Privacy Policy

What we collect

What you log: the messages you send Eth, the entries it creates, your corrections, go-tos, language, time zone, an optional display name and an optional daily number. If you ask Eth to calculate that number, the five inputs you give (sex, birth year, height, weight, activity) are stored on your profile so it can be recalculated; they are overwritten, never kept as a history, cleared together with the number, and never mentioned in the chat. If you turn reminders on, the hour you chose. From what you log, Eth also keeps a short list of the kitchens you eat from (Peruvian, Mexican, ...) and the way your house has each dish.

Photos, only if you send them. By default a photo is analysed and discarded; it's only stored (privately, in your own folder) if you turn on "Keep my photos".

Account data: an email if you add one; a Stripe customer id if you pay. We never see your card number.

Operational data: the time and size of model calls (never the text), rate-limit counters, and a record of safety-related events (a level, a category, whether it came from text or a photo caption, and a time; never the message) so Eth can soften its replies. Standard server logs with IP addresses are kept by our hosting provider for a short time.

Cookies: only the ones needed to keep you signed in (Supabase session cookies, marked HttpOnly). No advertising or analytics cookies, so there is no cookie banner. The site's language rides in the address, not a cookie.

What we don't collect

No advertising identifiers, no third-party analytics scripts, no tracking across other sites, no sale of data to anyone, ever.

Why

To run the log, to make Eth better at your food (house learning is per account), and, in aggregate only, to improve default estimates for dishes several households have logged. Aggregate learning uses hashed account ids, dish names and nutrition numbers; it never includes your messages, photos or anything identifying.

Who processes it

Supabase hosts the database and authentication (US). Vercel hosts the app. Anthropic receives the text and photos you send Eth to produce replies; their API terms don't allow training on that data. Stripe handles payments. Resend sends the reminder email if you turn reminders on; it receives your email address and the one-line reminder, never your log. Each one only gets what it needs for its job. Dictation uses your browser's own speech recognition; on Chrome that audio is handled by Google, not by us, and never reaches our servers as audio.

How long we keep it

Your log stays as long as your account does. Entries you remove are kept out of sight for 30 days, then deleted along with their photo; if you removed one by mistake in that window, write to us and we restore it. When you delete your account, everything (entries, messages, photos, learned house dishes) is removed within about a week (a seven-day grace period, then the nightly purge) and your subscription is cancelled. Stripe keeps the payment records the law requires it to keep.

Guest accounts (no email) that never logged anything are removed after 60 days of inactivity; guest accounts with entries are removed after 180 days without a sign-in, a log or a settings change, since without an email there is no way back to them. Add an email in You → Account to keep a log for good. The model-call ledger (sizes and timestamps, no text) runs on its own 90-day clock and is not tied to you once the account is gone.

Your rights

Download everything you logged (entries, messages, house dishes, go-tos, kept photos, kitchens, settings, safety events and the model-call ledger) from You → Your data → Download. Delete everything from You → Your data → Delete account. Change your language, time zone and photo setting from the same sheet. To move your log to a different email, write to us. For anything else, including rights under GDPR, CCPA or Peru's Ley 29733, write to hello@ethnocal.com.

Security

Data is encrypted in transit and at rest. Access is scoped per account at the database layer, so one account cannot read another's rows. Sign-in links expire after one hour.

Children

EthnoCAL is for adults 18 and older. If you believe a minor has an account, email us and we'll remove it.

Changes

If this policy changes in a way that matters, we'll tell you in the app or by email first. Questions: hello@ethnocal.com.