Privacy policy | Foodies

1. Who is responsible for your data

The data controller for Foodies is Hugo Moriceau, trading as Foodies, Paris, France. Foodies is an independent product: there is no parent company, no investor with a data-sharing arrangement, and no advertising business behind it.

You can reach the controller directly at hugo@oshi-messenger.com, or through the contact form. Messages go to the founder, not to a support queue. We have not appointed a Data Protection Officer, because the criteria in Article 37 GDPR do not apply to us: we do not carry out large-scale systematic monitoring, and we process no special-category data as a core activity.

2. What we hold

This list is derived from the database schema itself, table by table. If a category is not on this list, we do not have it.

Categories of personal data held by Foodies
Category	Exactly what that means
Account identifiers	A random account id we generate, your username, and the opaque subject identifier that Sign in with Apple returns for our app. We do not store your email address, not the one on your Apple Account, not a relay address. Nothing in our schema has a column for it.
Profile	Display name, bio, city, the cuisines you pick, your badge, your avatar image, your private-account and hide-my-visits settings, and your follower and following counts.
Content you create	Posts, reels and stories with their title, caption, cuisine, emoji, hashtags and optional place name; comments; collection names and the posts in them; live cooking events you schedule and the chat messages sent during a live.
Photos and video	The image and video files you upload. We re-encode every upload server-side into a uniform, compact format and serve it from our own domain. While you broadcast a live, the video segments your device produces are stored on our server so viewers can play them.
Approximate location	Only if you provide it: coordinates saved on your profile or attached to a post, and the coordinates your device sends when you open Nearby. The Nearby coordinates are used to rank that one response and are not written to the database. Location is optional everywhere; the rest of Foodies works identically without it.
Activity and social graph	Who you follow and who follows you, likes, saves, profile visits, event RSVPs, accounts you have blocked, and reports you have filed. Post-level counters (likes, saves, comments, views).
Push notification tokens	The Apple Push Notification service token for each device you have enabled notifications on, the platform, and your per-category preferences (follows, likes, comments, messages, lives).
Direct messages	The ciphertext of each message, the public key the sender used, who the two participants are, and the timestamps. Plus the public half of your device's encryption key, which we publish so other people can encrypt to you. See section 5.
Subscription status	Whether Pro is active, when the entitlement expires, and Apple's original transaction identifier for the purchase. We never see or hold card details, Apple takes the payment and we only verify the signed receipt Apple issues.
Technical	Your IP address is held in memory for at most one minute at a time, purely to count requests for rate limiting, and is then discarded. Your session token is a signed value that carries only your account id.

3. Why we hold it, and the legal basis

Article 6 GDPR requires a lawful basis for each purpose, not one basis for the whole product. Here is ours, purpose by purpose.

Purpose, data used, and legal basis under Article 6 GDPR
Purpose	Data used	Legal basis
Create your account and keep you signed in	Apple subject identifier, account id, username, session token	Performance of a contract, Art. 6(1)(b)
Run the product you came for: feed, Explore, profiles, search, collections, live events	Profile, posts, media, social graph, activity	Performance of a contract, Art. 6(1)(b)
Show dishes and cooks near you	Approximate coordinates	Consent, Art. 6(1)(a), given through the iOS location prompt and withdrawable at any time in iOS Settings
Relay your direct messages to the person you are writing to	Ciphertext, public keys, participants, timestamps	Performance of a contract, Art. 6(1)(b)
Send the notifications you asked for	Push token, per-category preferences	Consent, Art. 6(1)(a), given through the iOS notification prompt, withdrawable per category in the app or wholesale in iOS Settings
Keep the network safe: automated screening of posted text, reports, blocks, and rate limits against spam and brute force	Post and comment text, report and block records, IP address in memory	Legitimate interests, Art. 6(1)(f): protecting our users from abuse and the service from attack. Also a condition of our terms of use.
Grant Pro, and let it lapse on its own when a subscription ends	Apple transaction identifier, entitlement expiry	Performance of a contract, Art. 6(1)(b)
Nightly database backups so an outage does not erase your work	All of the above	Legitimate interests, Art. 6(1)(f): service continuity and integrity
Answer a message you send through the website	Your name, email address and message	Consent, Art. 6(1)(a), given by ticking the box on the contact form

4. What we do not do

There is no advertising SDK in Foodies. There is no analytics broker. We do not sell, rent or share your personal data with anyone for their own purposes, and nothing in the app follows you to other apps or websites.

That is a statement about the code, not a promise about intent. The server has six third-party dependencies in total, a web framework, a Postgres driver, two JSON Web Token libraries, an upload handler and a CORS helper. None of them is an analytics, attribution or advertising product. Nothing measures you on behalf of anybody else.

No advertising identifiers. We do not request the IDFA and we run no ad network.
No cross-app or cross-site tracking. There is no pixel, no fingerprinting, no third-party cookie. The website sets no tracking cookies at all, see the cookie notice.
No email address. Sign in with Apple can hand an app an email address; we read only the subject identifier and discard the rest. There is no column to put it in.
No profile sold to data brokers. Your taste profile is computed from your own posts, likes and saves, and it is shown to you.

5. Messages and encryption

Direct messages in Foodies are end-to-end encrypted. We relay ciphertext and we hold no key that opens it.

Concretely: your device generates a Curve25519 (X25519) key pair on first use and keeps the private half in the iOS Keychain, where it never leaves the device. To send a message, your device performs a key agreement with the recipient's published public key, derives a symmetric key from the shared secret with HKDF-SHA256, and seals the message with ChaCha20-Poly1305. What arrives at our server is a base64 blob and the sender's public key. Our database column is literally called ciphertext, and the push notification we send to the other person says who wrote to them and never what they wrote, because we do not know.

We would rather tell you the limits than let you assume there are none:

There is no key-fingerprint verification yet. Your device trusts the public key our server hands it for the person you are writing to. A malicious or compromised server could therefore substitute a key of its own and read what followed. A comparable-safety-number check, which would let two people confirm out of band that they hold each other's real keys, is not implemented today.
There is no forward secrecy. The same long-term identity key is used for every conversation, so a private key extracted from a device in the future could decrypt that device's older stored messages. There is no ratchet that rotates keys per message.
Metadata is not encrypted. We can see who is talking to whom and when, because routing a message requires it.
Message content is not scanned, we cannot, so the automated moderation described in the terms applies to public content only. Blocking someone stops their messages reaching you.

Live chat during a cooking event is not end-to-end encrypted: it is public content in a public room, stored as text so late arrivals can read the thread.

6. Where it lives, and who else touches it

Foodies runs on our own server, one machine, one database, media on its own disk. There is no data lake and nothing is copied to a warehouse.

Sub-processors and recipients
Who	What they do for us	Where
Contabo GmbH	Hosting: the virtual server that runs the API, the PostgreSQL database, and the media and live-stream storage. They provide the infrastructure; they have no purpose of their own for your data.	Data centre in France (EU)
Apple	Sign in with Apple (we verify Apple's signed identity token), the Apple Push Notification service (we open a direct connection to Apple's servers to deliver alerts), and App Store billing for the optional Pro subscription.	Apple's own infrastructure, under Apple's terms and safeguards

Your data is stored in the European Union. Any transfer outside the EEA that occurs is one Apple performs within its own services under its own safeguards; we do not transfer your data to any other country ourselves.

We will disclose data to a public authority only where we are legally compelled to, and only what is compelled. For direct messages there is nothing useful to disclose: we hold ciphertext and no key.

7. How long we keep it

Your account and everything attached to it: for as long as the account exists. Delete the account and it goes, see below.
Backups: the database is dumped nightly and dumps are rotated after seven days. A deleted account can therefore persist in an encrypted backup file for up to seven further days before it ages out. We do not restore individual records from backups.
Live broadcast video: segments are pruned continuously during a broadcast, and the recent window remains playable after the stream ends. Starting a new broadcast for the same event wipes the previous one.
Rate-limiting counters: held in memory, expire within a minute, never written to disk.
Session tokens: valid for 180 days, after which you sign in again.
Contact-form messages: kept in the founder's inbox and Telegram for as long as needed to deal with what you wrote about, and then deleted.

One honest caveat about media files. Deleting your account removes every database record, including the posts that referenced your photos and videos. The underlying image and video files sit in a separate media store on the same server, and deleting the account does not itself unlink them from disk; they simply become unreferenced, with no post, profile or listing pointing at them. If you want the files themselves purged as well, ask us at hugo@oshi-messenger.com and we will do it. We would rather write this sentence than a cleaner one that is not true.

8. Your rights, and how to use them

Under the GDPR you have the rights below. Two of them, the two people actually use, are buttons in the app rather than an email you have to send and then chase. Open Foodies, go to your profile, open Settings.

Access and portability, Articles 15 and 20

Settings → Download my data. One tap builds a single JSON file containing everything we hold about you and hands it to the iOS share sheet: your account record, every post, comment, like and save, who you follow and who follows you, your blocks and the reports you filed, your collections and their contents, the profile visits you received, your events and RSVPs, your encryption public key, which platforms you have registered for push, and your direct messages.

Two deliberate details in that file. Direct messages are included as ciphertext, because that is genuinely all we have; only your device can turn them back into words. And the push token itself is withheld: it is a delivery credential, and writing it into a file you might email around would let anyone holding the file push notifications to your phone. Everything else is verbatim.

Erasure, Article 17

Settings → Delete account. One tap, one confirmation, and the account row is deleted. Every table that references it is defined to cascade, so the same operation removes your profile, posts, comments, likes, saves, follows in both directions, collections and their contents, conversations and every message in them, your published encryption key, your push tokens, your events, RSVPs and live chat messages, your blocks, your reports and your profile-visit records. It is irreversible, it does not require an email to us, and there is no waiting period during which we try to talk you out of it. See the caveat about media files in section 7.

Rectification, Article 16

Edit your display name, username, bio, city, cuisines and avatar in the app at any time. You can edit the text of your own posts and delete any post or comment you made.

Restriction and objection, Articles 18 and 21

Switch your account to private to keep your plates out of Explore, Trending, Nearby and search; switch off "show my profile visits" to browse without being recorded as a visitor; block any account to cut it off in both directions. To object to processing we carry out on the legitimate-interests basis, write to us and we will answer.

Withdrawing consent, Article 7(3)

Turn off location for Foodies in iOS Settings and Nearby stops receiving coordinates; nothing else changes. Turn off individual notification categories in the app, or all notifications in iOS Settings. Withdrawal takes effect from that moment and does not undo processing that was lawful before it.

Automated decision-making

Ranking a feed is not a decision with legal or similarly significant effects, and we make none. Automated text screening can refuse a post that matches a narrow list of slurs, sexual-abuse terms and explicit threats; if that happens to you wrongly, write to us and a human will look at it.

Everything above is in the app, not in an email queue

Export and deletion are both a single tap in Settings. You never have to ask us for permission to leave with your own data.

Download on the App Store Ask us something

9. Children

Foodies is not directed at children under 13, and we do not knowingly hold personal data about them. If you believe a child has created an account, write to hugo@oshi-messenger.com and we will remove it. Posting, commenting, following and messaging all require a full account created with Sign in with Apple; browsing as a guest creates no profile you can post from.

10. Changes, and how to complain

If this policy changes materially we will update the date at the top and, where the change affects how we use data you have already given us, tell you in the app before it takes effect. Old versions are not hidden, ask and we will send you one.

If you think we have handled your data badly, tell us first at hugo@oshi-messenger.com; we would rather fix it than argue about it. You also have the right to lodge a complaint with a supervisory authority. Ours is the French one:

Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
www.cnil.fr

If you live elsewhere in the EEA, you may complain to your own national supervisory authority instead.

Related: terms of use · cookie notice · contact · recipe guides