Privacy Policy

1. Who we are

Jahanshasys, operating under the trade name "PourIt" ("PourIt," "we," "us," or "our"), is based in British Columbia, Canada and operates the PourIt mobile application, website (pourit.app), and related services (together, the "Service").

For privacy matters, Jahanshasys is the organization responsible for personal information under Canadian private-sector privacy law and, where the GDPR applies, the controller of personal data processed through the Service.

Privacy contact / Privacy Officer:
Jahanshasys (operating as PourIt)
British Columbia, Canada
Email: privacy@pourit.app (or support@pourit.app)

2. Scope

This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information when you use the Service. It is intended to align with:

• Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5
• British Columbia's Personal Information Protection Act (PIPA), S.B.C. 2003, c. 63
• Quebec's Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 (as modernized by Law 25 / formerly Bill 64)
• The EU General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, where it applies
• The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Cal. Civ. Code § 1798.100 et seq., where it applies
• The U.S. Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and the FTC COPPA Rule
• Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23, for commercial electronic messages

Which law applies depends on where you live, how we interact with you, and other facts. This policy is a transparency document, not a determination that every listed law always applies to every user.

3. Personal information we collect

The categories below are intended to match our App Store App Privacy and Google Play Data safety declarations.

3.1 Information you provide

• Account identifiers: name/display name, email address, profile photo URL (when you sign in with Google, Apple, or email registration)
• User content: favourites, personal recipes, preferences, feedback, and other content you submit
• Private-pilot organization data, if enabled: organization membership, roles, private recipes, training records, and related content submitted during an approved pilot
• Support correspondence: messages you send to us
• AI inputs: Tiny v1 does not accept AI recipe inputs. This policy will be updated before any public AI feature is enabled.

3.2 Information collected automatically

• Device and usage data: device model, OS version, app version, screen views, feature usage events, and similar analytics (Firebase Analytics)
• Crash data: crash stack traces, device state at crash time, and installation identifiers (Firebase Crashlytics)
• Authentication metadata: sign-in provider, user ID, and limited security metadata such as IP address and user agent (Firebase Authentication)
• Advertising identifiers (free tier): IDFA (iOS, subject to App Tracking Transparency) and GAID (Android) via Google AdMob, plus ad interaction data
• Push notification token (signed-in users only): if you sign in and allow notifications, Firebase Cloud Messaging issues a push registration token for that installation. We store the token together with your platform (iOS or Android), a randomly generated per-installation device identifier, and an update timestamp, so we can deliver organization alerts to your device. We do not request this if you use the app as a guest, and if you decline the operating system permission no token is collected. The record is deleted when you sign out.
• Website analytics: when you visit pourit.app, Google Analytics 4 (GA4) collects aggregate usage data (pages viewed, approximate region, device and browser type). GA4 runs under Google Consent Mode v2, with analytics and advertising storage denied by default. Accepting analytics enables analytics storage; advertising consent remains denied. You can change your choice using Cookie settings.

Launch notification requests: if you join our launch list, we store your email, signup time, source page (without its query string), and the notification consent you provided. This does not create an app account or sign you up for ongoing marketing. Use the unsubscribe link in your email or contact support@pourit.app to withdraw your request. To respect an opt-out after a contact is removed, we may retain a hashed email identifier in a restricted suppression list.

3.3 Future purchase-related information

• Pro (mobile): Pro is not offered in Tiny v1. If it is offered later, Apple App Store or Google Play would process payment and provide purchase confirmation data without providing full payment card numbers to PourIt.
• Team (web): public Team sales are not offered in Tiny v1. If a Team checkout is launched later, Stripe would handle card data and provide the billing details needed to provision the subscription.

3.4 Information we do not collect

• Precise location / GPS
• Contacts, photos, or microphone audio as a product feature
• Full payment card numbers (handled by Apple, Google, or Stripe)
• Personal information from children under 13 (see Section 12)

4. Purposes of collection and use

We collect and use personal information to:

• Provide, maintain, secure, and improve the Service
• Authenticate users and manage accounts
• Sync favourites, personal recipes, and preferences, plus organization content only in an explicitly enabled private pilot
• Process subscriptions only if a commercial plan is separately launched after this policy is updated
• Display ads to free-tier users and measure ad performance (AdMob)
• Send push notifications you have permitted, such as organization alerts and team messages
• Process AI inputs only if a public AI feature is separately launched after this policy is updated
• Analyze aggregate usage to improve features
• Monitor stability and diagnose crashes
• Respond to support requests and feedback
• Detect, prevent, and investigate abuse or security issues
• Meet legal and regulatory obligations

Under PIPEDA's limiting-collection principle (Schedule 1, Principle 4), we aim to collect only what is needed for identified purposes.

5. Legal bases (GDPR, where applicable)

Where the GDPR applies, we rely on one or more of the following bases under Article 6:

• Art. 6(1)(b) — contract: processing needed to provide the Service you request (account, recipes sync, subscription access)
• Art. 6(1)(a) — consent: where required (for example, certain advertising / tracking choices in the EEA/UK, optional communications)
• Art. 6(1)(f) — legitimate interests: security, abuse prevention, product improvement analytics, and service reliability, balanced against your rights
• Art. 6(1)(c) — legal obligation: where we must retain or disclose information to comply with law

We do not use automated decision-making that produces legal or similarly significant effects solely by automated means (GDPR Art. 22). Tiny v1 does not include AI recipe generation.

EU/UK representative (GDPR Art. 27): we do not currently appoint a dedicated EU or UK representative. If we appoint one, we will publish the representative's details on this page.

6. Consent and withdrawal (PIPEDA / PIPA / Law 25)

Where consent is the basis for collection, use, or disclosure, we seek knowledge and consent consistent with PIPEDA Schedule 1 Principle 3 and applicable provincial rules. You may withdraw consent subject to legal or contractual restrictions and reasonable notice (for example, by deleting your account or changing device ad/tracking settings). Withdrawal may limit features that depend on that processing.

We do not intentionally collect sensitive personal information such as health or biometric data as a product feature.

7. Third parties and processors

• Google Firebase (Authentication, Cloud Firestore, Analytics, Crashlytics, Cloud Functions, Cloud Messaging) — authentication, database, analytics, crash reporting, backend operations, push notification delivery. See Firebase privacy.
• Fastmail — our selected provider for branded account verification and password-reset emails, when enabled. This includes the recipient email address and the account-action message and link.
• Resend — delivers launch-request confirmations and launch notifications when enabled. It processes the recipient email, message and confirmation link, plus delivery, bounce, complaint and suppression events. Confirming a launch request does not subscribe you to ongoing marketing.
• Google AdMob — advertising for free-tier users (advertising ID / IDFA, device and ad interaction data). See Google Privacy Policy.
• Apple — Sign in with Apple; App Store billing only if a future Pro plan is launched
• Google Play — Google sign-in; Play billing only if a future Pro plan is launched
• Stripe — payment processing only if a future commercial web plan is launched

We do not sell personal information for money. Advertising technology may involve "sharing" or cross-context behavioral advertising as those terms are defined under California law; see Section 11.6.

Organization members may see your display name, role, and content you contribute within that organization.

We may disclose information if required by law, to protect rights/safety, or in a business transfer subject to comparable protections.

8. International transfers

Personal information may be processed on servers outside Canada (including the United States) through Google Firebase, AdMob, Apple, Google Play, Fastmail, and Resend. Stripe would be added for a future commercial web plan.

• Google Firebase processing is subject to Google's Firebase Data Processing and Security Terms and related cloud data processing terms.
• Where GDPR transfer rules apply, transfers may rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms used by our providers.
• Under Quebec Law 25, we use contractual and technical measures appropriate to the circumstances so personal information communicated outside Quebec receives an adequate level of protection.

9. Retention

• Account and user content: for the life of the account; deleted when you delete your account (subject to short technical purge windows)
• Organization membership: until you leave the organization or delete your account (organization-owned content may remain with the organization)
• Firebase Analytics: typically up to 14 months at the event level, then aggregated (provider default; may change)
• Crashlytics: typically about 90 days (provider default; may change)
• Purchase / billing records: retained as needed for accounting, tax, and dispute resolution (typically up to seven years where required by applicable law)
• Push notification token: kept while the installation stays signed in and registered; deleted when you sign out, delete the account, or the token is replaced
• Support correspondence: generally up to 2 years after resolution unless a longer period is needed
• Security / auth metadata: short periods as configured by Firebase for abuse prevention

After account deletion, associated Firestore user data is removed promptly. Firebase Authentication records may take additional time to purge fully under provider processes. Aggregated, de-identified analytics may be retained.

10. Security

We use commercially reasonable safeguards appropriate to the sensitivity of the information, including encryption in transit (TLS), provider encryption at rest on Firebase/Google Cloud, Firebase Authentication, and Firestore security rules that restrict access. No method of transmission or storage is completely secure.

12. Children's privacy (COPPA and age rating)

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13 (COPPA, 15 U.S.C. §§ 6501–6506). If you believe a child under 13 has provided personal information, contact privacy@pourit.app and we will delete it promptly.

The App contains alcohol-related content. Store age ratings will be shown on the respective store listings once assigned. A one-time age gate asks users to confirm they are of legal drinking age in their jurisdiction before use. See our Terms of Service for eligibility rules.

13. Commercial electronic messages (CASL)

We will only send commercial electronic messages with consent as required by Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23. Transactional messages (security alerts, purchase confirmations, service notices) may be sent as needed. You can withdraw marketing consent by unsubscribing or emailing us.

14. Data breach response

If we experience a breach of security safeguards involving personal information that creates a real risk of significant harm, we will notify affected individuals and applicable regulators as required (including PIPEDA s. 10.1 and, where applicable, BC PIPA and Quebec private-sector rules), describe the incident and steps you can take, and maintain required breach records.

15. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will update the "Last updated" date and, where practicable, provide in-app or email notice before changes take effect. Continued use after the effective date means you accept the updated policy. If you do not agree, stop using the Service and delete your account.

16. Contact and complaints

Jahanshasys (operating as PourIt)
British Columbia, Canada
Privacy: privacy@pourit.app
Support: support@pourit.app

If you are not satisfied with our response:

• Canada (federal): Office of the Privacy Commissioner of Canada — priv.gc.ca
• British Columbia: Office of the Information and Privacy Commissioner for BC — oipc.bc.ca
• Quebec: Commission d'accès à l'information du Québec — cai.gouv.qc.ca
• EEA/UK: your local data protection supervisory authority
• California: California Privacy Protection Agency / California Attorney General privacy resources