Privacy Policy

1. Who we are

iDoughMath is made by Hanamori Labs, LLC (“we”, “us”). We are responsible for the personal information described in this policy (the “controller”, in data-protection terms). This policy covers the iDoughMath iPhone app and this website.

Hanamori Labs, LLC · 1111B S Governors Ave, Dover, DE 19904-6903, USA · [email protected]

2. What stays on your iPhone

The app keeps the following in its own storage on your iPhone. We don’t receive it unless you sign in and it is part of the backup described in section 4.

• Your recipes: titles, ingredients and amounts, steps, reminders, folders, favourites, the recipe’s source link and creator, earlier versions, and recently deleted recipes (kept for 10 days so you can restore them).
• Recipe photos, step photos and video clips, and the main photo taken from a recipe web page when you save it.
• Your Decor Inspo board: web addresses of the pictures you save, links back to where they came from, photos you add, your notes and folders.
• Running step timers and their alarms.
• Your ingredient prices (version 1.1 and later): each product’s name, price, pack size, where you buy it, its photo and, if you scanned it, its barcode number. Only the products you choose to share leave your iPhone (section 10, “The shared product database”).
• Your settings, such as language and how photos are shown, and whether you have Pro (so Pro works offline).
• If you sign in, the sign-in session, so you stay signed in.

Deleting the app removes all of this from your iPhone. Your iPhone’s own backups (iCloud or computer backups) may include the app’s data, under Apple’s terms and your settings.

3. Your optional account

You can use every feature without an account. If you choose to sign in, we use Google Firebase Authentication to create and manage your account. Depending on how you sign in, Firebase stores:

• Email and password: your email address and your password in scrambled (hashed) form. We never see your password.
• Sign in with Apple: an identifier from Apple, and the email address and name Apple shares with us. You can choose Apple’s “Hide My Email”, in which case we receive a private relay address.
• Google: an identifier from Google, your email address, and your name and profile picture link if Google provides them.

Firebase also keeps a user ID for your account and the dates it was created and last signed in. If you ask to reset your password, Firebase sends the email for us. Google processes technical information such as your IP address to provide and protect the sign-in service.

4. Backup of settings, recipes and Business documents

While you are signed in, the app backs up to Google Cloud Firestore, a Firebase database hosted in Singapore:

• Settings: your chosen app language, photo view, and folder names.
• Saved recipes: the recipe as text: title, ingredients and amounts, yield and pan, steps and reminders, folder and favourite, source link, title and creator, which ingredients you ticked, how often you baked it, the file names of its photos on your phone, and (version 1.1 and later) which of your products it uses for each ingredient and the price you sell it for. Your ingredient prices themselves stay on your iPhone, unless you share a product with the community (section 10). When you delete a recipe, a small “deleted” marker replaces it so your other phones remove it too.
• Business tab documents (Pro, version 1.1 and later): if you are signed in, the quotes, pop-up market plans, menus and saved costings you keep in the Business tab are backed up the same way, as text: their names, the recipes used, quantities, prices, costs and the currency. When you delete one, a small “deleted” marker replaces it so your other phones remove it too. A menu’s notes for customers (order deadline, delivery fee and extra notes) are part of the menu and back up with it. Your shop name and logo are kept only on your iPhone and are not uploaded. They are deleted with your account (section 15). Orders you keep in the Orders calendar (the customer names and phone numbers you type, the items, invoice numbers and pickup details) back up with the Business documents and are deleted with your account; your customers’ details are your own records and are never shared.

Photos and clips are not uploaded. They stay on the iPhone where you added them. Your backup is protected by access rules so only you, signed in, can read or change it. We don’t look at it except when you ask us to help with a problem or when the law requires it. Pro status is never stored in the backup; it is restored through the App Store.

5. Subscriptions and purchases

iDoughMath Pro is sold through Apple’s App Store. Apple handles payment; we never receive your card or payment details.

We use RevenueCat to check whether you have Pro and to show the right prices. RevenueCat receives:

• an app user ID: a random ID that RevenueCat creates for this installation of the app or, while you are signed in, your iDoughMath account ID, so that Pro follows you to a new phone. It is never your name or email;
• your App Store purchase and subscription information, such as the product, dates, price and currency, store country, and Apple’s transaction identifiers;
• technical information needed to answer the app’s requests, such as device model, iOS and app version, language, and IP address.

“Restore purchase” asks the App Store for purchases made with your Apple Account, so Pro can move to a new phone without an iDoughMath account.

6. Features that run on your iPhone

These features use Apple frameworks built into iOS. The app does not send your content to us or to any other service for them.

• Reading a recipe from a photo uses Apple’s Vision text recognition on your iPhone.
• Reading a shop receipt (version 1.1 and later) to fill in ingredient prices uses the same text recognition on your iPhone. The receipt photo and its text are not uploaded or kept; only the prices you choose to save are kept, in your price list on your iPhone.
• A supermarket trip (Pro, version 1.1 and later), where you photograph products with their shelf prices to fill in ingredient prices, uses the same text recognition on your iPhone. The photos stay on your iPhone: they are kept as the pictures of the products you save, and photos you skip or don’t save are deleted. They are never uploaded, including when a price is shared. Only prices you confirm and save are kept, in your price list on your iPhone, and are shared with the community only as that product’s sharing switch says (section 10).
• Translating a recipe when you share it (Pro) uses Apple’s Translation framework on your iPhone. The first time you use a language, your iPhone may download it from Apple; after that it translates without the internet.
• Reading steps aloud (Pro) uses the voices built into iOS.
• Timer alarms are scheduled on your iPhone as local notifications or, on iOS 26 and later if you allow it, as alarms. We don’t use push notifications, so we don’t receive a push token.

7. Links, websites and in-app browsing

• Pasting a link. When you paste a link to a recipe website, a YouTube video or an Instagram post, your iPhone requests that page directly from the site to read the recipe, its title, photo and creator. For YouTube it may also ask YouTube’s public title service, and for YouTube links the app also asks YouTube’s API for the video’s comments and uses only the creator’s own; for Instagram it opens the post’s public embed page; if a video description links to the creator’s recipe page, that page is read too. These requests go straight from your iPhone to those sites, which see your IP address and a normal web request under their own privacy policies. They do not pass through any server of ours.
• Find a recipe and Decor Inspo search open Google, Google Images or Pinterest inside the app. Those sites handle your visit, including any cookies they set, under their own privacy policies. Links to other websites open in Safari.
• Scanning a barcode (version 1.1 and later). When you scan the barcode on an ingredient’s pack to fill in its details, the app first looks for it among the products you saved on your iPhone, then in the shared iDoughMath product database (section 10), which receives only the barcode number. If it isn’t there, your iPhone sends only the barcode number to Open Food Facts (openfoodfacts.org), a free, open database of food products, to look up the product’s name, pack size and photo, and downloads that photo to keep with the product on your iPhone. Nothing else about you is sent: no account, name, prices or recipes. Like any website, Open Food Facts sees your IP address and a normal web request, under its own privacy policy. Prices never come from a scan; you type what you paid.
• Typical prices (version 1.1 and later, for recipes priced in Malaysian ringgit, Hong Kong dollars or Singapore dollars). When the app shows typical ingredient prices, your iPhone downloads one small file of shop prices for that country from our own website (idoughmath-hanamori.web.app, on Firebase Hosting) and keeps it on your iPhone for later. The request carries nothing about you, your recipes or your prices; like any website, Firebase Hosting sees your IP address and a normal web request. The prices come from government open data: Malaysia’s PriceCatcher (data.gov.my), Hong Kong’s DATA.GOV.HK and Singapore’s Department of Statistics.
• Exchange rates (version 1.1 and later). When you choose to convert your ingredient prices into another currency, your iPhone downloads the European Central Bank’s daily euro reference rates from Frankfurter (frankfurter.dev), a free, open-source exchange-rate service, and keeps them on your iPhone for later. The request asks for the whole table of rates, so it doesn’t even name the currencies you use; nothing about you, your prices or your recipes is sent. Like any website, Frankfurter sees your IP address and a normal web request; it says it keeps no request logs (frankfurter.dev, FAQ).
• Decor Inspo saves the web address of a picture and a link back to its page, like a bookmark, on your iPhone. When the board shows the picture, your iPhone loads it from the site that hosts it.

8. Photos, camera and microphone

The app asks for access only when you choose to use a feature: your photos to add pictures to recipes and steps or to read a recipe from a photo; the camera to take those photos or clips, or to scan a product’s barcode (the barcode is read on your iPhone and the camera picture is not saved or sent), or to photograph shelf prices on a supermarket trip (section 6); and the microphone to record sound with step clips. What you pick or record is saved in the app on your iPhone and is not uploaded by us, except a photo you choose to add to a community post, or the photo of a product you share with the community (section 10). You can change these permissions any time in your iPhone’s Settings.

9. Sharing you choose

When you share a recipe, a PDF, a shopping list or a Decor Inspo collage, the app creates it on your iPhone and hands it to the app you pick (for example WhatsApp, Messages or Mail). What happens next is between you, the people you send it to, and that app. Shared recipes and collages include the App Store link to iDoughMath and credit the original creator or picture source when known.

10. The baking community

From version 1.1, the app has a community where bakers share their finished bakes, recipes, photos, questions and tips in groups. Anyone using the app can read it without an account. To post, comment, give a “Yum” (the app’s upvote) or create a group you need to sign in and agree to the community rules.

What is public. Everything below can be seen by anyone who uses the app:

• your display name, which you choose (we suggest the name from your sign-in, never your email address), and a coloured circle with its first letter;
• your posts: the group, title (or a bake’s caption) and text, the recipe you share (title, ingredients and amounts, yield and pan, steps and reminders, and the original creator’s name and link if the recipe came from someone else), and for a finished bake, what you say it was made with (a recipe’s title and who it is by, or a link to a community post). Step photos and clips are not included;
• up to four photos you add to a post, each made smaller on your iPhone (about 1600 pixels) before it is sent;
• your comments and replies, each with an optional photo (made smaller on your iPhone the same way), and the number of Yums and comments on each post. Who gave a Yum to which post is not shown to others;
• groups you create: the name, emoji, description and bake type. Your display name is not shown on a group;
• the time each post and comment was made, and, if you edited it, that it was edited and when.

Where it is kept. Posts, comments, Yums, groups, display names and the date you accepted the rules are stored in Google Cloud Firestore (Singapore). Post and comment photos are stored in Cloudflare R2 and shown to readers from cdn.idoughmath.com. They are named with your account’s user ID, and the server that receives them checks your sign-in, so that only you can change or delete them; a group you create is linked to your user ID so that only you can edit it. To limit each baker to three new groups a day, we also keep a private count of the groups you created today, which only you can read. Anyone who reads a post can save its recipe into their own collection, with credit to you; that copy is theirs and stays on their iPhone.

Editing. You can edit your posts (title or caption, text, photos and group) and your comments at any time. The new version replaces the old one, which we don’t keep, and the post or comment shows “edited” with the time. Photos you take off a post are deleted from our storage. A group’s creator can change its emoji, description and bake type at any time, and its name until someone posts in it.

Reports and blocks. Anyone can report a post, comment or group, with a reason and an optional note. A report stores what was reported, whose it is, the reason and note, the time, and, if the reporter is signed in, the reporter’s user ID. Only our moderators can read reports; the person reported is not told who reported them. When you block someone, the list of people you blocked is kept on your iPhone and, if you are signed in, in your account so it works on your other phones. Nobody else can see it. What you reported is hidden for you on your iPhone.

Moderation. To keep the community safe, the app checks posts, comments, display names and group names and descriptions (new and edited) against a list of objectionable words on your iPhone before they are sent, and our moderators review reports and may hide or remove posts, comments, groups or accounts that break the rules. The community rules and terms are in our Terms of Use.

Deleting. You can delete any of your posts or comments in the app at any time; a post’s or comment’s photos are deleted with it. Deleting your account (section 15) also deletes your posts and their photos, your comments and their photos, your Yums, your block list, your display name, the groups you created that nobody has posted in, and your count of groups created today. A group you created that has posts stays for the bakers who use it, no longer linked to your account. Comments other people left under a post you deleted can no longer be seen in the app. Copies of your recipes that other people saved to their own collections stay with them. Reports you sent are kept for our moderation records.

The shared product database

From version 1.1, bakers can share the ingredients they price, so others can see what a product usually costs near them. Anyone using the app can see shared products and prices without an account. Sharing needs you to be signed in.

Your choice, for each product. When you add or edit a product’s price, the form has a “Share with the iDoughMath community” switch. It is on unless you switch it off, and the form explains what it shares. In “Price this recipe” and when you save prices from a receipt, one switch, “Share prices I type with the community”, covers the new products you price there, and you can still change it for any product in its form. Switch it off for a product and it isn’t shared; if you shared it before, the prices you shared for it are removed when you save. Only prices you type are shared: a typical price or a community price you picked from a list is never shared back, and nothing is shared while you are signed out.

What is public. The product’s name as you wrote it, its pack size, its barcode number if you scanned it, and its photo (made smaller on your iPhone); and, for each price, the amount and currency, the country your iPhone is set to, your state if you chose one (Malaysia), the shop if you wrote one, and the month. Other bakers see a typical price worked out from these, such as “usually RM 12.50 in Selangor”, and can add the product to their own price list.

Anonymous. Shared products and prices never include your name, display name, email or account ID, and nobody else can find out who shared them. To let you remove your own prices, and to allow one price per product per day, your account keeps a private list of the prices you shared (which product, and when). Our database rules let only you read that list, and it is never shown to anyone. We don’t look at it except when you ask us to help with a problem or when the law requires it.

Reports and moderation. Anyone can report a shared product or a price as wrong, offensive or spam, with the same report details as for posts. Reports go to our moderators, who may hide or remove products and prices. Nobody can change a product or price someone else shared.

Deleting. Switching sharing off for a product removes the prices you shared for it. Deleting your account (section 15) removes every price you shared and your private list. Shared products themselves (a name, a pack size, a barcode and a photo) stay, because they don’t identify anyone; to ask us to remove a product photo you shared, email [email protected]. Products and prices are stored in Google Cloud Firestore (Singapore), and product photos in Cloudflare R2, shown from cdn.idoughmath.com. A product photo’s address does not contain your user ID.

11. What we don’t do

• No advertising, and no advertising or analytics tools in the app.
• No tracking across other companies’ apps or websites, and no advertising identifier.
• We don’t sell or share personal information, including for targeted advertising.
• We don’t send your recipes or photos to any service to be read, rewritten or analysed.

Apple may give us App Store statistics (such as downloads) and crash reports from people who chose to share them with app developers in their iPhone’s settings. These come to us from Apple under Apple’s privacy policy and don’t identify you.

12. Service providers

These companies process information for us, only to provide the services described:

Their privacy policies: Firebase, Google, RevenueCat, Apple.

13. Legal bases (EEA, UK and similar laws)

• To provide what you ask for (performing our contract with you): your account, backup and restore, Pro subscription status.
• To provide what you ask for also covers showing the posts and comments you publish in the community.
• Legitimate interests: keeping accounts, the service and the community secure, handling reports and blocks, and preventing misuse.
• Consent: access to photos, camera and microphone, which you can withdraw in your iPhone’s Settings; and sharing a product and its price with the community, which you can switch off for each product at any time.
• Legal obligations: keeping records we are required to keep, and answering lawful requests.

14. How long we keep data

• Account and backup: until you delete your account. Google may keep deleted data in its internal backups for a limited time before it is overwritten.
• Community posts, photos and comments: until you delete them or your account, or a moderator removes them. Groups you create: until you delete your account (a group with posts then stays, no longer linked to you), or a moderator removes them. Reports are kept as long as needed to handle them and keep the community safe, and no longer than two years unless the law requires more.
• Shared products and prices: a price you shared stays until you switch sharing off for that product, delete your account, or a moderator removes it. Shared products stay while they are useful to bakers, as they identify no one.
• Purchase records: RevenueCat keeps subscription records while they are needed to provide Pro and for accounting, tax and legal purposes. Apple keeps its own records of your purchases.
• On your iPhone: until you delete it, or delete the app. Recently deleted recipes are cleared for good after 10 days.
• Emails to support: as long as needed to help you and keep a record of what we agreed, unless the law requires longer.

15. Deleting your data

In the app, go to Settings, then Delete account. This deletes your backed-up recipes, your backed-up Business tab documents, your backed-up settings, everything you posted in the community, the groups you created that nobody has posted in (section 10), the prices you shared with the product database and your private list of them (section 10), and your account itself. For your safety, Firebase may ask you to sign out and sign in again first. The recipes on your iPhone stay until you delete them or the app.

Deleting your account doesn’t cancel a Pro subscription; cancel it in your iPhone’s Settings under your name, then Subscriptions. To ask us to delete purchase records held by RevenueCat, or anything else, email [email protected]. Because the RevenueCat ID isn’t linked to your name, we may ask for the order ID from your Apple receipt to find the right record.

16. Security

Connections to Firebase and RevenueCat are encrypted. Backed-up data can only be read or changed by your own signed-in account, under database rules we test. Passwords are never stored in plain text. No system is perfectly secure, so please use a strong password and keep your iPhone protected with a passcode.

17. Your rights

Wherever you live, you can ask us to access, correct, delete or export your personal information, and you can delete your account in the app at any time.

• EEA and UK: you also have the right to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to your local data-protection authority.
• California and other US states: you have the right to know what personal information we collect and how we use it, and to delete and correct it. We don’t sell or share personal information and don’t use sensitive personal information to infer characteristics about you. We will not treat you differently for using your rights.

To make a request, email [email protected]. We will reply within the time the law requires (usually 30 days, or 45 days in California), and may need to confirm the request comes from you, for example by replying from the email address on the account. You may use an authorised agent where the law allows.

18. International transfers

Our service providers may process information in the United States, Singapore and other countries, which may have different data-protection laws from yours. Where the law requires, these transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses, provided through our providers’ data-processing terms.

19. Children

iDoughMath is a general-audience app and isn’t directed at children under 13 (or the minimum age in your country). An account is optional, and we don’t knowingly collect personal information from children. If you believe a child has created an account, email us and we will delete it.

20. Changes to this policy

If we change how the app handles information, we’ll update this page and the effective date above. If a change is significant, we’ll take reasonable steps to let you know before it takes effect.

21. Contact

Questions or requests: [email protected]
Hanamori Labs, LLC · 1111B S Governors Ave, Dover, DE 19904-6903, USA