Privacy policy

Who we are

DishVoya (working name) is owned by Brand Growth, which is responsible for your data on this site. For anything about your data: (contact e-mail added before launch).

What we collect

• When you sign up: your e-mail, the username people see, and your password — stored with one-way encryption, so we can neither see nor recover it.
• If you sign in with Google: we receive your verified e-mail, your name and an internal identifier of your Google account only — never a Google password, and we cannot reach your mail or files. When the sign-in form appears your browser loads Google’s sign-in button (so Google receives your network address under its own policy); nothing is loaded from Google on the other pages.
• Activation and “forgot password” codes: 6 digits sent to your e-mail, valid 15 minutes; we keep only an encrypted fingerprint of them.
• What you add yourself (optional): profile photo, bio, country, cooking specialties, and your phone number — only the site team sees it and we use it to reach you only when needed (for example about a request to delete your account).
• Your experiences with recipes: rating, text, “what I changed” and a photo of your dish.
• A verification request (if you make one): link to your cooking account, your notes, and a photo of a certificate or proof of work.
• Your activity: saved recipes, “helpful” votes, reports, suggested recipe edits and recipes you shared — to show them to you in “My activity” on your page.
• One essential cookie that keeps you signed in: set when you sign in, sign up or reset your password, and kept for 90 days unless you sign out. Plus an encrypted fingerprint of your network address kept at most 8 days to stop spam (the address itself is not stored). We use no advertising trackers.
• Aggregate usage counts to improve our content: searches on the site, picks in “What should I cook today?” and the fridge, use of cook mode, timers, saving and sharing, and your device language. They are stored as daily counts, not linked to your account, and sent without cookies. To stop people faking the numbers we compute a daily encrypted fingerprint of your network address that does not outlive its day. Any number, e-mail or link is removed from search words before they are stored; search words are deleted after 90 days. Other counts are deleted after 400 days.
• On your own device (not sent automatically): the language, country and view you chose, a copy of your favourites (an old list moves to your account once when you sign in), a signed-in hint, the time you last opened each recipe so a visit is not counted twice within 30 minutes, the date your device language was last sent, and a note that you saw the welcome message.

What we do not collect

• We do not ask for your phone number to sign up — adding it is optional.
• Location and camera data are removed from photos on your device before upload.
• To show local words we guess your country from your device settings (time zone) inside your browser only; it is not sent or stored unless you pick a country in your profile.

Why we use it

• To run your account and show your experiences, name and rank on recipes.
• To check cooks before giving a verified badge.
• To protect the site from spam and abuse (review of a first experience, daily limits, reports).
• We do not sell your data or share it with advertisers.

What people can see

Public: your display name, username, rank, specialties, country if you add it, and your published experiences and photos. Verified cooks also get a public page with a link to their cooking account. Your e-mail, phone number, verification requests and proofs are seen only by the site team.

Where it is stored

Your data is stored with our hosting provider outside Saudi Arabia, and we follow the applicable transfer rules.

How long we keep it

As long as your account exists. When you ask to delete your account we suspend it for 30 days (your experiences leave the site, and you can bring the account back by signing in), then your data, experiences and photos are removed from the site for good. They remain in backups for up to 30 days and are then erased automatically (the newest three backups are always kept, so this can be longer if backups fail).

Your rights

• To know what we collect and why (this page).
• To access your data and get a copy.
• To correct it — most of it directly from “My page”.
• To delete your account and all your data — “Delete my account” in “Account settings”.
• To withdraw consent at any time (by deleting the account).
• For any request, write to (contact e-mail added before launch); we answer within 30 days.

Minors

Accounts are not intended for people under 18 without a parent’s or guardian’s consent.

Security

Access is restricted by strict database rules, and private data is seen only by the site team. If a breach affects your data we notify the competent authorities within the legal deadlines and inform you when required.

Changes

We may update this policy; the date at the top shows the last update, and we will tell you about important changes.