: baruwal.sujit@gmail.com