Privacy Policy

Who operates Nori + Rice

Nori + Rice is operated by Stephen Cuellar. This Privacy Policy explains how information is collected, used, disclosed, retained, and protected when you use the Nori + Rice mobile app or its related public pages. Questions can be sent to noriandriceapp@gmail.com.

Adults only

Nori + Rice is intended only for people who are at least 18 years old. A parent, guardian, or other adult caregiver may enter allergy information for a person in their care when authorized to do so. People under 18 are not permitted to create accounts, and Nori + Rice does not knowingly seek personal information directly from them. If you believe a person under 18 has provided personal information, contact Nori + Rice so it can be deleted.

Account and authentication information

Nori + Rice may collect and store your email address, first name, authentication provider, Firebase account identifier, account status, and consent choices. If you continue without registering, Firebase creates an anonymous account identifier and stores your profile and recipes in Firebase while that anonymous session remains available. Deleting the app or losing the anonymous session may prevent you from accessing that information, but it does not by itself send an account-deletion request.

Google Firebase and the selected sign-in provider handle authentication credentials. Nori + Rice does not independently store a copy of your Apple, Google, or email-account password.

Allergy and recipe information

Nori + Rice stores the allergy selections you provide. Allergy selections may reveal sensitive health-related information about you or a person in your care.

Nori + Rice also stores recipe titles, ingredients, preparation steps, source URLs, tags, personal notes, ingredient decisions, saved safety-analysis results, and other recipe information you choose to submit. For URL imports, Nori + Rice may retrieve and process text from the public webpage at the submitted URL.

Support information

When you contact Nori + Rice, the service may collect your message, Firebase account identifier, authentication status, app version, and any available first name, account email, or reply email you provide. Support submissions are stored in Firebase and may be forwarded through Resend to the Nori + Rice support inbox hosted by Gmail.

How recipe analysis uses AI

With your permission, Nori + Rice uses OpenAI as a third-party AI provider to extract recipes and compare listed ingredients with your selected allergens.

• The recipe title, ingredients, and preparation steps
• The allergens you selected
• For some URL imports, the recipe URL and public webpage text

Information not intentionally included in AI requests

Nori + Rice does not intentionally include your name, email, account ID, or personal notes in requests to OpenAI for recipe analysis.

Information placed inside a recipe title, ingredient, preparation step, source URL, or public webpage may be included because that content is part of the recipe request. Do not put personal information into recipe content that you do not want processed for analysis.

Product analytics and technical information

In configured release builds, anonymous product-usage analytics starts enabled. You can disable or re-enable it at any time under Settings → Anonymous usage analytics. Disabling it stops new PostHog events from being sent from that app installation and clears locally queued analytics events.

Nori + Rice may collect events such as opening a screen, completing recipe analysis, saving or viewing a recipe, and completing account registration. Events use pseudonymous analytics identifiers and may include app version, platform, environment, broad success or failure categories, account state, and a random recipe analytics identifier. Pseudonymous means the identifier does not directly contain your name or email, but it can recognize the same app installation or analytics object over time.

Analytics events do not intentionally include your allergy selections, recipe titles, recipe URLs, ingredients, preparation steps, analysis text, personal notes, name, email address, Firebase account ID, or support messages. Location enrichment, touch recording, and session replay are disabled. Firebase, OpenAI, PostHog, Resend, Gmail, Apple, Google, and network providers may automatically process IP addresses, device information, timestamps, security logs, and similar technical metadata when their services are used.

How information is used

• Create and authenticate accounts and preserve app information
• Import, store, review, display, and update recipes
• Compare recipe information with the allergies you selected
• Provide support and respond to questions or deletion requests
• Understand feature usage and improve reliability and usability
• Prevent abuse, investigate errors, protect the service, and comply with law

Service providers and disclosures

Nori + Rice uses Google Firebase for authentication, app data storage, server processing, and operational logs; Apple and Google for optional account authentication; OpenAI for recipe extraction and ingredient analysis; PostHog for pseudonymous product analytics; Resend for support-email delivery; and Gmail for the support inbox. These providers may process information under their own terms and privacy practices to perform services for Nori + Rice.

Information may also be disclosed when reasonably necessary to comply with law or legal process, enforce the Terms of Service, investigate fraud or abuse, protect a person's safety or rights, or complete a merger, financing, sale, reorganization, or transfer of the service. Any successor may use the transferred information only as permitted by this policy unless it provides notice of a different practice.

Nori + Rice does not sell or rent personal information and does not use allergy or recipe information for targeted advertising.

Retention and deletion

Firebase account, profile, allergy, and saved recipe information is generally retained until you delete your account or request deletion. Recipe extraction and safety-analysis caches expire after 30 days. Pseudonymous analytics may be retained while reasonably needed to measure and improve the service, subject to PostHog settings and applicable law.

OpenAI states that API inputs and outputs are not used to train or improve its models unless the API customer opts in. OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days by default, or longer when required by law or reasonably necessary to protect its services or others from harm. Nori + Rice does not opt in to use submitted recipe data for model training.

You can permanently delete your Firebase account, profile, saved recipes, and stored support submissions from Settings → Account. Apple-linked accounts must confirm with Apple so Nori + Rice can revoke Apple authorization before deletion. You may also request help at the privacy contact email. Deleting the mobile app by itself does not delete information stored in Firebase.

Copies of support messages already forwarded to the support inbox, provider security or abuse logs, backups, and records reasonably needed for legal, fraud-prevention, or dispute purposes may remain after account deletion. They will be retained only as long as reasonably needed for those purposes and then deleted or de-identified where feasible.

Your privacy choices and rights

You can update certain account and allergy information in the app, disable product analytics in Settings, withdraw future AI-sharing permission under Settings → Safety and AI, and delete your account under Settings → Account. You may contact noriandriceapp@gmail.com to ask to access, correct, or delete information, or to raise a privacy concern. Nori + Rice may need to verify your identity and may retain information when permitted or required by law. Depending on where you live, you may have additional privacy rights and the right to appeal or complain to a privacy authority.

Withdrawing AI permission stops new OpenAI requests but does not recall information processed before withdrawal.

Security

Nori + Rice uses reasonable administrative and technical measures designed to protect information, including authenticated access, server-side processing, provider security controls, and restricted database rules. No method of transmission or electronic storage is completely secure, so absolute security cannot be guaranteed.

International processing

Nori + Rice is operated from the United States. Information may be processed and stored in the United States or other countries where its service providers operate. Those countries may have privacy laws different from the laws where you live.

Changes to this policy

This policy may change as Nori + Rice and applicable requirements evolve. The updated date will be posted with the revised policy. When a change materially affects how previously collected information is used or shared, Nori + Rice will provide additional notice when reasonably appropriate. Material changes to AI data sharing will require renewed in-app permission before new AI requests are made.

Contact

For privacy questions, requests, or concerns, email noriandriceapp@gmail.com.