Privacy Policy

1. Who we are and what this covers

Cravable is run by [Cravable’s legal name and form], [mailing address]. This policy covers cravable.ai, cravable.vercel.app, our emails, and anyone who uses them: people who look around, customers, people who apply to cook, and the people who work in kitchens on Cravable.

Kitchens on Cravable are independent businesses. Our Kitchen terms limit what they may do with what we share with them, and their own privacy policies cover their own records.

While Cravable is a test build, some people, kitchens and craves are samples and payments are simulated. Real sign-ups, and what real people type, are still personal information, and this policy covers them.

2. What we collect

What you give us

• Account: your name, email address, your password if you choose one (kept only in scrambled form by our sign-in provider), and your area. If you add them: an address with its delivery details (a second line, how to hand an order over and a note for a courier) and a phone number. When you start, join, reserve or order a crave with a street address in Your address, we save it here as your delivery address. With Continue with Google, Google gives us your name, email address, Google account ID and profile picture link. We never see your Google password.
• Profile and choices: your avatar, whether your first name shows on craves you start, how a kitchen knows you at pickup (your first name or the code only), your tastes (the cuisines and foods you love, how much heat, and anything you skip, such as pork or dairy), and your choices for updates, emails, pickup reminders and Help improve Cravable.
• Craves you start, and drafts: what you tell the dish guide; the dish card it writes with you (the dish’s name, its description, the story behind it, the diets you need and anything to leave out, which can include your allergies); the pictures you choose; the cuisine; your area and where you’d pick up, to about a kilometer; and the date, portions, budget and times you’d like.
• Craves you join: when you joined, the times you’d like, the portions you’d like and the most per portion you agreed to, and the card you joined with, which Stripe saves so we can place a hold on it, or charge it, when a kitchen takes the crave. We keep it with the crave until you leave it, remove the card in Settings or delete your account.
• What you say to the mic, only when you tap it: your browser asks you first. It records from your tap until you stop, go quiet or reach 30 seconds, and Gemini, by Google, writes the recording down. We don’t keep the recording: only its words are left, in the box, for you to check and send.
• Reservations, orders and payments: portions, half hour, price, tax, credits, pickup code, whether you’ve picked up, and whether you came from a link the kitchen or someone else shared. Our payment provider, Stripe, collects your card details: we get a reference, the card’s brand and last four digits, and whether a payment worked. [In the test build, payments run in Stripe’s test mode, where only test cards work and nothing is charged.]
• Invites and credits: who invited you, your invite link and the credits you earn and use.
• Messages and reports: what you send us by email or report about an order, including any photos.
• If you apply to cook: your name, email address, phone number, kitchen address and what you tell us about your cooking.
• If you cook with us: your name, email address and role in the kitchen; the kitchen’s business details, permits, insurance, cooking and pickup addresses; and your offers (with any photo of the dish you add, kept without where it was taken), statements and payout status. Stripe collects the bank, identity and tax details it needs for payouts; we see whether your payout account is ready.

What we collect automatically

• Your connection: your IP address and browser details reach our host, Vercel, with every request, and its logs keep them for a short time. Vercel also tells us the city your connection suggests. Until you pick a place, home’s feed and the AI search put the craves closest to that city first, without keeping it. When you sign up, we use it for your area, unless you picked a place or joined a crave in another; you can change it.
• Keys for limits: to count how much people who aren’t signed in use the dish guide, the AI search and the mic, or send kitchen applications, we keep a key made from the IP address and a secret, never the address itself. We delete the key after 30 days. To limit the codes we email, wrong passwords and new accounts, we keep keys made the same way from the email address typed and the IP address, and delete them after 2 days.
• AI use and limits: when and how you used the dish guide, the AI search, the mic and AI pictures and what each use cost, and when a limit stopped you, so the limits work and can be set fairly.
• Your location, only if you tap Use my location: your browser asks you first. We use it during your visit to sort craves near you and to name your neighborhood, and keep only the area, to about a kilometer. In Your address, it also finds the street address where you are; if you then start, join, reserve or order a crave, that address is saved as your delivery address, and the crave keeps only its neighborhood.
• What happens on Cravable: a log of each change, such as a crave sent, a reservation made or a payment collected, and which account made it, for security, support and disputes.
• Cookies and device storage: what we keep on your device is on our Cookies and storage page.

We don’t use analytics, advertising pixels, session recording or anything that tracks you across other sites. Help improve Cravable is off, and nothing is counted yet.

3. How we use it

• To run your account and show you craves nearby, with what you love first.
• To help you describe a dish and draw it, to answer searches, and to write down what you say to the mic.
• To check how the dish guide and the AI search answer, so we can make them better: a copy of each conversation with them, kept for 30 days without your name, account or device, is read by our own checks, which use rules, not AI.
• To check the AI pictures: each picture’s check, with the dish card’s facts it read, is kept for 30 days, and each morning Claude looks again at the day’s pictures, to catch any the check got wrong.
• To show a crave to kitchens that might make it, and to run offers, reservations, payments, pickups, refunds and credits.
• To send you updates about craves you started, joined or reserved, by email and under the bell, one email when a crave you joined or reserved is almost there, and pickup reminders, each if it’s on.
• To review kitchen applications, check kitchens and pay them.
• To answer you, look into problems and keep people safe, including food safety.
• To prevent fraud and abuse, keep Cravable secure and fix what breaks.
• To keep the records the law asks of us, and to enforce our Terms of Service.

We send suggestions or news only if you turn that on in Settings. We don’t make decisions about you by computer alone that have legal or similar effects: AI suggests and describes, and people at Cravable approve kitchens and offers.

4. What’s public

• Craves you start are public: anyone can see the dish, its description, its pictures, the diets it asks for and anything it leaves out, its cuisine, area and pickup point (to about a kilometer), the date, portions and budget, and how many people joined or reserved. Your first name and avatar show on it, unless you choose to appear as A neighbor in Settings, under Privacy. Crave pages can be shared, and found by search engines.
• Diets and allergies on a crave are public too. A crave that asks for halal or kosher food can say something about the faith of the person who started it, and one that leaves out an allergen says something about their health. If you’d rather not be linked to that, choose A neighbor before you send the crave.
• Craves you join or reserve show only in counts: 15 of 40 portions reserved, never who.
• Times people would like show only as counts: Fri 6–7 PM, by 8 people.
• Invites: the friend who invited you sees your first name and avatar (or A friend, if you’d rather not show your name), when you joined and whether your first meal was picked up, never what you ordered.
• Kitchens show their name, what they cook, and where to pick up. A home kitchen’s address shows only to people who reserved with it or ordered from it.
• If you delete your account, craves you started stay up for the people who joined them, as A neighbor’s crave, without your name.

5. Who we share it with

Kitchens. A kitchen sees a crave’s brief when it’s invited: the area, the date, portions and budget people would like, the heat, the diets its starter needs, and its dish card, including anything to leave out and the questions the customer asked. It sees how many people picked each time, and how many would be reserved at each price when Cravable approves its offer, without who. When you reserve or order, the kitchen making your meal sees your pickup code, portions and half hour, and your first name unless you chose the code only. If you report a problem with its food, we share what’s needed to sort it out. Kitchens never see your email address, phone number or address, and our Kitchen terms let them use what they see only for your order.

Companies that run parts of Cravable for us. They work under contract and may use your information only to provide their service to us.

Supabase

Our database, sign-in, file storage and live updatesWhat it gets: Everything in your account and the pictures; your browser asks it directly for the feed, and we pass on your IP address when you sign in, so it also gets your IP address

Cloudflare

Checks that a person, not a bot, is signing in, asking for a code, setting a new password, applying as a kitchen, or using the dish guide, the AI search and the mic without an account (Turnstile)What it gets: Your IP address and details of your browser, when one of those checks runs

Vercel

Hosts the websiteWhat it gets: Each request to the site, with your IP address and browser details

Sentry

Tells us when something on Cravable breaks, so we can fix itWhat it gets: The error and where in our code it happened, the page’s address without anything after its ?, your browser and device type, and your account’s ID (a random number) if you’re signed in, and the note you write when you use Report a problem. Never your name, email address, address or anything else you type. Reports reach it through our address, and it doesn’t keep IP addresses

Stripe

Card holds, payments, refunds and kitchens’ payouts [once payments are live]What it gets: Your card and payment details; kitchens’ bank, identity and tax details

GitHub

Runs our daily checks of how the dish guide and the AI search answer, and of the AI picturesWhat it gets: For 30 days: the replies the check finds worth a look, with any answer you tapped before them, but never your name, email address, account or what you typed; and the address of each day’s AI pictures, which holds your account’s ID (a random number), with each one’s check and the dish card’s facts, but never your name or email address

Resend

Sends our emails, and tells us when one can’t be delivered or is marked as spamWhat it gets: Your name, email address and the email; kitchen applications sent to our team

Anthropic

The dish guide, the AI search and the check on AI pictures (Claude), and our daily checks of themWhat it gets: What you type to them (to look a dish up, Claude’s web search gets its name and your newest message), your dish card and the AI pictures drawn of it, your area’s name with a search, and facts about open craves, but never your name, email address or account. Our daily checks read what GitHub gets for them, and open each day’s AI pictures by their address

Google

Continue with Google, AI pictures and writing down what you say to the mic (Gemini), and the street address search in Your address (Google Maps)What it gets: Sign-in details; a description of the picture to draw, with the dish’s name and origin; the recording when you use the mic; what you type in Your address, the address you pick, your saved address (to find it on the map) and your exact point when you use your location there. Our server asks Google Maps, so it never gets your IP address

Photon, by komoot

Place search for your areaWhat it gets: What you type to search (or your area’s name, to find it on the map), a point rounded to about a kilometer when you use your location, and your IP address, since your browser asks it directly; and the point of a street address the U.S. Census Bureau finds, from our server, to name its neighborhood

U.S. Census Bureau

Finds a street address Google Maps hasn’t got, and the ZIP code of an address we save that came without oneWhat it gets: A street address with its city or ZIP code, or the point of an address; our server asks it, so it never gets your IP address

The law and safety. We share information when the law requires it, such as a court order or a health department’s investigation, or when we need to protect someone’s safety, stop fraud or defend Cravable’s rights. We share only what’s needed.

If Cravable changes hands. If Cravable is merged, bought or reorganized, your information may go to the new owner, who must keep this policy’s promises for it. We’ll tell you before it’s used in a new way.

With your OK. Anything else, we’ll ask you first.

6. Sensitive information

Some of what you tell us can be sensitive: a diet that suggests your faith, allergies or health details you mention to the dish guide or in a report, your exact location when you tap Use my location, and your sign-in details.

We use sensitive information only to give you what you ask for (finding a kitchen that cooks halal, say, or describing a dish without peanuts), to keep Cravable safe and secure, and as the law allows. We don’t use it to work out things about you or for advertising. Please don’t share health details beyond what a dish needs, and never send us medical records.

7. How long we keep it

Your account and profile

While your account is open

Drafts, with their dish guide conversation

Until you send or delete them, or delete your account. Once a crave is sent, its draft keeps only the dish card

The copy of conversations with the dish guide and the AI search, for checking their answers

30 days, without your name, account or device

The check of each AI picture, with the dish card’s facts it read

30 days

Craves you started

As long as they’re on Cravable. After you delete your account, without your name

Pictures made for you that you didn’t choose

[30 days]

Reservations, orders, payments, refunds and credits, and the log of changes behind them

7 years after the order, for tax and accounting

Updates and the record of emails we sent you

While your account is open

Records of AI use and limits

While your account is open. For people who aren’t signed in, without the key after 30 days

The key made from an IP address

30 days

Error reports

30 days, then Sentry deletes them

Keys for the limits on codes, passwords and new accounts

2 days

Reports and messages to us

[2 years] after they’re settled, or longer for a safety or legal matter

Kitchen applications

[12 months] after we reply if the kitchen doesn’t join; with the kitchen’s records if it does

Kitchens’ permits, insurance and statements

While the kitchen cooks with us, and 7 years after for financial records

Backups of our database

[Up to 7 days], then replaced

What’s kept on your device

See Cookies and storage

When you delete your account:

• reservations still waiting on their minimum are cancelled, their holds released, and you leave the craves you joined,
• your profile goes: your name, email, area, address and delivery details, phone, tastes, avatar and choices,
• your drafts, updates, invite link and cart are deleted, and so are pictures made for you that no crave shows,
• craves you started stay up as A neighbor’s crave, without your name, for the people who joined them,
• we keep only the records the law asks of us (reservations, orders and payments), under Deleted account.

You can’t delete your account while a confirmed meal of yours is still to be picked up; you can once it’s served.

8. Your choices and rights

Wherever you live, you can:

• See and change your details in Account and Settings.
• Get a copy with Download my data in Settings, under Privacy.
• Delete your account in Account, at any time.
• Correct anything that’s wrong, or ask us what we hold about you, by email.
• Turn off update emails in Settings, under Notifications, or with the link in any update email. Emails about the orders we reserve for you, a payment problem, an expired hold or a refund still come, because they’re about your money, and so do pickup reminders and the email when a crave you’re in is almost there, unless you turn them off too. If an email to you can’t be delivered, or you mark one as spam, we turn update and almost there emails off, and you can turn them on again in Settings.
• Stop sharing your location in your browser’s settings, and type an area instead.
• Stop Cravable using your microphone in your browser’s settings, and type instead.
• Change your cookie choice in Settings, under Privacy, or on our Cookies and storage page.

To ask us, email privacy@cravable.ai from the address on your account. If you write from another address, or someone asks for you, we’ll check it’s really you, using only what we already have; never send us a password or a card number. We confirm we’ve got your request within 10 business days and answer within 45 days. If we need longer, up to 45 more days, we’ll tell you why. It’s free. If we say no to any part, we explain why, and you can reply to have a person look at it again.

We won’t treat you differently for using these rights.

9. If you live in California

California law gives you the rights in section 8, plus the right to opt out of the sale or sharing of your personal information and to limit the use of sensitive personal information. We give everyone the same rights, whether or not the law requires it of a business our size.

Sale and sharing. We don’t sell personal information, or share it for cross-context behavioral advertising, and haven’t in the past 12 months. We don’t knowingly sell or share the information of anyone under 16. So there’s nothing to opt out of; if that ever changes, we’ll add a Do Not Sell or Share My Personal Information link first, and honor Global Privacy Control.

Sensitive personal information. We use it only for the purposes California law allows without a right to limit (section 6), so there’s no Limit the Use of My Sensitive Personal Information link.

What we’ve collected in the past 12 months, in the categories California law uses:

Identifiers

Name, email address, account ID, IP address, the key made from itShared with: Our providers; kitchens get a first name and pickup code

Customer records

Address, phone number, payment referencesShared with: Our providers

Commercial information

Craves, reservations, orders, credits, refundsShared with: Our providers; kitchens get your order

Internet activity

Requests to the site, AI use, the log of changesShared with: Our providers

Geolocation

Your area and pickup point, to about a kilometer; your device’s location for a visit, if you share it, and the street address found there in Your addressShared with: Our providers; the public, for a crave’s area and point

Sensory information

Photos you send us with a report; what you say to the mic, which we don’t keepShared with: Our providers; the kitchen, for a report’s photos, if needed to sort it out

Professional information

For kitchens and applicants: business details, permits, insuranceShared with: Our providers

Inferences

What your feed puts first, from your tastesShared with: Nobody

Sensitive personal information

Sign-in details; device location; diets that suggest faith; allergies and health detailsShared with: Our providers; kitchens get a crave’s diets and what to leave out; the public, for a crave you start

Where it comes from, why we use it and how long we keep it are in sections 2, 3 and 7. We disclose personal information only for the business purposes in section 5.

Give 10%, get 10% (notice of financial incentive). When a friend signs up with your invite link, we record that they came from you, so their first order is 10% off and, once that meal is picked up, so is your next one (each up to $10, for 90 days, up to 5 credits in 12 months). This uses your and your friend’s account details and whether the first meal was picked up. You opt in by sharing your link or signing up with one, and you can stop at any time by not sharing it, or by deleting your account. We think the information involved is worth about what the credit is worth to you, up to $10, which is what the program costs us per friend. The full rules are in our Terms of Service.

Shine the Light. We don’t share personal information with other companies for their own direct marketing.

Authorized agents. Someone can ask for you with your signed permission. We may ask you to confirm the request with us directly.

10. Security

We protect your information with HTTPS everywhere, passwords kept only in scrambled form, database rules that let each account read only what it should, and access for Cravable’s team only where their work needs it. No system is perfectly secure, so please use a strong password you don’t use anywhere else.

If we learn that someone got your personal information who shouldn’t have, we’ll tell you, and the authorities, as the law requires.

Found a security problem? Email security@cravable.ai. Please don’t access other people’s data, and give us a reasonable time to fix it before you share it. We won’t pursue anyone who reports a problem in good faith this way.

11. Children

Cravable is for people 18 and over. We don’t knowingly collect information from anyone under 18. If you think a child has signed up or told us something, email privacy@cravable.ai and we’ll delete it.

12. Where your information is kept

Cravable is run from the United States, and our providers keep and process your information mainly there. Some of them may process it in other countries, under their own safeguards.

13. Changes to this policy

When this policy changes, we update the date at the top. Before a change that matters, such as a new use of your information or a new kind of company getting it, we tell you by email or on the site, and ask for your OK where the law requires. We don’t use a new version to undo a promise we made about information we already have. Earlier versions are available on request.

14. Contact

Questions or requests: privacy@cravable.ai, or write to [Cravable’s legal name], [mailing address]. You can also ask for this policy in another format, such as plain text or large print.