Privacy Policy

Scope

This policy applies to the CRAVD website at cravd.io and the CRAVD mobile app (iOS and Android, “the App”). CRAVD is operated by Bill Kamanzi (“we”, “us”, “our”). We are the data controller responsible for your personal data. You can reach us at bill@cravd.io.

Website — what we collect

When you join our waitlist at cravd.io:

• Your email address to manage your waitlist position and send launch updates
• Your marketing preference (whether you opted in to promotional content)

When you visit any page on cravd.io we also collect, via Google Analytics 4, anonymous usage data (pages visited, browser type, device information, approximate location from IP address). We use this only to understand how visitors use the website.

Mobile App — what we collect

When you create a CRAVD account and use the app, we collect the following categories of data. Each category lists what we collect, why, and whether it is tied to your account identity.

Contact Info — your email address and name

We collect your email address when you create an account. It is used for authentication (sign-in by magic link or OTP), account recovery, and to send you transactional emails (welcome, milestones, friend activity). We also store the display name you choose for your profile (you can edit it any time in Settings → Edit Name). Both are linked to your identity and not used for tracking across other apps or services.

Identifiers — your user ID

We assign each account a unique identifier (a UUID) used internally to reference your data. We also store your Expo push notification token if you grant push permission, so we can send you notifications about activity in the app (a friend nods one of your Cravds, a friend Cravd's at a place you saved, etc.). These identifiers are linked to your identity and not shared with third parties for advertising.

User Content — photos, posts, profile

We store content you choose to create in the app:

• Profile information (username, display name, bio, city, avatar)
• Cravds you post (dish name, tier S/A/B/C, photos, optional notes, optional cuisine, optional tags, the restaurant)
• Cravings (restaurants you save for later)
• Nods, comments, follows, blocks
• Visibility setting per Cravd (public, friends, private)

Public Cravds are accessible at cravd.io/c/<mealId> as a shareable preview. Friends-only and private Cravds are never published this way and are only visible inside the app to permitted users. All content is linked to your identity.

Location — coarse, only at the moment you rate

When you tap to rate a meal (and only then), the app may read your device's approximate location to suggest nearby restaurants for quicker selection. We do not track your location in the background, we do not store your location history, and we do not use your location for advertising. The system permission prompt asks for “While Using the App” access only. If granted, the location is linked to your identity for that single moment of use only.

Usage Data — product interaction

We collect data about how you use the app — app launches, screen views, button taps, post events, login events, errors. We use this to understand which features work and which don't. Because we identify your events with your user ID after sign-in, this data is linked to your identity. We do not sell, share, or use this data for tracking across other apps or websites.

Usage Data — email opens and clicks

When we send you transactional or lifecycle emails, our email provider (Resend) records whether you opened the email and which links inside it you clicked. We use this only to understand which emails are useful and to improve them. This data is linked to your identity (we know which user opened what) and is not used for tracking across other apps or services.

Diagnostics — crash reports and performance data

If the app crashes we collect a stack trace describing what happened. We also collect basic performance signals like app launch time and navigation timing — used to detect regressions like slow cold starts. Both are configured to NOT include personally identifying information — no IP address, no email, no user ID is attached. They are therefore not linked to your identity.

Service providers we use

• Supabase — stores your account, profile, Cravds, Cravings, photos, and push tokens in a managed PostgreSQL database with row-level security.
• Vercel — hosts our website and serves content via a global CDN.
• Resend — delivers transactional and lifecycle emails from bill@cravd.io. Resend records email open and click events.
• Hostinger SMTP — delivers waitlist confirmation emails from the website (legacy; being migrated to Resend).
• PostHog — processes product analytics events (taps, screen views, errors).
• Sentry — processes crash reports. Configured to exclude personal identifiers.
• Google Analytics 4 — collects anonymous website usage data (cravd.io only, not the app).
• Google Maps Platform — the app uses Google Places API to search for restaurants and Maps SDK to display the map. Map queries are processed by Google under Google's privacy policy.
• Apple Push Notification Service and Firebase Cloud Messaging — deliver push notifications to your device.

All processors comply with international data-protection standards. Data is encrypted in transit (TLS) and at rest.

What we do NOT collect

• Phone numbers
• Physical mailing addresses
• Payment information (CRAVD is free; we do not process payments)
• Contacts from your phone's address book
• Health, fitness, or sensitive personal data
• Precise GPS location in the background
• Browsing history or search history outside the app
• Advertising identifiers (no IDFA, no GAID) — we do not run ads in CRAVD

Tracking and advertising

We do NOT use your data to target you with ads in CRAVD or in other apps or websites. We do NOT share your data with third-party ad networks. We do NOT use cross-app tracking (the App Tracking Transparency prompt on iOS will never appear in CRAVD because we do not track you in Apple's defined sense).

Data sharing

We do not sell, rent, or trade your personal data. Your data is only shared with the service providers listed above for the purposes described in this policy.

Public Cravds (those you set as “public”) are visible to anyone with the share link at cravd.io/c/<mealId>. You control which Cravds are public by setting visibility per post.

Data retention

We retain your data while your account is active. If you delete your account from inside the app (Settings → Delete Account) or by emailing us, we delete your profile, Cravds, Cravings, photos, nods, comments, follows, push tokens, and email preferences within 14 days. Crash diagnostics (which are not linked to your identity) may persist for 30 days in our error-tracking provider.

International data transfers

Your data is processed by service providers in the United States, the European Union, and Singapore. All transfers are protected by standard contractual clauses or equivalent safeguards.

Children's privacy

CRAVD is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us at bill@cravd.io and we will delete it.

Your rights

Under the UAE Personal Data Protection Law (PDPL), the EU General Data Protection Regulation (GDPR), and similar laws, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw your consent to data processing at any time
• Receive your data in a portable format
• Unsubscribe from any marketing communication
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email us at bill@cravd.io with “Data Request” in the subject line. We will respond within 30 days.

Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. If we make material changes that affect how we use your data, we will notify you by email and in-app.

Contact

For any data-related requests or questions about this policy, contact us at bill@cravd.io

CRAVD — Dubai, UAE