Privacy Policy
Effective 23 October 2026. This describes what Ojafi collects, why, and what you can do about it.
What we collect
Your answers. The questions you answer on the web or in the app, and the reading calculated from them. What you log. How you slept, what you ate, how you felt: whatever you choose to enter; every field is optional and skipping one leaves the day genuinely unlogged rather than guessed at. Your account. Email address, a mobile number if you add one when you sign up, and a name if you set one. We use the number only to reach you about your account, and it is never shown on your profile or to other members. How you found us. The campaign parameters on the link you arrived through, so we know which advert brought you. What you share. A handle, a profile and any recipes you publish are visible to other people on Ojafi, and so is who you follow.
What we don't collect
Payment details are handled by the payment provider used at checkout; Ojafi does not store your full card number. We do not keep your contacts (see finding friends below), and we have no access to your whole photo library. We do not request GPS or other device location access. Optional analytics can infer approximate location, such as city and country, from an IP address. PostHog discards the raw IP address after processing. We process the individual photos and recordings you choose to submit. We do not sell or rent your data. See the advertising measurement sections below for information about optional conversion reporting.
Finding friends from your contacts
If you choose Connect contacts, the app reads your address book on your phone, turns each phone number and email address into a salted hash there, and sends only those hashes to our server to see which belong to people already on Ojafi. Names are never sent. The server compares the hashes, answers, and stores none of them; nothing from your address book is kept. Nobody is messaged unless you choose to invite them. You can withdraw this choice in the app’s privacy settings and turn off access in iPhone Settings.
Opening a shared recipe after installing
Shared recipes open through the link you choose. If you install Ojafi after opening a recipe, return to that link and choose Open in Ojafi. We do not match your network address or device characteristics to recover a recipe on first launch. Legacy network hashes from the retired recovery service are removed by the scheduled cleanup.
Apple Health
The app does not currently connect to Apple Health. If that changes, this section will say what is read and written, and nothing will be read before you allow it.
How we use it
Your answers produce your reading, and your reading plus what you log decides what the app suggests each day. Your email is used to sign you in and to send you things you asked for. Nothing you log is used to target advertising to you.
Analytics
Optional browser analytics starts only after you choose it in cookie preferences. Optional mobile analytics is controlled separately in the app’s privacy settings. PostHog, hosted in the EU, helps us understand page and feature usage. With your consent, its browser cookie lasts up to 30 days and connects visits across our marketing site and web app. When you sign in, your internal account identifier connects consented website and app activity. Signing out resets that browser identity; withdrawing consent removes the analytics cookie. Google Analytics measures consented website visits across our marketing site and web app. We do not send it account identifiers, private entries, or URL query strings, and Google advertising signals are disabled. If the app crashes while mobile analytics is on, PostHog receives a standard error category and numeric locations in the app’s code. Raw error messages, file paths and anything you entered are excluded. Browser session recording and automatic browser error capture are disabled. Operational server events are processed separately; these browser choices do not cancel essential account, payment or security processing.
Website advertising measurement
When you grant advertising consent on the website, conversion reporting can send Meta purchase events, hashed contact identifiers and technical signals such as click identifiers, IP address and browser information. This helps measure advertising performance. Apple Health readings and diary contents are not included in these conversion events.
App advertising measurement
On iPhone the app asks once, with Apple’s own “Allow tracking” prompt, whether it may measure which adverts brought you to Ojafi. Nothing below happens unless you choose Allow, and you can change your answer at any time in iOS Settings, Privacy & Security, Tracking.
If you allow it, the app starts TikTok’s Business SDK, which sends TikTok app installs and launches, App Store purchases, when you finish setting up, your Ojafi account identifier and email address, and device information including the advertising identifier. TikTok uses this to match your use of the app to a TikTok advert you saw or tapped, and to report that match to us. Our server may also connect your account to an advert or creator link you followed on our website, and tell TikTok or Acrune that it led to a sign-up or a purchase. If you choose Ask App Not to Track, none of this is sent.
Diary contents and health data, including what you eat and how you feel, are never shared for advertising, whatever you choose. Acrune receives receipts for purchases made in the app, with your internal account identifier, so that creator referrals can be reviewed for commission. Typed creator codes are self-reported evidence, and purchase bindings across the App Store boundary require review before earnings are confirmed.
Optional AI assistance
Before using AI assistance, you can choose whether to share your messages, selected photos or recordings, and relevant meal, symptom, plan and cupboard context with Anthropic or Google through Vercel AI Gateway to answer your request. You can decline and continue browsing guides and logging manually. Change this choice in Settings to stop future AI requests. Withdrawing permission does not recall requests already processed.
Feedback on AI replies
When you rate an AI reply, we save the rating, any reasons or note you add, and excerpts of your question and the reply with your account. These excerpts can include personal or health details from that exchange. We use this feedback to investigate problems and improve replies. Removing the rating deletes that feedback record. It is also included in your account data export and removed from our application database when your account is deleted.
Providers we use
Better Auth, Apple and Google (sign-in), RevenueCat (purchase entitlements), PostHog EU and Google Analytics (analytics), Meta (consented website advertising measurement), TikTok (advertising measurement), Acrune (advertising and creator referral attribution), Stripe and Whop (web payments), Resend (email), Vercel (hosting and AI Gateway), Anthropic and Google (optional AI processing), and our database host. Data handling by these providers is also subject to their applicable terms and privacy policies.
Plans and account backup
Your plan choices, starting notes, actions and reflections are kept on your device and backed up to your account when a connection is available and the server confirms the upload. My Plans and Settings show backup status; pending changes remain only on that phone. Sign in to the same account on another device to recover confirmed backups. Conflicting edits may be kept as separate recovered copies so you can review both. Plans migrated from older, unscoped storage require confirmation that they belong to your account before upload. Signing out preserves the account’s local plans. Account deletion removes the server backup and the plans on the device making the request. Unfinished intake drafts are cleared on sign-out; offline copies on other devices are not remotely erased.
How long we keep it
You can delete your account in Settings. A successful deletion removes the account and linked records from our application database. Paid order records are retained with the email, account link and quiz link removed. We also keep a deletion record containing a hash of your email, counts of removed records and details of retained records. Deleting the application account does not immediately erase provider-held copies. We queue a request to PostHog to remove the linked analytics profile, events and recordings, and retry failed submissions. PostHog processes event deletion asynchronously. While the request is pending, we retain the account and linked funnel identifiers needed to deliver it; these targets are removed after PostHog accepts the request. Payment-provider records are handled separately. Deletion does not cancel subscriptions. Contact us for requests covering provider-held data. Device-local plans on other devices are not remotely erased.
Your rights
Email help@ojafi.com for help accessing, exporting or deleting your data, including data held by our providers. Account export and deletion are also available in Settings.
Children
Ojafi is not for under-16s and we do not knowingly collect anything from them. If you believe a child has an account, write to us and we will remove it.