Privacy Notice

Effective date: October 30, 2026 · Version: 1.0

Who we are. Yummiable is made and run by Whats4Dinner LLC, 8201 164th Ave NE, Ste 200, PMB 064, Redmond, WA 98052, USA; telephone +1 206 738 7633; e-mail hello@yummiable.com. Write or call us about anything in this notice, or to use your rights as a parent (below).

No tracking. We don't track what you or your kids do in the app. It does not record which screens you open, what you tap or how long you play, and sends nothing of the kind to us or to anyone else. It downloads each food's pictures and details as you open them, without any account or device number, so those downloads don't say who is looking. It contains no advertising or tracking tools and no third-party analytics. Our services keep only what a feature needs in order to work, as described below; Cloudflare, which runs them, keeps short technical records of their requests, including the network address they came from, for up to 7 days to keep them running and stop abuse; these are never used to study how anyone uses the app. No other company collects information about your activity over time or across other apps and sites through Yummiable, so a browser's "Do Not Track" setting has nothing to turn off.

What children share. In kid mode, children tap, read and play; the app sends nothing personal from kid mode, except that with Family sync on, the coins and stamps a child earns there reach the family's encrypted copy (below); it never asks a child for more information than an activity needs. Everything the app holds about a child — the profile, the Taste Passport, the food diary, the allergy list — is entered or confirmed by a grown-up and stays on the phone unless the family turns on Family sync.

Crash reports. When the app crashes or freezes, it sends our team an anonymous crash report so we can fix it: what went wrong and where in the app's code, the app's version, the kind of device and its system version. It carries no device number, account, name or profile, nothing about the kids and nothing anyone typed, and our service doesn't store where it came from (only Cloudflare's short technical records above see that). It describes a failure of the app, not what you were doing. Our service counts repeats of the same crash and keeps those counts for 30 days.

Learning stays on the phone. When the app suggests foods to try, it learns from what your family records — for example, which kinds of small change between foods (a new shape, a new flavor) work for each child. That learning happens on the phone, and it stays there: the app never sends it to us or to anyone else. If your family turns on Family sync, it travels only inside the family's encrypted copy, whose key never reaches our server, and which we never read.

What a profile contains. A first name or nickname, a buddy icon, an age, the coins and books earned in the app, the Taste Passport notes and food-diary entries that a parent or guardian confirms.

Where it is kept. In the app's own storage on this device. Unless your family turns on Family sync (below), the app never sends it to a server we host or shares it with any other party. If you have enabled your device's own backup feature, the operating system may include the app's data in that encrypted backup under your account, as it does for any app; the app does not control this, and such a backup can be restored only to a device you sign in to.

Family sync. A Premium family can let up to five grown-ups share the kids' profiles, coins, Taste Passports, food diary, allergy lists and hidden Discovery dishes across their phones. To do that, an encrypted copy is stored on our account service (run on Cloudflare). It is encrypted on the family's phones with a key that never reaches our server, so our server holds only the encrypted copy, and neither we nor Cloudflare, which stores it for us, ever read it. It is used for that one purpose — keeping the family's phones the same — and for nothing else: we do not analyze it, do not use it for advertising or marketing, and never share it with any other party. It is deleted at once when a grown-up turns Family sync off (each phone keeps its own copy) or deletes the family in Settings (the phone it is deleted from keeps its copy). Deleting the family also deletes all the family's storybooks from our servers, with their pictures; the books already on that phone stay on it. When a grown-up signs out on a phone, the family's kids, their coins and food diary, and the family's books leave that phone, and come back when that grown-up signs in there again; a different grown-up signing in there never sees them. They also leave a phone whose grown-up leaves the family, is removed from it or deletes their account while the family goes on, and the other grown-ups' phones when the family is deleted, unless that phone is the only one that can open the family's copy.

Grown-up accounts. A grown-up account is optional and only for grown-ups: only a grown-up can make an account or subscribe, and kids never do. It is made with an e-mail address or a phone number, which goes to Clerk, our sign-in service, and to the provider that delivers the sign-in code — or with Sign in with Apple or Sign in with Google, which give Clerk the e-mail address of your Apple or Google account (Apple can hide it behind a private relay address that forwards to you). It is used only to sign in and to send account messages (from our account service on Cloudflare); it is never used for marketing and never shared with anyone else. Google also gives Clerk the name and profile picture on your Google account, and Apple, when you sign in with it on Android, the name you choose to share; the app doesn't use them and our account service doesn't keep them. Before any address is typed, or Apple or Google is asked, the app checks that you are a grown-up: with your phone's own answer where it has one (on an iPhone, if you choose to share your age range), or with the month and year of birth you type. That answer stays on the phone and is not kept; our account service records only that the check was passed and how, with the consent you ticked and the version of the Terms of Service you accepted. Our account service doesn't store the phone's network address or its browser (only Cloudflare's short technical records above see them); Clerk sees the network address of each sign-in request, to protect signing in from abuse.

Clerk, our sign-in service. Clerk, Inc., a US company, runs signing in for us as our service provider. It keeps the e-mail address or phone number you sign in with (and what Apple or Google give it), sends the sign-in codes through the provider it uses to deliver them, and keeps you signed in on your phones. It handles this on our behalf only to sign you in to Yummiable; it never receives your kids’ profiles, the food diary, stories or photos. The sign-in screens use Clerk’s own code, set so that it reports nothing to Clerk about how the app is used. Our account service keeps only Clerk’s number for your account, the name your family calls you, your family and its phones (each one's kind, such as iPhone), the consents you gave and, if you sign in with Apple on an iPhone or iPad, the token Apple gives for that sign-in, kept only so that deleting your account can revoke it at Apple; it asks Clerk for your address only to send you an account message. Deleting your grown-up account in Settings → Grown-up account deletes it at Clerk too.

Age checks where the law asks. Where a law asks apps to check the age of the people using them (some US states do, through the app stores), the app checks at every launch, account or not, when your phone says such a law applies: with your phone's own answer (on an iPhone, Apple asks you to share your age range), or, if it has none, with the month and year of birth you type. The answer stays in the app's memory only until the app closes: the app keeps nothing about anyone's age and sends it to no one, and it never keeps the birth date (after an under-18 answer, it keeps only the time it may ask again, 24 hours later); a new grown-up account records only that the check was passed and how (above). Where the answer is under 18, grown-up accounts stay closed, and so do the grown-up parts that send what someone types or photographs — dish photos, writing stories, feedback and upgrading — and crash reports; everything else works. Everywhere else the app asks nothing at launch.

Feedback. When a grown-up sends feedback from Settings, what they write, the topic they pick and the details the form lists (the app and phone versions, the plan, the app’s style and the food list version) go to our team as an e-mail, through our story service (which runs on Cloudflare). If they are signed in to a grown-up account, the address the account signs in with goes with it, so we know which account wrote; when they ask for a copy, our account service e-mails it to that same address. Nothing about the kids goes with it. We use it only to fix and improve the app and its food information.

Generative AI. Food stories, their painted pages and the cute dish drawings are made by OpenAI’s generative AI services, which write the words and paint the pictures. They receive only what the feature needs: your story idea and edits, the food friends you chose, or the dish photo you take. Our story service, which passes it on, also receives a random device or subscription number that counts the monthly allowance. On an iPhone or iPad the phone keeps that device number in its keychain, and on Android it is made from Android’s ID for this app, so deleting and installing the app again keeps it and the allowance carries on where it was. It stays a random number, never linked to a name, or to an account unless a grown-up signs in. A grown-up who is signed in and in a family shares the family’s Premium: our story service links the subscription their phone shows to their account and their family, by number only (never a name or an address), so that every grown-up in the family uses its allowance and shares its bookshelf, and keeps the App Store’s or Google Play’s reference for that subscription, encrypted, to ask them from time to time whether it is still active. The AI services never receive anything from the app's profiles: no profile, age, coins, Taste Passport or food diary. They receive only what you type or photograph: if a story idea names or describes a child, that goes with the idea and is kept with the book, so use a nickname if you prefer. Finished stories are kept on our story service (which runs on Cloudflare) as your family's bookshelf: their words and painted pages, the idea and edits you wrote, and the characters you named. New stories stop at 10 books on Basic (per device) and 50 on Premium (per subscription); books kept before the bookshelf existed, or brought along by an upgrade, stay even above that.

Dish photos. When you take or choose a photo of a dish, the app first makes it smaller and removes its location and other camera details. The photo then travels through our story service (which runs on Cloudflare) to OpenAI’s servers, where OpenAI’s AI models look at it to recognize the foods on the plate and, with Premium, to draw it. OpenAI receives only the photo, with nothing about your family: no profile, name or food diary. So please photograph only the food, and keep people, especially children, out of the frame. Our story service never saves the photo or the drawing made from it; it holds them only briefly, in temporary memory, and the result for at most 10 minutes. Of the photo it keeps only a fingerprint, a code from which the photo can't be rebuilt, with the record of what reading it cost (How long we keep it, below). OpenAI may keep what it receives for up to 30 days to check for abuse of its service, and does not use it to train its models.

Identifiers. The app uses two kinds of identifier, only to run its features: the random device or subscription number that counts the AI allowance and keeps the bookshelf (Generative AI, above), and the network address each request comes from, which Cloudflare's short technical records hold to keep our services running and stop abuse. Neither is used to build a profile of anyone, to advertise, or to follow anyone across apps or sites.

How long we keep it. We keep information only as long as the feature it serves needs it. On the phone, everything stays until you delete it, or the app. On our servers: the family's encrypted copy until Family sync is turned off, the family is deleted, or no family phone has used it for 12 months, when it is deleted (the phones keep their own copy); a grown-up account, its family membership and its consents until the account is deleted; finished stories until you delete them or, for a family's bookshelf, until the family is deleted (Deletion, below); a record of what each story and dish photo cost the allowance (when, which allowance number and how much, with a fingerprint of the request) for one year after the allowance period it was charged to ends; dish photos and drawings only in temporary memory, the result for at most 10 minutes; crash-report counts for 30 days; Cloudflare's technical records for up to 7 days; feedback e-mails only as long as we need them to answer and fix what they report, and no longer than 2 years. Copies our host keeps to recover from failures are overwritten within 30 days (stories: within about two days). Age answers are never stored (Age checks, above).

Your rights as a parent. You can see, change and delete everything about your child in the app: each profile, its Taste Passport and food diary are in Settings and the child's pages, its allergy list on New foods, and you can export the food diary there. Our server's copy is encrypted, so the app on your family's phones is how you review it. Turning Family sync off deletes that copy at once and stops any further collection; deleting the family deletes it too, with all the family's storybooks on our servers; deleting your grown-up account deletes the account, its family membership and its consents, and the whole family, with its copy and storybooks, when you are its only grown-up. You can also write to us at hello@yummiable.com, or call us (Who we are, above), to ask what we hold about your child, to have it deleted, or to withdraw your consent; we answer within 45 days, after checking that the request comes from the family's own grown-up (for example from the address the account signs in with). If we turn down a request, you can appeal; our Consumer Health Data Privacy Policy explains how. We never require a child to share more information than an activity needs.

Health data. We treat what the app keeps about a child's eating — the allergy list, food diary, Taste Passport and what the app learns from them — and anything you write about a child's health as consumer health data, as Washington's My Health My Data Act defines it. Our separate Consumer Health Data Privacy Policy says what we collect and why, who receives it, and how anyone can ask to see or delete it, withdraw consent, or appeal our answer.

Security. We protect what we hold under a written information security program: every connection is encrypted, the family's copy is encrypted end to end, access to our services and their keys is limited to Whats4Dinner LLC and protected by two-step sign-in, the providers named here are bound to protect what they handle for us, and we review these safeguards at least once a year and after any incident. To report a security concern, write to security@yummiable.com.

COPPA. While this information stays on the device, it is not "collected" within the meaning of the Children's Online Privacy Protection Act (COPPA) and the Federal Trade Commission's COPPA Rule (16 CFR Part 312). Family sync sends it to our server, so the app asks a parent or guardian for verifiable consent before sync can be turned on, and uses the information only as described above. The app contains no third-party advertising, analytics or tracking.

Deletion. Deleting a profile in Settings erases it from the device and, if Family sync is on, from the family's copy on our server the next time that phone shares. Deleting a book in Manage my books deletes it, with its earlier versions, from our story service and from the device; the service's backup copies of its records drop it within about two days of the service running. PDFs you saved are yours and are not touched. A Basic bookshelf belongs to this phone, so deleting the app does not delete it, and installing the app again brings it back; to delete it, delete its books in Manage my books. A Premium bookshelf can be changed from any device while the subscription is active (a family that shares Premium has one bookshelf, which its grown-ups change while the family is Premium; deleting the family deletes it from our servers, and the books already on that phone stay on it); when Premium ends, its books stay on our story service until you delete them, which you can still do from a phone that used that bookshelf, or, for a family's bookshelf, as one of its grown-ups; or write to us (Who we are, above). A parent or guardian may also export or import the food diary from Settings, and a grown-up account can be deleted there too.

Changes. When we change this notice, we change its date and version above, and the app shows the new version. Before a change in what we collect from or about children, or in how we use or share it, we ask a parent or guardian for consent again.

The short version

Profiles (a first name or nickname, a buddy icon, an age, and what a parent or guardian confirms) are stored by the app on this device. If your family turns on Family sync, a copy is kept on our server for one purpose only: keeping your family's grown-ups' phones the same. We never use it for anything else and never share it with any other party. We don't track what you or your kids do in the app. Only grown-ups can make an account or subscribe; kids never do.

On the welcome screen

Profiles, coins and the food diary stay on this phone unless your family turns on Family sync. We don't track what you or your kids do in the app, and there are no ads. Only grown-ups can make an account or subscribe; kids never do.

On the grown-up home

Privacy: profiles, coins and the food diary stay on this device (Family sync adds a copy on our server only to keep your grown-ups' phones the same); your food stories are kept on our story service (the full notice says how to delete them). We don't track what you or your kids do in the app, and there are no ads. Only grown-ups can make an account or subscribe; kids never do. COPPA-compliant.