Privacy Policy

1. Overview

This Privacy Policy explains how Minthee ("we", "us", or "our") handles information when you use our Android mobile application ("DishApp") and our companion website ("DishWeb", minthee.com).

We do not require you to create an account with us to use Minthee. There is no central user profiling server collecting your personal identifiers, dietary choices, or shopping patterns.

2. Information Handled by the Mobile App

The mobile app stores your culinary data locally in an SQLite database using Android's Room persistence library on your device:

• Dishes and Recipes: Names, ingredients, categories, step-by-step instructions, preparation notes, tags, cooldown timers, calorie estimates, and ratings.
• Cooking History & Badges: Timestamps of cooked meals, frequency metrics, and culinary milestone progression.
• Meal Plans & Events: Scheduled meals, dining-out days, and calendar notes.
• Grocery Lists & Aisles: Interactive checklists of ingredients, quantities, checked states, and supermarket aisle assignments.
• Pantry & Stock Inventory: On-hand staples, low-stock thresholds, expiration dates, custom aisle organization, and restock links.
• Dish Photos: Selected via the native Android Photo Picker and saved exclusively to internal app-private storage (filesDir/images/). Minthee supports multi-photo galleries without scanning your photo library or requesting broad external storage permissions.
• Barcode Scanner: Packaging barcodes are scanned on-device using CameraX. Product lookups query Open Food Facts directly over encrypted TLS without transmitting advertising IDs or user identifiers.

3. Optional Encrypted Cloud Backup

Minthee provides optional cloud backup features. If you choose to enable them:

• Google Drive Client-Side Encryption: Backups uploaded to Google Drive are encrypted on your phone using AES-256-GCM with a key derived from your passphrase using PBKDF2 (100,000 iterations and random salt). Access is restricted strictly to the hidden app folder (drive.appdata). Google and third parties receive only ciphertext and cannot read your recipes or photos.
• Cloud Snapshot Backups: When you create a cloud backup snapshot, communication uses TLS 1.3 encryption. Restores are strictly non-destructive, protecting your local recipes with safety snapshots.

4. Information Collected by This Website

Our companion website (minthee.com) is a static website:

• We do not set third-party tracking cookies, analytics pixels, or marketing scripts.
• Standard HTTP server access logs (IP address, user agent, requested URL) are processed strictly for security, rate limiting, and uptime diagnostic purposes.

5. Live Sharing, 12-Hour Ephemeral Links & Instant Invalidation

We do not sell, rent, monetize, or disclose your personal information or recipes to third parties.

When you use Live Recipe Sharing to share a dish with friends or family via web link:

• 12-Hour Maximum Ephemeral TTL: All live recipe links are capped at an absolute maximum lifespan of 12 hours. An active countdown timer on the web page shows the remaining availability. Once expired, the shared data is automatically and irreversibly purged from our servers.
• Instant Link Invalidation: You maintain full control. You can revoke or invalidate any active share link at any time from the app's Settings menu or from the Live Share confirmation sheet. Revoking immediately terminates web access and destroys server copies.
• Optional Photo Inclusion: You choose whether or not to include dish photos when sharing.
• Offline QR Sharing: Recipes and grocery checklists shared via QR code are compressed and transmitted optically camera-to-camera with 100% offline peer-to-peer privacy.

6. Data Retention and Deletion

Because all primary data is stored locally on your device:

• You can delete individual recipes, images, pantry items, or entire databases directly from the app at any time.
• Uninstalling Minthee completely deletes all app-private data from your device.
• If you created live share links, you can revoke them immediately in Settings or wait for automatic 12-hour purge. If you configured cloud backup, you can delete all remote data directly in the app or see our Account & Data Deletion page.

7. Children's Privacy

Minthee does not knowingly collect or solicit personal data from children under the age of 13.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.