Privacy Policy

Effective date: 2026-06-09 · Last updated: 2026-06-09 · Version 1.1

This Privacy Policy describes how Heetae Kim ("we", "us", "Jann") collects, uses, stores, and shares personal information when you use the Jann mobile application (the "App"). This English version is provided for users outside the Republic of Korea; the Korean version remains the controlling text where any conflict arises (한국어 보기).

TL;DR. Jann processes ingredient photos entirely on your device. Only your AI-recipe requests (anonymized ingredient names, never photos) are sent to OpenAI, with your explicit one-time consent. We do not sell your data, do not run cross-app tracking, and serve only non-personalized ads.

1. Data Controller

Heetae Kim, individual developer
Contact: cobokk2123@gmail.com
Support: cobokk2123@gmail.com
Location: Republic of Korea

2. What We Collect and Why

Data type	Purpose	Legal basis (GDPR Art. 6)	Retention
Email, name, photo URL (from Apple / Google / Kakao sign-in)	Account identification	Performance of contract	Until account deletion
Ingredient list (text, not photos)	AI recipe generation	Consent (one-time AI modal)	30 days at OpenAI; deleted from our servers immediately after response
Photos for ingredient recognition	On-device YOLO inference only	—	Photos never leave your device
Device IDFA / Ad ID	Non-personalized Google AdMob	Legitimate interest (npa=1)	Per Google AdMob policy
App version, OS version, locale (in error logs)	Crash diagnostics	Legitimate interest	90 days

3. International Data Transfers

If you reside in the EU, UK, or Switzerland and use the AI recipe feature, your anonymized ingredient list is transferred to OpenAI, L.L.C. (United States) via a Cloudflare Workers proxy operated by us. OpenAI is committed to the EU-U.S. Data Privacy Framework (DPF); transfers rely on this DPF certification together with Standard Contractual Clauses (2021/914/EU) where applicable. We do not transfer any image data internationally.

4. Your Rights

Depending on your jurisdiction, you have the following rights:

EU / UK (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection, and the right to lodge a complaint with your local data protection authority.
California (CCPA / CPRA): know, delete, correct, opt-out of "sale" or "sharing", and limit use of sensitive personal information. We do not sell your personal information.
Republic of Korea (PIPA): access, correction, deletion, and consent withdrawal.
Other jurisdictions: users in China (PIPL), Japan (APPI), Brazil (LGPD), Canada (PIPEDA), or other regions may have additional rights under local law. We honor verifiable requests on the same email channel below.

To exercise any right, email cobokk2123@gmail.com with subject line "Privacy Request — [region]". We respond within 30 days.

5. Account Deletion

You can delete your account in-app at Me → Delete account. This permanently removes your stored ingredients, saved recipes, and profile. Deletion is irreversible and cannot be restored.

6. Children

Jann is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect data from such children. If you believe a child has provided us data, contact us and we will delete it.

7. Cookies and Tracking

The mobile app does not use cookies. We do not perform cross-app or cross-website tracking; Apple App Tracking Transparency (ATT) is not requested because we do not track. AdMob serves only non-personalized ads (parameter npa=1).

8. Third-Party Services

The following processors may receive limited data:

Apple Inc. — Sign in with Apple (account)
Google LLC — Google Sign-In, Firebase Auth, Google AdMob (non-personalized)
Kakao Corp. — Kakao login (Korean-locale users only)
OpenAI, L.L.C. — AI recipe text generation (ingredient names only, with explicit consent)
Cloudflare, Inc. — Edge proxy to OpenAI; no persistent storage

9. Security

We transmit data over HTTPS only (App Transport Security enforced). Apple Sign In uses CSPRNG-generated nonces with SHA-256 hashing. Secrets are managed via environment variables (Cloudflare Workers, Firebase Cloud Functions); the App Store binary itself contains no API keys.

10. Changes to This Policy

Material changes will be announced via the App Store What's New screen and in-app notice at least 7 days before they take effect.

11. Governing Law & Dispute Resolution

This Privacy Policy is governed by the laws of the Republic of Korea, except where mandatory local consumer-protection or data-protection law applies to you. You may bring claims in the courts of your residence or in the Seoul Central District Court.