Privacy Policy

1. Overview

This Privacy Policy explains what personal data Devine collects through our website and mobile apps (the "Service"), how we use it, who we share it with, and the choices you have. It's part of, and should be read alongside, our Terms of Service.

2. Data we collect

Account & profile: name, email address, password (stored hashed by our authentication provider), profile photo, and bio.

Content & activity: recipes, articles, cookbooks, and comments you publish; follows, bookmarks, meal plans, shopping lists, and ratings; which creators you subscribe to.

Payment data: we do not collect or store full card numbers. Web payments are handled by Stripe; mobile in-app purchases are handled by Apple or Google. We receive and store only the minimum needed to manage your subscription — such as subscription status, plan, and renewal date — from Stripe, Apple, and Google, plus RevenueCat, which reconciles entitlement across platforms.

Device & usage data: IP address, device and browser type, approximate location derived from IP, pages viewed, and app usage events, collected automatically to operate, secure, and improve the Service.

Advertising data: on the web app only, when an ad is shown on a free recipe or a creator page, Google receives the information described in §5 below. Devine's own record of an ad view stores no IP address, no device or browser identifier, and no precise location — only a one-way daily hash of a random session token, which we delete after 90 days.

Push notification tokens if you enable notifications on mobile, so we can notify you about creators you follow.

3. How we use your data

• To provide the Service — accounts, feeds, subscriptions, purchases, and payouts
• To process payments and prevent fraud
• To send transactional email (receipts, password resets, subscription updates) and, if you opt in, product updates
• To personalize your feed and recommendations
• To show advertising on free recipes and creator pages, which helps pay the creators you read (see §5 and §6)
• To secure the Service, debug issues, and enforce these policies
• To comply with legal obligations, such as tax reporting for creator payouts

We do not sell your personal data for money. We do show third-party advertising on the web app, and showing you a *personalized* ad involves sharing limited information with Google — which some US state privacy laws classify as "sharing" for cross-context behavioral advertising, and in some states as a "sale" even where no money changes hands. You can turn this off at any time: see §6.

The mobile apps carry no third-party advertising and no third-party ad cookies — the only promoted content there is Devine's own sponsored cards in the feed, which involve no outside advertiser and no data sharing.

4. Who we share data with

We share data only with service providers who help us run Devine, under contract:

• Supabase — database, authentication, and file storage
• Stripe — web payment processing and creator payouts (Stripe Connect)
• Apple / Google — mobile in-app purchase processing
• RevenueCat — unifying subscription entitlement across web and mobile
• Resend — transactional email delivery
• Vercel — web application hosting
• Google (AdSense) — serving advertising on the web app, and its consent management service in regions where consent is required. See §5 and §6.
• other creators, in aggregate or anonymized form (for example, subscriber counts), and other users, for content you choose to make public (your profile, published recipes, public comments)

We may also disclose data if required by law, to protect the rights and safety of Devine or our users, or as part of a merger, acquisition, or sale of assets — in which case we'll notify you before your data becomes subject to a different privacy policy.

5. Cookies and advertising

The web app uses essential cookies to keep you signed in and to remember preferences, including your advertising choices.

The web app also shows third-party advertising on free recipes and creator pages, served by Google AdSense. Where an ad is shown, Google may set advertising cookies or similar identifiers and may receive your IP address, browser and device information, and the page you are viewing, in order to select and measure ads. Google's handling of that data is governed by its own privacy policy and advertising notices.

Ads are never shown:

• on content you have paid for
• on account, settings, checkout, or payment pages
• on a creator's pages unless that creator has opted in
• anywhere in the mobile apps

Advertising is not affected by whether you subscribe to Devine Plus.

6. Your advertising choices

In the EEA, the UK, and Switzerland, we ask for your consent before any advertising cookie is set, through a consent management platform certified under the IAB Transparency & Consent Framework. Until you answer, no advertising script is loaded and no ad request is made. You can change your answer at any time using the Cookie settings link in the footer of every page.

In the United States, you can opt out of the sale or sharing of your personal information for advertising using the [Do Not Sell or Share My Personal Information](/legal/do-not-sell) link in the footer of every page. It takes one click and no account. Opting out does not remove ads — you will still see ads, just non-personalized ones. If you are signed in we store the choice on your account so it applies on every device you use; if you are signed out we store it in your browser.

Global Privacy Control. We recognize the Global Privacy Control signal. If your browser or extension sends it, we treat you as opted out automatically on every page — you do not need to use the link above, and we will tell you so on the Do Not Sell page. For signed-in readers we save that opt-out to your account so it follows you to devices whose browser does not send the signal.

7. Data retention

We keep your data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where we're required to retain records (for example, payment and tax records for creator payouts) for legal, accounting, or fraud-prevention purposes.

Records of ad views are deleted after 90 days. Your advertising opt-out is kept for at least 12 months, and for as long as your account exists, so we do not have to ask you again.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to opt out of the sale or sharing of your personal data and of targeted advertising.

• Export: download a copy of your data anytime from Settings.
• Delete: permanently delete your account and associated data from Settings.
• Correct: update your profile and account details directly in the app.
• Opt out of ad personalization: use Do Not Sell or Share My Personal Information, or the Cookie settings link in the footer.

We will not discriminate against you for exercising any of these rights — your access to Devine, and what it costs, does not change.

For requests we can't handle through in-app tools, email privacy@devine.app. We'll respond within the time required by applicable law.

9. Security

We use industry-standard safeguards — including encryption in transit, database row-level security so users can only access their own or authorized data, and access controls on our infrastructure — to protect your data. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security.

10. Children's privacy

Devine is not directed to children under 16, and we don't knowingly collect personal data from them. If you believe a child has provided us data, contact us at privacy@devine.app and we'll delete it.

11. International data transfers

Our service providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers of data out of the European Economic Area, the UK, or Switzerland.

12. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we'll notify you by email or in-app notice before they take effect.

13. Contact

Questions about this policy or your data? Email privacy@devine.app.