Privacy Policy

Introduction

Cookoff ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our cook-off voting platform and related services (the "Service").

By using Cookoff, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

Information We Collect

Personal Information

When you register for an account, ask us to email you a sign-in link, or use our Service, we may collect:

• Email address
• Name
• Profile information
• Password (encrypted)

Voting and Event Data

When you participate in or organize cook-off events, we collect:

• Votes and scores you submit
• Comments and feedback
• Photos of food entries you or an event organizer upload
• An event logo, if the organizer uploads one for their cook-off
• Event preferences and settings
• Scoring mode scores and judging criteria responses

Usage Information

We automatically collect certain information about your device and how you interact with our Service:

• IP address
• Browser type and version
• Device information
• Pages visited and features used
• Time and date of visits
• Error logs and diagnostic data

Mobile App Data

When you use our iOS app, we may additionally collect:

• Device identifiers
• Biometric authentication data (stored locally on your device only)
• Camera access - to scan invite QR codes and to capture profile photos and dish photos

How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain our Service
• To process and tabulate votes in cook-off events
• To send you voting invitations and event notifications
• To communicate with you about your account or events
• To improve and optimize our Service
• To detect, prevent, and address technical issues or fraud
• To comply with legal obligations
• To calculate and display results and winner announcements

Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

Within Your Events

Event organizers and collaborators can see:

• Judge names and email addresses for events you participate in
• Your votes, scores, and comments (within that event)
• Your participation status

Shared Links

Invite and results links show a preview when they are pasted into a messaging app or social network. That preview includes the event's name, its date, and the name of the person hosting it, and the messaging or social platform fetches it from us to build the card - so anyone the link is forwarded to, and that platform, can see those details without opening the link. Only event and host details appear; judge names, scores, and email addresses never do.

Service Providers

We use third-party service providers to help us operate our Service:

• Supabase - Database and authentication services
• Vercel - Hosting and deployment, and privacy-friendly traffic analytics on our marketing site - page views and where visitors arrived from, with no cookie and nothing that identifies you
• Resend - Email delivery, including whether you opened an email or clicked a link in it
• Mixpanel - Product analytics, including session replay - see Cookies and Tracking Technologies below
• Sentry - Error monitoring on web and iOS; error reports may include your account information, but not your IP address or session cookies
• Google Analytics - Traffic analytics on our marketing site only, and only if you accept our cookie banner
• Upstash - Rate-limiting infrastructure that stores your IP address to prevent abuse

Legal Requirements

We may disclose your information if required by law or in response to valid legal requests.

Data Security

We take the security of your data seriously and implement industry-standard measures to protect it:

• Encrypted data transmission (HTTPS/TLS)
• Encrypted password storage using bcrypt
• Row-level security policies in our database
• Secure authentication with session tokens
• Regular security updates and monitoring
• Biometric data (Face ID/Touch ID) stored only locally on your device

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.

Data Retention

We retain your information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy:

• Account information is retained until you delete your account, at which point it is anonymized as described below
• Event data is retained as long as the event exists
• Votes and results are retained to maintain event integrity
• If you ask for a sign-in link but never use it, the placeholder account we created for that email address is deleted automatically after 30 days
• Infrastructure and analytics logs (hosting, error monitoring, rate-limiting) are retained according to our service providers' standard retention periods

You can delete your account directly in the app from Profile → Delete Account. If you still own any cook-off, you'll need to delete it first - we can't remove your account out from under an event, or a results page, that other people are relying on. Once you confirm, we immediately clear your active sessions and anonymize your profile: your name, email, password, and photo are removed and replaced with a generic placeholder. Your votes, scores, and feedback stay attached to that anonymized profile rather than being deleted outright, so cook-off results and leaderboards other participants rely on stay accurate - they just no longer show anything that identifies you. We also keep a permanent, non-identifying record that a deletion occurred, for audit purposes.

Your Rights and Choices

You have the following rights regarding your personal information:

• Access - Request a copy of your personal data
• Correction - Update or correct your information
• Deletion - Request deletion of your account (see Data Retention above for what this does)
• Export - Email privacy@cookoff.dev to request a copy of your data in a portable format
• Opt-out - Unsubscribe from marketing emails (account-related emails may still be sent)

To exercise these rights, use in-app settings when available (including account deletion) or contact privacy@cookoff.dev for support requests.

Children's Privacy

Our Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete it.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. These countries may have different data protection laws. By using our Service, you consent to the transfer of your information to these countries.

Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to improve your experience:

• Session cookies - To keep you logged in
• Local storage - To remember your preferences and app state on this device
• Analytics - Mixpanel, to understand how you use Cookoff, and Google Analytics and Vercel Web Analytics on our marketing site only
• Referral cookie - A single cookie recording where you first arrived from - a search engine, a link, or a campaign - so we can tell which of them bring people to Cookoff. It holds no name, email address, or account identifier, and it expires 30 days after your last visit

Session replay: Mixpanel, our product analytics provider, may record a replay of your session - including clicks and scrolling - to help us diagnose bugs and understand how people use Cookoff. On-screen text is masked in these recordings, and images, video, and audio are excluded from them entirely. What you type while setting up an event - cook-off, dish, category and criteria names and their descriptions - is recorded, so we can see where setup goes wrong. What you type into personal or sensitive fields is not: your name, passwords, email addresses, phone numbers, sign-in codes, invite links, feedback you send us, and notes you write about a dish are all masked before the recording leaves your browser.

You can control cookies through your browser settings, but some features may not work properly if you disable them. If your browser sends a Do Not Track signal, we do not load Google Analytics, Vercel Web Analytics, or Mixpanel in your browser. Our servers still record the actions you take in the app - creating an event, voting - because that is how the product works.

Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read the privacy policies of any third-party sites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: