CutCravePrivacy Policy
CutCrave is operated by CutCrave Library LLC. Updated September 6, 2026. Effective September 6, 2026.
Browsing and accounts
Browse without an account. Email authentication uses Supabase; Apple or Google identity is used only if that provider is enabled. We store your account ID, email and chosen profile details. We do not ask for date of birth, sex, health history or a calorie diary.
Contributions and visibility
We store saves, finds, recipe suggestions/PDFs, photos, reviews, ratings, helpful votes, follows, reports and your community-term acceptance version and time. Contributions remain private to you and authorized staff until approved. Public profile, social handles, attribution, saved products and follow lists follow your visibility settings. Private avatars are not displayed publicly. Approved review content and ratings may be public. Do not put private or medical information in contributions.
Optional usage analytics
First-party analytics starts enabled and can be disabled in Profile → Privacy & usage analytics, including as a guest. It uses a random installation identity, not your account ID, with platform, app version and coarse device class. It records meaningful impressions, opens, navigation, searches, saves, shares, Buy clicks and foreground engagement. There are no third-party advertising trackers or health profiles. Potentially sensitive search phrases are conservatively discarded. Eligible food-search phrases are shown only in restricted aggregate reports after enough distinct installations use them.
Supplements/OTC privacy
Medical browsing records only daily section/product impression, open and Buy-click counters. These contain no medical search terms, account/device/session identity, navigation trails or cohorts.
Retention and privacy controls
Usage events expire after 90 days; retained search phrases after 30 days. Queries exclude expired data immediately, with bounded physical cleanup daily. Inactive analytics credentials expire after 90 days. Opt-out clears queued events; current-device export and erasure are available in Privacy & usage analytics. Account records remain while needed to provide your account and are removed through the deletion process. Limited security, abuse-prevention, moderation and editorial audit evidence may remain for legitimate operational or legal purposes without a live account reference. Infrastructure logs and backup copies follow provider retention schedules; removal from the active service does not immediately erase existing backups or copies others have downloaded.
Providers and external destinations
Supabase processes authentication, database and file storage. Vercel hosts the website and API. Resend delivers transactional authentication emails through the configured mail service and processes delivery information. Enabled Apple/Google sign-in provides the basic identity information needed to authenticate; we do not request access to your mail, contacts or files. Infrastructure providers may process network addresses and operational logs; CutCrave rate limits store short-lived derived network buckets, not raw IP addresses. These providers process information to operate the service. Retailer and social links leave CutCrave and follow the destination policy. Retailers may recognize affiliate links. CutCrave does not receive your retailer payment details.
Export, deletion and contact
Profile → Account settings & privacy → Account export & deletion offers supported account records, excluding credentials, private editorial notes and image bytes. Current-device analytics export and erasure are in Privacy & usage analytics. Deletion removes account visibility before retried Auth/Storage cleanup. You may request access, correction or deletion and raise a privacy concern through Support at cutcrave@gaufoka.resend.app. We verify account ownership before disclosing or removing private data. Applicable rights depend on your location; you may also contact your local privacy authority. See Delete Account for the process and retained-data limitations.
Security, device permissions and website use
Connections use HTTPS. Access to private account data and unpublished files is restricted by account ownership and staff permissions. We use safeguards appropriate to the service, but no system is risk-free. Photo/camera/document access is used when you choose to contribute or update an image; permissions can be managed in device settings. The public information website has no advertising trackers. Staff sign-in uses authentication cookies. Information may be processed in the regions used by our infrastructure providers, which may differ from where you live.
Children and policy changes
CutCrave is not designed for children and does not request a date of birth. If you believe a child has supplied personal information, contact Support so we can investigate and take appropriate action. We update this policy when the service or its data practices change and show the update date here. Material changes requiring notice or consent will be handled as required by applicable law.