Privacy Policy

Information we process

Account and profile information includes your email, identifiers supplied by sign-in providers, username, display name, bio, avatar and selected sign-in method. Firebase Authentication handles passwords; Annona does not store readable passwords.

Content you provide includes food photos, categories, dish names, notes, moods, capture or journal dates, dining companions, place names and coordinates you choose to save, plus friendships, likes, comments, private messages, reports and blocks.

Service information includes notification preferences, push tokens, an installation identifier, language, widget preferences, collection progress, coins and item receipts, passkey public credentials, and moderation and account-security records. Cloud providers may also process technical records such as connection IP addresses, request times and errors to operate and protect the service.

Purposes and sharing

We use information to authenticate accounts, save and organize food memories, provide friend interactions and notifications, sync collections and wallets, handle reports, moderate content, and maintain security and reliability.

New moments are shared with friends by default; older moments follow their saved visibility. Private messages are available to conversation members, while moments and comments follow access permissions. Profile names, usernames and avatars support friend searches, invitations and interactions.

Annona private messages are not end-to-end encrypted. Authorized personnel may access relevant content when necessary for reports, security incidents or service maintenance. We cannot guarantee remote removal of copies, screenshots, delivered notifications or exported files saved by other people.

Image review and service providers

Before uploading a food photo or avatar, the app explains and asks for consent to send that image to Google Cloud Vision SafeSearch to check for potentially inappropriate content such as sexual or violent imagery. Authorized reviewers may manually review pending or reported content. Automated decisions can be wrong; email us to request review. If you decline, that upload does not start; features that do not require photo uploads remain available.

Firebase and Google Cloud provide authentication, databases, photo storage, backend processing and image review. Expo Push Service and Apple APNs deliver push notifications. If you choose Apple or Google sign-in, that provider verifies your identity through its own process. iOS place search uses Apple MapKit and sends your search text to Apple. Providers may process information outside your country or region.

Annona currently does not offer advertising or cross-app advertising tracking. If we introduce processing for a different purpose, we will update this information and request consent when needed.

Permissions, devices and passkeys

The camera captures meals and the photo library imports food photos or avatars. Location supports optional current-location and map records; you can decline it and enter a place manually. Manage notification permission and categories in Annona or iOS Settings. Imported photos may include capture dates or locations that the import flow reads for you to confirm or remove.

Widgets store necessary thumbnails and text snapshots in an App Group to display friend photos and journal status. Signing out or switching accounts clears the shared snapshot. Old photos on an offline device may remain until the next sync.

Passkeys use the operating system authenticator, which may use Face ID, Touch ID or a device passcode. Annona receives public credentials and verification results, not face images, fingerprints or biometric templates. Your system or credential provider may sync passkeys according to its settings.

Retention, deletion and your choices

Account and journal information is retained to provide the service until you delete content or your account. Reports, security and handling records may be retained as necessary to address an incident. Technical logs, backups and existing exported copies may be removed later under their respective mechanisms; we cannot promise instant removal of every copy.

Incomplete upload tickets usually expire after about 24 hours. Media awaiting manual review is usually retained for 7 days. Scheduled cleanup runs in batches and may be delayed by backlogs or outages.

Request deletion through Settings → Delete account and confirm your identity. The system first restricts account activity, then removes your information and photos in the background. This generally takes about 5–10 minutes; large accounts or service failures may take longer. Your comment and message contents are cleared; placeholders without the original text or identity may remain. Other people’s replies may remain in their read-only archived conversation.

After completion, the backend retains a guard receipt keyed by the original account identifier with a 24-hour validity period to prevent old credentials from recreating the account. It contains no name, email, photo or original content and is removed by scheduled cleanup after expiry. Email us about access, correction or deletion; we verify identity and handle requests under applicable requirements.

Image-review consent is recorded on this device per account and policy version. Withdraw this device’s consent in Settings → Privacy and support to be asked again before your next upload. Withdrawal does not automatically delete previously uploaded photos.

Contact and policy updates

Service provider: Annona Team. Contact annona.support@gmail.com for support, privacy questions, reports or appeals. Do not send passwords, verification codes, private keys or unnecessary private photos.

We update the version date when this policy changes. Material changes in purposes will be communicated appropriately and consent requested again when needed.