Privacy Policy

Effective April 29, 2026

This policy explains what information DishBish collects, how we use it, and the choices you have. If you have questions, email wisam@armaly.io.

1. Who we are

DishBish is a social recipe app for people who actually cook. "DishBish", "we", and "us" refer to the operators of dishbish.io and the DishBish mobile app.

2. Information we collect

Information you provide:

• Your phone number, used as your account identifier and to send you a one-time sign-in code.
• Your profile: display name, handle, bio, and avatar image.
• Content you create: recipes (text, photos, ingredients, steps), comments, "made-this" replies, cookbooks, likes, saves, and follows.
• Settings you choose: theme, language, and notification preferences.

Information we collect automatically:

• Your device push notification token, if you grant push permission.
• Server request logs (IP address, request path, timing, user agent) used for security, debugging, and abuse prevention. These logs are short-lived.
• In-app activity used by features you can see: last-seen timestamp, cooking streaks, badges earned, AI credit balance, and AI credit usage.

Information from purchases:

• If you purchase AI credits, we receive a receipt from Apple's App Store or Google Play to validate the purchase. We do not see your payment card or billing address — Apple and Google handle billing directly.

3. How we use your information

• To run the service: sign you in, show your recipes, deliver comments and follows.
• To send notifications you've opted into.
• To power AI features you trigger: photo and video recipe import, recipe customization (e.g. "make it vegan", "halve the servings"), and recipe translation.
• To keep the service safe: rate-limit abuse, prevent fraud, and debug issues.

4. Third-party processors

We use the following vendors to operate parts of DishBish. They process data on our behalf under their own privacy commitments:

• Twilio Verify — sends the one-time SMS code used to sign you in. Receives your phone number.
• Amazon Web Services (AWS) — hosts uploaded photos in Amazon S3 and runs the AI models we use (Anthropic Claude on Amazon Bedrock) for photo and video recipe import, customize, and translation. Photos and recipe text submitted to those features are sent to Bedrock.
• Expo Push — delivers push notifications to your device.
• Apple App Store and Google Play — process in-app purchases and provide the receipts we validate.
• USDA FoodData Central — public nutrition database we query by ingredient name. We do not send your identity to USDA.

5. What we don't do

• We don't show advertising in DishBish.
• We don't sell or "share" your personal information for cross-context behavioral advertising under California law.
• We don't use third-party analytics SDKs or third-party crash reporting.

6. What's public, what's private

Your published recipes, comments, likes, follows, and profile (display name, handle, avatar, bio, follower and following counts) are visible to other DishBish users and to anyone who visits the public web link for that recipe or profile. Your phone number is never shown publicly.

7. Data retention and account deletion

We keep your account information for as long as your account is active. You can delete your account at any time from inside the DishBish app: open Profile → Delete account and confirm. This permanently erases your profile, recipes, comments, follows, saved recipes, and AI credits. If you'd rather email us, write to wisam@armaly.io from the phone number on your account and we will complete deletion within 30 days. Some information may persist in encrypted backups for a limited period before being overwritten, and we may retain a minimal record where required by law.

8. Your rights

Depending on where you live (including the European Economic Area, the United Kingdom, and California), you have the right to access, correct, delete, or export the personal information we hold about you, and to object to or restrict certain processing. To exercise any of these rights, email wisam@armaly.io. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We protect data in transit with TLS. Authentication uses short-lived access tokens (15 minutes) and rotating refresh tokens with replay detection that revokes a token family on suspicious use. One-time SMS codes expire after 5 minutes. No system is perfectly secure — please report any suspected compromise to wisam@armaly.io.

10. Children

DishBish is not directed to children under 13 in the United States or under 16 in the European Economic Area, and we do not knowingly collect personal information from children in those age ranges. If you believe a child has provided us personal information, please contact wisam@armaly.io and we will delete it.

11. International data transfers

DishBish operates from, and our service providers (AWS, Twilio, Expo) may process data in, the United States and other countries. By using DishBish, you understand your information may be transferred to and processed in those countries.

12. Changes to this policy

We may update this policy as the service evolves. When we do, we will revise the effective date at the top of this page. For material changes we will also notify you in the app or by another reasonable means.

13. Contact

Questions, requests, or complaints: wisam@armaly.io.