Privacy Policy

I collect information you provide and information generated when you use ForkOut:

• Account information: Your email address. If you sign in with Apple or Google, ForkOut receives the name and email address they share. With Sign in with Apple, you can hide your email, and ForkOut gets a private relay address instead.
• Profile and health details: What you share during setup and in settings, such as your goals, gender, date of birth, height, weight, diet, allergies, foods you avoid, cooking effort, budget, and other details that help Otto plan for you. Otto uses these to plan your meals and set nutrition targets. You can change them in the app at any time.
• Meals and nutrition: Your meal plans, meals you log or mark as eaten, nutrition estimates, and saved favorites.
• Chats with Otto: Your messages to Otto (the in-app AI assistant), photos you attach, and voice input. Messages and photos are saved to your chat history; photos are stored privately. Voice recordings are turned into text and aren’t stored by ForkOut. Only the text is kept.
• Location (optional): If you allow it, your device’s precise location while you use the app, to find places nearby. ForkOut doesn’t track your location in the background, and location isn’t required.
• Purchases: If you subscribe to Pro, Apple processes the payment. ForkOut receives your subscription status, such as plan, renewal, and expiry dates, but never your card or payment details.
• Usage data: How you interact with the app (for example, features used, session activity, and device or app version information) to help improve reliability and the product. Product analytics events are pseudonymous and tied to an internal account ID. They do not include your email, name, date of birth, body measurements, precise location, or the text of messages you type.
• Diagnostics: Crash reports and error details, such as device model, operating system and app version, and what failed, to find and fix bugs. They don’t include your name or email.
• Notifications and time zone: If you enable notifications, a device token is stored so ForkOut can send the reminders you choose. Your time zone is stored so check-ins arrive at the right local time.

When you register for early access on forkout.app, I collect the email address you enter and a few details about the request:

• Registration details: your email address, the page and form you used, and, if present, the campaign tags in the link you followed (such as utm_source) and the referring website. Campaign details are kept in your browser’s session storage until you close the tab, and the website does not set advertising cookies.
• Abuse prevention: your IP address and browser user agent, stored with the registration and used to rate-limit and block automated or abusive sign-ups. Requests are rate-limited by IP address and by a one-way hash of the email address.
• Security check (only if enabled): if Cloudflare Turnstile is switched on, the form runs a privacy-preserving check in your browser, and Cloudflare receives your IP address and browser signals to tell people from bots.
• Website analytics: pseudonymous page views and form events (for example, that a form was submitted), measured with PostHog and Vercel Web Analytics, and page performance measured with Vercel Speed Insights. PostHog on the website keeps its identifier in memory only, so it sets no cookie, and these events never include your email address.

I use registration data to send your early access invite and related ForkOut updates, and to keep the list free of abuse. I don’t sell it or use it for advertising. Registration records are kept until ForkOut’s early access ends or you ask to be removed, whichever comes first; IP addresses and user agents are kept with the record for the same period. To be removed, reply to any ForkOut email or write to support@forkout.app.

I use your information to:

• Provide and personalize meal and restaurant recommendations.
• Power Otto, the in-app AI assistant, so it can understand your requests and respond in context.
• Save your meal plans, favorites, and conversation history across sessions.
• Set nutrition targets and estimate nutrition for meals you log.
• Send optional push notifications you have enabled.
• Process subscriptions and unlock Pro.
• Maintain, secure, and improve ForkOut.

I do not sell your personal information. I use your data to operate and improve ForkOut, not to build advertising profiles. I don’t use your chats, photos, or health details for advertising.

I rely on trusted third-party providers to run ForkOut. They handle data only as needed to provide their services:

• Supabase: Authentication and database hosting for accounts, meal plans, favorites, and chat history.
• Amazon Web Services (S3): Private storage for photos you attach in chat, hosted in Japan.
• Google Places: Restaurant search and place details. Receives your location when you search nearby.
• Spoonacular: Recipe data and meal inspiration where applicable.
• Google Gemini and OpenAI: Process your messages and photos to generate Otto’s responses. OpenAI also turns voice input into text.
• Apple and RevenueCat: Apple processes App Store payments. RevenueCat manages subscription status and receives an internal account ID and your purchase history, not your payment details.
• Sign in with Apple and Google Sign-In: Sign-in, when you choose one of them.
• Sentry: Crash and error reporting for the app and API. It receives technical details such as device model, app version, and error traces.
• Expo: Delivers push notifications through Apple’s push service when you opt in.
• Resend: Transactional email delivery. Resend receives your email address and the content of messages ForkOut sends you, such as account confirmation, password reset, a one-time welcome email, and your early access invite.
• PostHog: Product analytics processor. PostHog receives pseudonymous usage events tied to an internal account ID (for example, that a meal plan was generated or a paywall was viewed), plus app version, platform, and coarse country or region derived from the request IP. PostHog does not receive advertising identifiers, and ForkOut does not use this data for cross-app or cross-site tracking or to sell personal information. Events are hosted in the United States (`us.i.posthog.com`). On forkout.app, PostHog also receives pseudonymous page views and form events, as described above.
• Vercel: Hosting for the website and API, edge security and rate limiting, Web Analytics, and Speed Insights. Vercel processes IP addresses and request details to serve and protect the site.
• Cloudflare Turnstile (only if enabled): A bot check on the early access form. Cloudflare receives your IP address and browser signals during the check.

These providers are bound by their own privacy policies and by terms requiring appropriate data protection.

The providers above may store and process your information on servers located in countries other than your own, including the United States and Japan. Where this happens, I take reasonable steps to ensure your information remains protected in line with this Privacy Policy and applicable law.

I retain your information for as long as your account is active and as needed to provide ForkOut. If you delete your account or request deletion, I remove or anonymize your personal data within a reasonable period, except where limited records must be kept for legal, security, or backup purposes. Product analytics events sent to PostHog are retained for up to one year on PostHog’s free plan. Photos you attach in chat are kept with your chat history until you delete your account. Voice recordings aren’t stored.

You can delete your account in the ForkOut app: open Profile → Privacy and tap Delete account. This removes your profile, meal plans, favorites, chat history and photos, and other account-linked data from active systems, subject to the retention limits above.

Deleting your account doesn’t cancel an App Store subscription; cancel it in your Apple ID settings. If you can’t access the app, email support@forkout.app with the subject “ForkOut account deletion request.”

Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal data, or to object to certain processing. You can exercise these rights as follows:

• Update preferences and profile details in the app at any time.
• Turn off location, notifications, or microphone access in your device settings at any time.
• Request access to or deletion of your data by contacting me (see below).

ForkOut is not directed to children under 13, and I do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact me and I will take steps to delete it.

I use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, so absolute security cannot be guaranteed.

I may update this Privacy Policy from time to time. The “Last updated” date will be revised when I do. Continued use of ForkOut after changes means you accept the updated policy.

Questions about this Privacy Policy or your data? Email support@forkout.app.

See also the Terms of Service.