Privacy Policy

Last updated: November 9, 2026
Applies to: the ALYAF mobile app and this website.

10.1 Who we are

ALYAF is run by Rayan Shafy Alkharasani in Saudi Arabia. Privacy contact: [email protected].

10.2 The short version

• We never sell your data or share it for advertising. Product photos you send us are the one exception: they become ours when you send them (section 10.10).
• The app contains no analytics, tracking or advertising SDKs of any kind.
• Your food log and health data are private to you: no other user can see them (except what you choose to share of your day with your friends, below), and we look at them only for the specific reasons in section 10.10.
• The only thing other people see is what you choose to publish to the recipe community, and what you choose to share with your friends.
• Sharing your day with friends is off unless you turn it on yourself in Settings (“Share my day with friends”). If you do, your friends (people you follow who follow you back) see the last 24 hours of your day: each meal's name, ingredients, calories and nutrients, how much water you drank, your step count for the day so far, and your weight if you logged it. So while sharing is on, your phone sends your step count for the day to our server, and we keep only the latest one. All of it disappears for them after 24 hours, and turning the switch off stops all of it (section 10.3).
• Your private meal log is seen by no one else, and kept for 7 days, then its meals are deleted (section 10.7).
• Logging, search and the calculations work offline. Food search never leaves your device.
• When you sign up you give one explicit consent to what this policy describes, and section 10.6 lists what it covers. Without it no account is created, and it's withdrawn only by deleting your account.
• AI features run only when you ask. Only what you asked about is sent: one line you wrote, or one photo you chose to have read.
• A photo is sent for analysis only when you ask for it. Meal photos and InBody reports you attach stay on your device with your log, and are not uploaded to our cloud (section 10.4).
• The camera runs only when you open it. Barcode scanning captures and stores no image. If we don't have a product you scanned, nothing reaches us unless you choose to photograph its front and nutrition label and send them to us so we can add it. Once you send them, they become ours: we may use them as the product's photo in the app and elsewhere, we may read their label with Google Gemini in our product tool, and we don't delete a photo we've used because you ask, except for any personal information in it (section 10.3 and section 11.6).
• Dictation turns your speech into text through your device's own speech service. We do not record your voice and it never reaches us.
• Notifications are scheduled locally on your device. There is no push server.
• No password: you sign up and sign in with a 6-digit code we email you. It works for 5 minutes, and only once. You can also use your Google account if you choose to (in the Android app and on the web).
• You can delete your account and data at any time (section 10.9).

10.3 What we collect

Account data: email, username (@handle, unique, in English), display name, account ID. The email is yours, or comes from Google if you sign in with it, and is used to create the account, sign you in with a code we send to it, and send account messages such as the code to delete your account. There's no password. You sign up and sign in with a 6-digit code sent to your email. It works for 5 minutes and only once, and a new code replaces the one before it. Supabase Auth, our account service, may hold a password on your account in a one-way encrypted form. The app never sets or uses it, and the server refuses any sign-in with it.

If you sign in with Google (in the Android app and on the web, not in the iPhone app for now): when you choose “Continue with Google” and agree on Google's page, Google gives us your Google email address and whether Google has verified it, your name on Google, your Google account ID, the link to your Google profile picture, and your organization's domain if it's a work account. Supabase Auth keeps these with your account. We use the email to sign you in and send account messages, and suggest the name as your display name, which you can change. The app doesn't show or download the picture.

Health and personal data (sensitive): sex, age, height, weight, target weight, activity level, goal direction, and, if you add an InBody report, its printed numbers (such as body fat, muscle mass and segmental measurements). We need them to work out your calorie and macro goals: the Mifflin-St Jeor equation takes weight, height, age and sex as direct inputs. We treat these as sensitive data: we ask for your explicit consent in the consent step when you sign up, before anything is saved (not bundled with accepting the Terms, section 10.6), and we store them in a space that server-side rules keep closed to every other account, except your latest weight if you turn on “Share my day with friends”: your friends see it for 24 hours after you log it (see “Your day, shared with your friends” below).

Your log: meals and their ingredients and timestamps, the meal photo if you attach one, weight entries, InBody reports and the photo of the sheet if you attach one, water, your steps, walking distance, walking time and active calories if you link a health app (see device permissions below), fasting sessions, exercise, your plan for the day and your favorites.

Community content (public by your choice): display name, @handle, bio, published recipes with their ingredients and notes, ratings, comments, and your follow relationships. We keep when each follow started: for 7 days after you follow someone, they can see in the notifications bell on their profile that you added them, and when. We've stopped adding profile photos and covers: the app doesn't ask for either, upload them or show them to you or anyone else, and shows the first letter of your display name or username in their place. If you added one in an older version of the app, we haven't deleted it. It may stay where it was stored. On your device, it stays until it's erased as section 10.7 describes (removing the app erases all of it). On the image host of our old Firebase test versions, if those versions uploaded it, it stays until it's deleted the way section 10.4 gives for data from those versions.

A recipe photo is optional, and public if you add one. When you publish a recipe you can add a photo. Your phone prepares it (up to 1,280 pixels on the longest side, as a JPEG), then it's uploaded to file storage in the app's own Supabase project (section 10.4), and every member who can see the recipe sees it. Its address is public: anyone who has it can open the photo, signed in or not, until it's deleted. The file's name says nothing about you. It's deleted from our image host within 30 days at most when you delete the recipe, a moderator removes it or you delete your account, and so is a photo you uploaded that no recipe ended up using (section 10.7).

Comments and replies are text only: we've removed their photos for good. If a comment or reply was posted with a photo from an older version of the app, that photo stays stored with it as it is, and the app doesn't show it in comments or replies. If that comment is reported, our moderators may see the photo while they review the report. It is deleted when the comment is deleted or your account is, and from our image host within 30 days at most, with the exception set out in section 10.7.

Your day, shared with your friends (off unless you turn it on): with “Share my day with friends” on in Settings, your friends see the last 24 hours of your day on the Friends tab (the “Daily” page). Friends are people you follow who follow you back. A one-way follow isn't enough. They see:

• Your meals: each meal you log is shown for 24 hours after it's shared, then it disappears. Only meals eaten in the last 24 hours are shared, editing one doesn't add time, and turning the switch back on shares your meals from the last 24 hours again. For each meal they see its name, its ingredient names (up to 12), its time, its calories, protein, carbs and fat, and the other nutrients recorded for it (saturated fat, total and added sugar, fiber, sodium, cholesterol, potassium, iron, caffeine, vitamin D and vitamin B12). A nutrient that wasn't recorded isn't shown. They also see your total calories and nutrients for the last 24 hours, added up from these meals.
• Water: how much you drank in the last 24 hours, and when you last logged water.
• Steps: your phone's step count for the day, as of the last time it was sent, and when that was. This is the only step data that leaves your device: while sharing is on and a step source is linked (Apple Health, the iPhone's motion counter or Health Connect), your phone sends your step count for the day and its date to our server when you turn the switch on, then after the app's successful reads from that source while it's open: usually at most once every 5 minutes if the count has changed, and once an hour so it stays visible. The server keeps only the latest count, in one row for your account, and shows it to your friends for 24 hours after it's sent. Walking distance, walking time and active calories aren't sent.
• Weight: the latest weight you logged in the last 24 hours, and when. If you didn't log one, they see nothing about your weight.

Water and weight aren't copied anywhere: the server reads them from your log when a friend opens the page, gives them only to mutual friends, and never gives anything older than 24 hours. If sharing is on and you've logged nothing in the last 24 hours, your friends see your name with “Nothing logged in the last 24 hours”. Not shown: the sentence you wrote a meal as, its photo, amounts, brands, your target weight, height, age or InBody numbers, or any other health data about you.

Turning the switch off stops all of it at once: all your shared meals come down, your latest step count is deleted from the server, and the server stops giving anyone your water and weight. Deleting a meal from your log takes it down. A shared meal ending doesn't touch your log, and your log ending after 7 days doesn't touch it. Your published recipes are affected by neither.

Older versions of the app have the old switch, “Share my meals with friends”, which shares meals only: nobody sees your water, steps or weight through it. If you turned it on there, it stays on until you update. The new version turns it off when you first open it, which also stops sharing your meals, and your day isn't shared until you turn on “Share my day with friends” yourself.

Product photos you send us: when a barcode you scan is not in our database, the app offers to photograph the front of the pack and its nutrition label so we can add the product ourselves. Nothing is sent until you tap “Send photos”. Your request stores them with the barcode, your account ID (UID), your device type (iOS, Android or web), the app's version and language, how the code was entered (camera or typed), which page opened the scanner, and when you sent it and how many times. If we already have the product when you send, no photos are asked for and your request is recorded as closed. Once you send them, they become ours, as the app says above “Send photos” (section 11.6). We may use them as the product's photo in the app, on our website and elsewhere, including commercially, which includes licensing or selling them to others, and we don't delete a photo we've used because you ask or because you delete your account. Photos we don't use are deleted once the product is added or we turn the request down (section 10.7). Photograph the product alone, with no face or person, and no paper, receipt or screen showing personal details. Whatever is in the picture reaches us as it is, and if it shows personal information we delete or blur it when we notice or when we're asked, or delete the photo. Who sees them: while the request is open, only we do, in our product tool through an editor account, and Google Gemini if we use it to read the label (below). The tool shows us how many people asked for a product, not who: your account ID appears neither there nor in the photo's file name. The front we use for a product is seen by everyone who sees that product in the app. The label we use isn't shown there. Both have public addresses, with no name or account ID, and may also appear outside the app, wherever we use them or license them to someone else. Reading the label with AI: when we add the product from your request, we may send the two photos from our product tool to Google Gemini to read the numbers on the label and fill in the product's nutrition values, then check them ourselves before saving. Nothing else from your request goes with them, not even your account ID. Our Gemini key is on its free plan, and Google's terms for Gemini's unpaid services say Google uses what is sent to them to provide and improve its products, and that human reviewers may read it (section 10.5).

Device permissions:

• Camera: asked when you scan a barcode, photograph a meal, a product label or an InBody report, take a recipe photo, or photograph a product we don't have so you can send it to us. Barcode scanning reads the number only, and captures, stores and sends no image. A photo you take is used for what you took it for: it's analyzed if you ask, kept with your meal or report if you attach it, and the two photos of a product we don't have are sent to us only when you tap “Send photos”.
• Photo library: only the image you pick, for a meal, an InBody report, a recipe or a product you send us, or to save a share card.
• Microphone and speech recognition: only while you press the dictation button in “Describe your meal”. Your device's speech service turns your speech into text: Apple's on iPhone and iPad, usually Google's on Android, and your browser's on the web. That service may process the audio on its operator's servers, under that operator's privacy policy. The app doesn't record, store or send us the audio. Only the text reaches it.
• Notifications: on a phone, asked when you tap Continue on the “Notifications & steps” page of sign-up (before the “Your name” step and consent), once when you first reach Home for accounts made before that page existed, or when you turn on “Meal reminders” or “Walking & calorie reminders” in Settings. Saying no doesn't stop the sign-up, and nothing is scheduled until the account exists and you've consented. Reminders are scheduled locally on your device: each meal reminder's time is worked out on your device from your own logged meals, and no reminder's text carries a number from your log. There's no push server, and no device token is sent to us. You can turn off any reminder in Settings, and withdraw the permission itself in your device's settings.
• Apple Health and Motion & Fitness (iPhone) or Health Connect (Android): on a phone, asked when you tap Continue on the “Notifications & steps” page of sign-up (nothing is read until the account exists and you've consented, and it's linked to the account when it's made), or when you turn on “Health app sync” in Settings or tap “Connect a health app” on the steps card. It reads, per day, your steps, walking distance, walking time (the time your device recorded steps) and active calories as the Health app or Health Connect recorded them. We never estimate calories. On iPhone it reads from the Health app (Apple Watch steps included) when your version of the app has Health access, and otherwise from the iPhone's own motion counter for the last 7 days, without calories. On Android it reads from Health Connect. It's read only: nothing else is asked for and nothing is written back. This data stays on your device and isn't uploaded, except your step count for the day while “Share my day with friends” is on (section 10.3 and section 10.4). Turning sync off stops the reading, and you withdraw the permission itself in your device's settings or in the Health app.

You can say no to any permission and the app keeps working. You lose only the feature that needs it.

What we do not collect: location, contacts, data from other apps (except the steps, walking distance, walking time and active calories Apple Health or Health Connect holds, if you link it), advertising identifiers, browsing behavior, or any analytics whatsoever.

10.4 Where your data is stored

On your device first: the app writes everything locally and mostly works offline. Your health app data stays on it: what the app reads from Apple Health, the iPhone's motion counter or Health Connect is kept on your phone, in your account's space, and is neither uploaded nor sent to anyone, except your step count for the day and its date while “Share my day with friends” is on. That is sent to the app's project so your friends can see it (section 10.3), only the latest count is kept there, and it's hidden 24 hours after it's sent, then deleted by a scheduled job within about 5 minutes (section 10.7). For sync and backup of everything else we use a Supabase project of the app's own (a Postgres database and the Supabase Auth account service):

• Your account (Supabase Auth): your email, your sign-in state and sessions, and, if you sign in with Google, what Google gives us (section 10.3). You never put a password in it. It may hold a password on your account in a one-way encrypted form that the app never sets or uses, and the server refuses any sign-in with it (section 10.3). Supabase writes a technical log of sign-ins in its own logs, not in our database (section 10.7).
• Account deletion: if you start deleting your account, we keep when you started, in one row for your account that your next start replaces and that is deleted with your account.
• Your private data: your health profile, plan and goals, your logged meals (7 days, section 10.7) and favorites, water, weight and InBody numbers, and your consent history. Row-level security on the server lets only the account that owns them read or write them, and everything not explicitly opened is denied. The one exception is what you share of your day: with “Share my day with friends” on, the server reads your water total and your latest weight from the last 24 hours for your mutual friends only, and gives them nothing else from this data (section 10.3). Your meals reach them as separate copies (next item).
• Community content: your public profile (username, display name and bio), recipes with their ratings and comments, your follows and when each started, your blocks, and the reports you send. Signed-in members can read profiles, recipes and comments, and only their author can change them. What you share of your day with friends (section 10.3), your meals and your latest step count, is given by the server to your mutual friends only, until it expires. The step count is one row for your account that no account can read directly.
• Photos: your meal photos and any photo of an InBody sheet stay on your device and are never uploaded. A recipe photo you choose to publish is uploaded to file storage in the app's own project (Supabase Storage, the recipe-photos bucket), at most 2 MB per photo. The bucket is public to read: a photo's address opens it for anyone who has it. Only a signed-in member can upload to it, and only their own photo, and a listing of the bucket shows each member their own photos only (section 10.3). The server won't take a photo link in a recipe from outside a list of hosts we set. The app no longer asks for a profile photo or cover, and doesn't upload or show one left from an older version (section 10.3). Comments and replies are text only, and old comment photos stay stored until they're deleted (section 10.3).

Requests for products we don't have are stored, once sent, in another Supabase project, our product database's, not the app's (section 10.3):

• The request (the barcode, your account ID and the rest of its details) lives in a table only the editor account of our tool can read, one record per product however often you resend.
• The two photos live in a private storage bucket (product-requests) that only that account can read, at most 1080 pixels wide and 2 MB per photo.
• Whichever of the two photos we use for a product is copied, re-encoded, to the products project's product photo storage, which anyone can read, with no account ID in its name. The front becomes the product's photo in the app. The label is kept in the same public storage but isn't shown in the app.
• Checking your account: the app sends the request and its two photos, with your sign-in token, to a function in the products project. It asks the account service of the app's project whose token it is, then files the request and uploads the two photos itself. We keep only your account ID from the token, and the function's log holds no token, ID or barcode.
• Until the request is delivered, it waits on your device, in your account's space.

From the same products project your device downloads a copy of our product list every few hours, and asks it about a barcode you scan that its copy does not have, without your account ID.

Server region: the app's project is in Mumbai, India (AWS region ap-south-1), and the products project is in Mumbai, India (AWS region ap-south-1). Your data may therefore be processed outside Saudi Arabia, as may whatever is sent to the AI provider and our proxy (section 10.5), on the basis of your consent and the contractual safeguards provided by our processor.

Earlier test versions: old test versions of the app kept the account and log in Google Firebase (Firestore and Firebase Authentication), recipe photos in Cloudinary, and your profile photo, if you added one, in Firebase Storage or Cloudinary. That data was not moved to the current version, whose accounts start from zero, and stopping profile photos doesn't delete what those versions uploaded. If you had an account on those versions and want its data deleted, write to us at [email protected] from that account's email and we'll delete it.

10.5 Third parties: the complete list

There are no other third parties, and none of them receives your data from us for its own purposes, with an exception we state plainly: our proxy runs today on the free plans of Google Gemini and Groq, and we don't pay for a plan with either. Our product tool also reads request photos with Google Gemini on its free plan. Google's terms for Gemini's unpaid services say Google uses what is sent to them, and what they answer, to provide, improve and develop its products, including machine learning technologies, and that human reviewers may read and annotate it once it's disconnected from our account and key. Groq says it doesn't keep what is sent to it by default, but may log it for up to 30 days to fix a failure or investigate abuse. That's why no request carries your name, email or account ID. We'll move the AI features to a provider on a paid plan later. We'll name it in the next table and notify you before the move (section 10.12). Product photos you send us are outside all of this: they become ours when you send them, so we may give or license them to others once any personal information in them is removed or blurred (section 10.10).

The AI provider, today and after the move. The app never talks to a provider directly. Every request goes through our proxy, which picks the provider the same way for all four features:

We update this table before anything in it changes, and notify you as in section 10.12. Reading request photos in our product tool isn't part of this table: it doesn't go through our proxy, and we ask Google Gemini directly (its row in the table above).

About the AI features: none of them runs on its own. Nothing is sent unless you ask, and what is sent and to whom is set out in the consent you give when you sign up (section 10.6). You never have to use them: manual entry is available everywhere. A line our food database can't match shows an “Estimate with AI” button, and nothing is sent unless you tap it. What is sent is that line as you wrote it and its measure, not the rest of your meal. Photos are sent in three cases only, all at your request: meal photo analysis, product label reading and InBody report reading, and only the photo you chose. The app doesn't send the photos of a product we don't have to any AI, but we may read them with Google Gemini in our product tool (section 10.3). The provider never receives your name, email, account ID, device ID, or anything from your health profile beyond what is in the photo you sent. Our proxy checks that you're signed in and uses the connection's IP address briefly to limit repeated requests, but doesn't pass your identity on. An estimated number passes a consistency check before it's shown and carries an “Estimated by AI” badge so it can't be mistaken for a measured one. Anything read from a photo is shown to you to review and edit before it's saved.

10.6 Legal basis, and the one consent

The one consent, and what it covers. When you sign up, before your account is created or anything is saved, the app shows you one consent covering all of the following. The app doesn't work without it: if you choose “I don't agree”, no account is created and none of your answers are kept, and you can cancel sign-up and come back whenever you like. People who signed up before this step existed are asked once: they agree, or delete their account and sign up again. By agreeing, you agree that:

1. We process your health data (sex, age, height, weight, goal and activity level, your food log, weigh-ins and InBody reports) for one purpose: working out your needs and tracking your progress (section 10.3).
2. We keep it on your device and sync it to our cloud, where no other account can read it, and it may be processed on servers outside Saudi Arabia (section 10.4).
3. We send what you ask us to analyze to an external AI provider through our proxy, only when you ask: one written line and its measure, a meal photo, a product label photo, or an InBody sheet photo, which may show your name, age, height and weight. Your name, email and account ID are not sent with it, and what comes back is shown to you to review and edit before saving (section 10.5).
4. You follow our community rules and Terms of Service (section 11.5): zero tolerance for objectionable content or abusive users. We remove anything that breaks the rules within 24 hours of a report and suspend the account that posted it, and we check published text automatically before it goes live.

It's one consent to these four together, given once for your account, and you're not asked again on another device. You never have to use the AI features afterwards: nothing is sent unless you ask, and manual entry is always there.

Withdrawing it is done by deleting your account (section 10.9), because the app cannot work without this data. Deletion is immediate, with no waiting period and no undo: your data is deleted from our cloud and from this phone right away, and any other phone you signed in on keeps its copy until you remove the app from it. Your photos are removed from our image host within 30 days at most, unless another member's recipe or comment still uses the same photo, in which case it stays until that recipe or comment is deleted. Backup copies go within 30 days, and technical logs on each provider's schedule. Reports you sent stay, no longer linked to your account, for up to a year, and no more than 90 days after they're closed (section 10.7). Withdrawal does not reach what was already sent to the AI provider.

Every earlier acceptance (its version and time) is kept while your account exists, so we can show what you agreed to and when, and it is deleted with your account.

If we change anything material in this consent (what we collect, who receives it, or why), we ask you again before the change takes effect (section 10.12).

10.7 Retention

Your private meal log (the day strip) shows today and the 6 days before it, and no meal is stored more than 7 days from its time. On the Supabase server it becomes unreadable the moment its 7 days end and is deleted within about 5 minutes by a scheduled job. If the job stops, it stays hidden but isn't deleted until the job runs again. On your device and a Firebase account it's deleted when you open the app, so it stays until you do, and a meal an older version of the app puts back in the cloud may stay there up to 30 more days, though it isn't shown. Only the dates you logged on are kept, on your device alone, to count your streak. Water, weight, InBody and favorites aren't part of the log. Your other account data is kept for as long as your account exists. Recipes you publish to the community stay until you delete them or we remove them for breaking the rules, whatever happens to your log or your shared meals. When you delete your account it's deleted at once, with no waiting period and no undo, after you confirm it with a 6-digit code sent to your email (section 10.9). Your recipes, ratings, comments and the replies under them, follows and blocks go with it, and your username and email are freed right away. What stays after that, and for how long:

Backup and Supabase log periods in our project's plan: our Supabase plan is the free one, which keeps no automatic backups. We take encrypted manual backups ourselves before major changes and delete them within 30 days at most. Supabase keeps its technical logs, including the sign-in log, for 1 day.

What law requires us to keep stays for as long as it requires. Local data is erased from the device you deleted the account on at once, and from any device when you uninstall. Abuse reports are deleted 90 days after they're resolved, and every report after 365 days at most. If a moderator removes one of your recipes, we keep a review record with the recipe's id, the reason from a fixed list, the time and the two accounts involved, without the recipe's name or text. It's deleted automatically 90 days after the removal (if the scheduled deletion job stops, when it runs again). Meals shared with friends stop being shown exactly 24 hours after they're shared, are deleted from the server by periodic clean-up (within about a minute on Supabase) or when you next open the app, and at once when you delete the meal, turn sharing off or ask to delete your account. Each time your phone sends your step count, it replaces the one before. It isn't shown once 24 hours have passed since it was sent, and is deleted from the server by periodic clean-up within about 5 minutes after that. If the job stops, it stays hidden but isn't deleted until the job runs again. It's deleted at once when you turn sharing off or delete your account. If you unlink your step source or sign out while sharing is on, the last count stays visible to your friends until 24 hours have passed since it was sent. Water and weight aren't copied for sharing: they stay in your log as described above, and the server doesn't give them to your friends once 24 hours have passed since you logged them, or once sharing is off. A request for a product we don't have stays open until we add the product or turn the request down. A photo we use for the product stays for as long as we use it, with no link to your account, and we don't delete it because you ask, except for any personal information in it (section 11.6). Its other photos are deleted once the product is added or the request is turned down, as are the photos of a send you replaced with a newer one or that never finished. The request record itself (the barcode, your account ID and its other details) is deleted within 30 days of closing, as is a request recorded as closed because we already had the product. Whatever we sent to Google Gemini stays with Google under its terms (section 10.5). When you delete your account we delete your requests and the photos we haven't used too, but they live in the products project, not the app's, and deleting the account doesn't reach them. So we delete them ourselves, in a separate manual step, within 30 days of the account's deletion.

10.8 Your rights

Access, rectification, erasure, portability, withdrawal of consent (by deleting your account, section 10.6), objection and restriction, and the right to lodge a complaint with your supervisory authority (in Saudi Arabia: SDAIA). Write to [email protected] and we'll respond within 30 days.

10.9 Deleting your account

In the app: Settings → your account row at the top (your name) → “Delete my account” at the bottom. Tap “Send code” and we email a 6-digit code to your account's address. It works for 5 minutes. Enter it and tap “Delete my account”, and your account and all its data are deleted at once from our cloud and from this device, and you're signed out. There's no waiting period and no undo, nothing can be recovered, and nothing is deleted before you enter the code. We ask for the code because the server accepts a deletion only from a sign-in made with a new code after you started it, so someone holding your unlocked phone can't delete your account without your inbox. If time runs out before you enter it, start again and we'll send a new one. A Google account goes the same way: the code goes to your account's address, which is your Google email, and signing in with Google doesn't replace it. What you shared of your day with friends (your meals and latest step count) is deleted with it, and your water and weight go with your log, so friends see none of it. Photos from your recipes and your old comment photos are deleted from our image host within 30 days at most, unless another member's recipe or comment still uses the same photo. What else stays, and for how long, is in section 10.7. Deleting your account is also the only way to withdraw your consent (section 10.6).

By email: write from your registered address to [email protected] with the subject “Delete account”. We check the message comes from the account's address, delete it the same way, and confirm by email. This is also the way for a suspended account, which cannot sign in to the app. There's no password to forget: signing in and deleting both go by a code sent to the account's email, and a Google account can also sign in with Google (in the Android app and on the web) but is deleted with the same code. If you've lost that inbox, write to us at [email protected]. We won't delete an account or change anything on it until you show it's yours with details only you would know. We delete your product requests from the products project in a separate manual step within 30 days of your account's deletion (section 10.7). A photo we use for a product stays, with no link to you (section 11.6). See section 7 of the Arabic text for the full table of what is deleted.

10.10 Security and our own access

TLS in transit, encryption at rest on our database provider's (Supabase) infrastructure, server-side access rules that no modified client can bypass, and no passwords: you sign in with a 6-digit code sent to your email that works for 5 minutes and only once, or with your Google account (in the Android app and on the web). The server refuses any sign-in with a password, and accepts an account deletion only from a sign-in made with a new code sent to the account's email after you started it, even for a Google account.

Those rules stop every other user from reading your data, except what you publish or share of your day with your friends (section 10.3). We, like anyone who runs a database, can technically reach stored data through our server provider's console. We have built no tool for browsing users' records, and we use that access only to carry out a request from you (correction, deletion, or a copy of your data), to fix a technical problem you asked us to help with, or to protect the service and investigate abuse. We do not use your data to train AI models. Product photos you send us are the exception to all of this: they become ours when you send them, and we may use and earn from them, including by selling or licensing them to others, once any personal information in them is removed or blurred (section 11.6).

No system is perfectly secure. If a breach affects your data, we'll notify you and the competent authority within 72 hours of becoming aware of it.

10.11 Children

ALYAF is only for people who are 18 or older. No one under 18 may create an account or use it, and we don't knowingly collect their data. If we learn of an account belonging to someone under 18, we delete it. Parents and guardians who learn of one: write to [email protected] and we'll delete it right away.

10.12 Changes

For material changes, particularly a new third party or a new purpose, we notify you in the app 30 days before they take effect.