Privacy Policy

Last updated: April 11, 2026

SafePlate ("we", "our", "us") operates the SafePlate mobile application and the website at mysafeplate.app. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Data Type	Purpose	Stored Where	Retention
Email address	Account creation and authentication	AWS Cognito & DynamoDB	Until account deletion
Allergy profile	Personalized menu analysis	DynamoDB (encrypted at rest)	Until account deletion
Location (runtime only)	Finding nearby restaurants	Not stored on our servers	N/A
Menu analysis results	Caching for performance	DynamoDB	30 days (auto-deleted)
Feedback (thumbs up/down)	Improving analysis accuracy	DynamoDB	1 year (auto-deleted)

We do not collect your date of birth. The age verification during signup only checks that you are 13 or older — the birth year you enter is not stored.

2. How We Use Your Information

To provide personalized allergen analysis of restaurant menus
To find restaurants near your current location
To improve the accuracy of our AI analysis through aggregated, anonymized feedback
To communicate with you about your account (e.g., password resets)

3. AI Processing

When you request a menu analysis, your allergen list is sent to our AI provider (OpenAI) to classify dishes. This data is:

Sent only for the purpose of generating your analysis
Not stored by OpenAI or used for AI model training
Transmitted over encrypted connections (TLS)

4. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with:

AWS — infrastructure hosting (encrypted at rest and in transit)
OpenAI — AI menu analysis (allergen list only, not stored)
Google Places — restaurant discovery (your location is sent directly from your device)

5. Your Rights

You have the right to:

Access your data — use "Export My Data" in the app's Profile screen
Delete your data — use "Delete My Account" in the app's Profile screen. This permanently removes all your data from all our systems.
Correct your data — edit your allergy profile at any time
Opt out of data sale — we do not sell your data. See "Do Not Sell My Information" in the app.

These rights apply regardless of your location. We comply with GDPR (EU), CCPA (California), and applicable state health data privacy laws.

6. Children's Privacy

SafePlate is not intended for children under 13. We require age verification during signup and do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it.

7. Security

We protect your data with:

Encryption at rest (AES-256) and in transit (TLS 1.2+)
AWS Cognito for secure authentication
API keys stored in AWS Systems Manager (SSM) SecureString parameters
Least-privilege access controls on all backend services
Input validation and SSRF protection on all endpoints

8. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via the app or email. Continued use of SafePlate after changes constitutes acceptance.

9. Contact Us

For privacy questions or data requests, contact us at privacy@mysafeplate.app.