Privacy policy

Who is responsible for your information

Koshoku is operated by GordonHan, based in Singapore. This policy covers the Koshoku mobile app and koshoku.app.

For privacy questions, access or correction requests, consent withdrawal, or deletion requests, contact support@koshoku.app. General support is available at support@koshoku.app.

Information we collect

The information involved depends on the features you use:

• Account information: email address, username, user identifier, sign-in records, and information you provide to create or secure your account. Supabase processes passwords and authentication sessions.
• Optional profile information: display name, date of birth, height, weight, activity level, calorie goals, meal preferences, and reasons for using Koshoku. A saved security-method preference alone does not activate two-factor authentication.
• Meal information: photos you choose or take, meal descriptions, pasted recipe text, analysis results, ingredient edits, saved recipes, and food-diary entries.
• Purchase information: store transaction and subscription identifiers, purchase history, subscription status, product, and expiry information. Card details and other payment credentials are handled by the store or payment provider, rather than entered into Koshoku's mobile paywall.
• Technical and support information: request and error records, device or app information processed by our service providers, and the contents of messages you send us. Website hosting providers may process IP addresses and request metadata.

How we use information

Where consent is required, we ask for it for the relevant use. Withdrawing consent may prevent us from providing features that need that information. Consent to optional features is separate from accepting the terms of service.

• Create and authenticate your account, deliver account messages, and respond to support requests.
• Estimate nutrition, save your meals and recipes, display your diary, and use the preferences and goals you choose.
• Verify subscription access, process purchase changes, enforce usage limits, and prevent fraud or misuse.
• Operate, troubleshoot, and protect the service, and meet applicable legal obligations.

Meal analysis and external AI providers

When you request AI meal analysis, the meal photo or text and analysis instructions are sent to Google Gemini. If Koshoku is configured to use its fallback provider, that content is sent to Anthropic instead. The analysis request does not intentionally include your account email, username, or body measurements, but a photo or text can contain information you include in it.

Photograph the food only and avoid faces, documents, addresses, or other identifying or sensitive details. Providers process inputs and outputs under their own service terms and may retain information for security, abuse prevention, or legal purposes.

Google's treatment differs between paid and unpaid Gemini API projects. Unpaid services may use inputs and outputs to improve products and may involve human review; paid services have different processing terms. The production billing configuration is not yet confirmed, so this draft does not promise that inputs are excluded from product improvement.

You can use features that do not submit a meal for AI analysis without requesting that analysis. Nutrition estimates may be inaccurate and should not be used as medical advice.

Service providers and disclosures

Supabase provides account authentication, database storage, file storage, and backend functions. Cloudflare hosts the website. RevenueCat verifies and manages mobile subscription entitlements, using your Koshoku user identifier to associate purchases with your account. Apple and Google process store purchases.

When configured, Amazon SES sends account messages such as confirmation and password-reset emails and processes delivery information. Sign-in providers process authentication information when their sign-in option is available and you choose it.

We disclose information to providers as needed for these functions. We may also disclose information when legally required, to protect rights or security, or as part of a lawful business transfer subject to appropriate safeguards.

Storage and retention

Our scheduled cleanup is designed to remove stored meal-photo objects and their scan references after 30 days, and scan records, scan components, and retry-attempt records after 365 days. These periods describe Koshoku's storage and do not set our providers' independent retention periods.

Food-diary entries keep nutrition snapshots even after the source photo or scan is removed. Account information, preferences, saved recipes, and diary entries are kept while needed to provide your account or until an applicable deletion request is completed.

Some records may need to be retained for legal, fraud-prevention, security, or dispute purposes. Backups and provider systems may take additional time to age out. The scheduled cleanup has not yet been confirmed active; these periods remain a draft until deployment is verified.

International processing and security

Our providers may process information in countries outside Singapore. We use appropriate safeguards for transfers as required by applicable law, including contractual protections where relevant.

We use access controls and authentication to protect account information. No storage or transmission system is completely secure. Keep your sign-in credentials private and contact us if you suspect unauthorized account access.

Your choices and requests

You can choose whether to provide optional profile information and whether to allow camera or photo access. You can change device permissions in your device settings. Features that require a permission may stop working when it is disabled.

You can contact support@koshoku.app to request access, correction, deletion, or withdrawal of consent, and to raise a privacy complaint. We may verify your identity before processing a request and will respond in accordance with applicable law.

Deleting an account does not automatically cancel an App Store or Google Play subscription. Manage cancellation with the store separately.

Website and device storage

The current marketing website does not include advertising trackers or an analytics integration in its application code. Hosting services may still process operational request information.

The app stores authentication sessions on your device so you can stay signed in. The app's browser version uses local storage for its session. We will update this policy if we introduce additional analytics or tracking.

Eligibility and policy changes

Koshoku is intended for adults aged 18 or older. If you believe a person below that age has provided personal information, contact us so we can investigate and take appropriate action.

We may update this policy when our service or practices change. We publish the revised version and effective date and provide further notice or request consent when required.