VeganVerse Privacy Policy

Effective: September 16, 2026

DeLow Dynamics, based in Portland, Oregon, provides VeganVerse and is responsible for the personal information described in this policy. Contact rich@delowdynamics.com for privacy questions or requests. This policy covers the app and its related services; websites and services you open through external links have their own policies.

1. Accounts, profiles, and saved information

Guest browsing is available. Creating an account enables account and community features. Firebase Authentication processes email/password, Apple, or Google sign-in. Depending on your chosen method, we receive an account identifier, email address, name, provider information, and profile photo. Apple may provide a private relay email. Your password is handled by the authentication service and is not displayed to other members.

We store your chosen display name, handle, profile photo, account timestamps, and preferences. Your public identity can appear with posts, comments, reviews, messages, follows, and leaderboard entries. Your account email and private account settings are not part of your public profile.

Saved app information may include grocery items, saved places and Nearby filters, search words, the last searched map center and results, onboarding and notification choices, 7 Days Kinder progress, dietary choices, impact estimates, game progress, and settings. Some information stays on your device; supported account information synchronizes through Firebase so it can be restored across sessions or devices. Archived recipe and meal-planning state may remain for existing accounts, but those features are disabled in the initial release.

2. Community content and private messages

We store posts, uploaded photos, comments, reviews, ratings, poll choices, Seed prompts, Root topics, reactions, follows, and their associated identifiers and timestamps. Published community content and attached place information are public and may be accessible without signing in. Uploaded profile, post, and review photos are publicly accessible media; do not upload an image you intend to keep private. Choosing an image can upload it while a submission is being prepared, before publication is completed.

Direct messages are stored through Firebase and access is restricted to the conversation’s participants through app security rules. They are not end-to-end encrypted. Authorized service administration or legally required access may still be possible. Private messages are not sent to OpenAI for the community publishing checks described below. A recipient can copy or share anything you send them.

Reports and blocks contain the reporting or blocking account identifier, target identifiers, reasons, and relevant content excerpts. Reports are restricted from ordinary member access and may be reviewed to protect the community and enforce our Terms.

3. Location, maps, and place searches

With your permission, Nearby uses device location to find places and calculate distance. Venue names, addresses, and place identifiers pass through our Firebase services to Google Places to match and retrieve images. Google Places is not used to supply our directory, map coordinates, ratings, or opening hours. Nearby also sends the selected search coordinates and radius directly to Geoapify for place results; that service receives ordinary network information, such as your IP address. Apple Maps services may also process location or search information. Your last Nearby search, selected map center, filters, and results can be saved on device and synchronized to your private account state. You can instead search a selected map area where supported. We do not collect a continuous movement history or request background location access.

Attaching a place or current area to a community post is a separate, deliberate choice. A current-area attachment reduces coordinate precision to a neighborhood-scale area before publication. A searched venue attachment identifies that venue. Both the label and attached coordinates become public with the post and can be used by Root’s Near Me filter. An approximate area can still reveal where you are or spend time. Location is never attached automatically.

4. Camera, selected photos, and scanning

Camera permission supports barcode capture. Ingredient-label text recognition uses Apple’s Vision framework on your device; the label photo and recognized text are not sent to OpenAI by the scanner. A scanned barcode is sent to Open Food Facts to retrieve product data. That provider also receives ordinary network information, such as an IP address. Product photos shown in results may load from that provider.

Profile, post, and review photo features use images you select and upload to Firebase Storage. The app does not silently upload your photo library. You can decline camera or photo access and change permissions in iOS Settings. You control whether to add a calendar event; the app requests the necessary calendar permission for that action.

5. OpenAI processing and permission

VeganVerse uses OpenAI for two purposes in this release. Before content is sent for either purpose, the app explains the purpose and asks you to allow sharing with OpenAI. Consent is separate for each purpose and account on this device. Declining a prompt sends nothing from that request to OpenAI.

• Community safety: Before publishing a post, comment, or place review, our server sends the submitted text and any attached submission photo to OpenAI to screen for unsafe or prohibited content. For posts, screening can also include poll options, Seed prompts, topic names, mood, and an attached place name. Account email, private messages, and device coordinates are not included in that screening payload. You may identify yourself or disclose personal information within your own text or photo. Publishing requires the safety check; browsing and other features remain available if you decline.
• Nearby assistance: Some dish searches can send the entered dish or search words to OpenAI to suggest related vegan terms. A pseudonymous safety identifier derived from the account identifier can accompany the request. The request does not include device coordinates or account email. Declining leaves ordinary Nearby search available.

Turn off either permission in Settings → AI Data Sharing. Revocation stops future requests and cannot recall processing that already occurred. Our generation requests disable response storage where the API supports that control. OpenAI may nevertheless retain eligible request information under its own abuse-monitoring, security, and legal retention policies. We do not promise zero provider retention. See OpenAI’s privacy policy and API data controls. Do not submit secrets or confidential information.

6. Advertising, analytics, and device information

Google Mobile Ads displays native advertising on Home and V-Stream. Advertising services may process device and app identifiers, IP address, approximate region, ad interactions, and diagnostics. Where applicable, Google’s consent flow collects advertising choices. The app asks for Apple’s App Tracking Transparency permission before accessing the advertising identifier for tracking. Declining tracking leaves app features available; contextual or otherwise permitted ads may still appear. Adjust tracking in iOS Settings and use Settings → Ad Privacy Choices when that consent option is required and offered.

Firebase Analytics can receive feature interactions, app-instance identifiers, device characteristics, and diagnostics. Our custom events use broad categories, such as a feature opened, sign-in method, score range, or completion of the ad-free purchase and its product identifier. They do not include account emails, names, post or message text, search words, AI prompts, or coordinates. Device identifiers mean this collection should not be treated as completely anonymous. Settings → Usage Analytics lets you disable our analytics collection and reset local analytics data. This control is separate from advertising and necessary account/security services.

We do not sell personal information for money. Advertising-related disclosure may nevertheless qualify as a sale, sharing, or targeted advertising under some privacy laws. Available consent and tracking controls govern those activities; contact us to exercise additional rights applicable where you live.

7. Purchases, notifications, and support

The optional Remove All Ads purchase is a one-time, non-consumable App Store purchase. Apple handles payment details; we do not receive your full card or bank details. StoreKit provides purchase identifiers, signed transaction information, and entitlement or revocation status so the app can verify and restore ad removal. Account deletion does not cancel, refund, or erase an Apple purchase record.

If you enable social push notifications, Firebase Messaging processes an installation identifier and push token associated with your account. Notification activity can include the actor’s public identity, related post identifiers, and a short content preview. Push previews can appear on your lock screen; adjust preview and permission settings in iOS. Plant-Based Reminders are scheduled locally. Support requests include the contact details, message, and attachments you choose to send us.

8. Why information is used and who receives it

We use information to operate requested features, synchronize saved state, verify purchases, send authorized notifications, moderate submissions, investigate reports, protect accounts, diagnose failures, improve the app, support permitted advertising, respond to requests, and comply with law.

Providers include Google Firebase for authentication, databases, storage, functions, analytics, messaging, and app/device attestation; Apple and Google for sign-in, platform, map, place, advertising, and consent services; Geoapify for additional place searches; Open Food Facts for barcode product lookups; and OpenAI for the permitted processing above. Exa helps our server discover public editorial and event information; your private messages and profile are not inputs to that editorial refresh. Public story, venue, directions, and ad links can take you to independent services that receive ordinary network data and apply their own policies.

We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect rights and safety, investigate abuse, or transfer the business subject to appropriate protection and notice. Providers process data under their applicable agreements and policies. Useful references include Google privacy, Firebase privacy and security, Apple privacy, Geoapify privacy, and Open Food Facts privacy.

Where applicable privacy law requires a lawful basis, we rely on performance of the service you request, consent for processing that requires it, legitimate interests in security and proportionate service improvement where permitted, and legal obligations. You may withdraw consent without changing the lawfulness of earlier processing.

9. Retention and account deletion

Account and saved information generally remain while your account is active. Published content remains until removed, including through account deletion. Security reports, operational logs, backups, and provider records may remain as reasonably needed for security, legal obligations, and dispute handling. Retention depends on the information and service; we do not represent that every provider copy disappears immediately. Moderation approval records have a ten-minute validity period and expired approvals are cleaned by a scheduled process. Google Places photos and their references are fetched fresh and are not persistently cached by this release. Other device image caches normally expire after 30 days.

Sign in and choose Settings → Delete Account to initiate deletion. Our deletion process removes the authentication account, private saved state, profile media, owned posts and their threads, your comments and place reviews, review photos, username reservation, follow links, your authored direct messages, notification/token records under your account, moderation approvals, and account-specific AI/moderation quotas. Other conversation participants’ own messages can remain, along with the conversation identifier. Security reports or records retained for legitimate legal/security purposes may remain. Copies, screenshots, notification previews, external provider records, and content other people independently saved are outside this deletion process. Contact rich@delowdynamics.com if deletion fails or you need help.

10. Your choices and privacy rights

You can browse as a guest, edit your profile, remove supported content, decline optional permissions, control analytics and AI sharing, manage notification and advertising choices, and delete your account. Depending on your jurisdiction, you may also have rights to access, correct, export, delete, restrict, or object to processing; opt out of qualifying sale/sharing or targeted advertising; withdraw consent; or complain to your local data protection authority.

Send requests to rich@delowdynamics.com. We may verify account ownership and an authorized agent’s authority before disclosing or changing information. We respond as applicable law requires, explain lawful exceptions, and do not discriminate for exercising privacy rights. You can contact us to request review of a denied request where an appeal right applies.

11. Security, children, and international processing

We use service authentication, access rules, encrypted network connections, and device/app attestation to protect information. No service can guarantee complete security. Public submissions should not contain private or sensitive information you do not want others to see.

VeganVerse is not directed to children under 13. Users must meet the Terms’ minimum age and applicable parental-consent requirements. Contact us if you believe a child under the permitted age supplied personal information so we can investigate and remove it where appropriate.

Information may be processed in the United States and other countries where providers operate. Applicable safeguards and provider agreements govern transfers where required; laws may differ from those in your home jurisdiction.

12. Policy updates and contact

We may update this policy when the app, providers, or applicable requirements change. We will update the effective date and give additional notice or request new consent where required. Contact DeLow Dynamics, Portland, Oregon, at rich@delowdynamics.com.

Read the VeganVerse Terms of Use.