Privacy Policy

Last updated: April 23, 2026

This Privacy Policy explains how ChefxDoor (“we”, “us”, “our”) collects, uses, and shares information when you use the ChefxDoor mobile application and related services (the “Service”). By using the Service you agree to this Policy.

1. Information We Collect

Information you provide

Phone number. Required to create an account and receive SMS verification codes. We store phone numbers in a hashed form for lookup and matching; the plaintext number is retained only where it is required to deliver SMS to you.
Date of birth. Collected via an age‑verification step the first time you use this version of the Service, whether your account is new or already existed. You cannot continue using the Service without providing a date of birth that confirms you are at least 18 years old. We store the date of birth, a derived age‑verified flag, and the timestamp of verification. We do not display your date of birth to other users.
Profile information. Name, profile photo, and (for cooks) kitchen name, bio, cuisines, and dietary tags.
Listing and request content. Photos, descriptions, prices, pickup or delivery locations, and any text you submit when creating menus, stories, food requests, offers, messages, or reviews.
Communications. Messages you send to other users through the in‑app chat, and support requests you send to us.
Consent and acceptance records. The version of our Terms of Service and this Privacy Policy you accepted, the date and time of acceptance, and your SMS consent choices (transactional and, if applicable, marketing), each stored with a version number, timestamp, source screen, and the IP address and user agent at the time of consent. We retain these records to demonstrate compliance with applicable law (including TCPA and consumer-protection rules).

Information collected automatically

Device and app information. Device model, OS version, app version, language, and crash diagnostics.
Approximate or precise location. Used to surface nearby cooks, food, and requests, and to compute pickup or delivery distance. Precise location is only collected if you grant the permission; you can revoke it in your device settings at any time. Other users see derived information such as approximate distance or area — they do not see your raw coordinates.
Push notification token. Used to send order, message, and request notifications to your device. We also record the device name and OS version at the time of registration so we can target a notification to the right device.
Authentication and security logs. Sign‑in attempts, verification‑code requests, IP address, and user agent, kept for fraud and abuse prevention and for investigating security incidents.
Usage data. Pages viewed, items tapped, search queries, and timestamps, used to operate and improve the Service. Some events also include a small structured metadata payload (for example, the identifier of the button you pressed or the navigation path you came from) that we use for analytics and debugging.

Information from third parties

SMS provider (Twilio). Delivery status of verification codes and other SMS we send, including STOP/HELP keyword events used to honor opt‑outs.
Object storage and content delivery providers (including Cloudflare Stream and Cloudflare Images). Hosting, transcoding, and streaming of photos and videos you upload.
AI providers (OpenAI). When you use AI‑assisted features, text you provide for that feature (such as dish names, ingredients, or descriptions) may be sent to OpenAI to produce a response. In production, this traffic is allowed only through our configured privacy‑preserving integration route; if that route is unavailable, the AI feature is unavailable. We do not send user‑uploaded photos or videos, profile photos, phone numbers, dates of birth, or other contact details to AI providers in production.

2. How We Use Information

To create and authenticate your account, including age verification and SMS verification codes.
To match cooks and customers, display listings, route messages and orders, and process requests and offers.
To send transactional SMS and push notifications — verification codes, security alerts, new messages, new offers, accepted offers, order updates, and other essential service messages. These cannot be turned off without losing the ability to use the Service.
To send marketing SMS — only if you have explicitly opted in via Settings → Notification Settings → SMS Preferences. Marketing SMS is off by default and can be turned off again at any time, in‑app or by replying STOP.
To prevent fraud, abuse, and security incidents, to enforce our Terms, and to investigate reports.
To debug, monitor, and improve the Service.
To comply with legal obligations and to maintain records of consent and policy acceptance.

3. How We Share Information

With other users. Your public profile (display name, photo, bio for cooks), your listings, your stories, your requests and offers, and any messages you send to a counterparty are visible to that counterparty as needed to operate the marketplace. We do not share your date of birth, raw coordinates, hashed phone, IP address, or consent records with other users.
With service providers. Hosting, database, SMS delivery (Twilio), push delivery, video streaming and content delivery, error monitoring, analytics, and AI processing providers, under contracts that limit them to processing data on our behalf.
For legal reasons. When required by law, court order, or to protect the rights, property, or safety of ChefxDoor, our users, or the public.
In a business transfer. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred subject to this Policy.

We do not sell your personal information.

We do not use your data to track you across apps or websites owned by other companies, and we do not use advertising identifiers for targeted advertising. ChefxDoor therefore does not request App Tracking Transparency permission.

4. Messaging, Moderation, and Admin Access

Private messages between users are accessible to the sender and the recipient. ChefxDoor staff do not routinely read private messages. We may, however, access message content, listing content, story content, or report metadata in the following limited circumstances:

Reports and flags. When a user reports content or another user, the reported content and surrounding context may be reviewed by our moderation team to enforce our Terms and Community Guidelines.
Automated abuse detection. Our systems may flag content (for example, suspected spam, fraud, or unsafe behavior) for review.
Legal or safety obligations. When required by law, court order, or to address an imminent threat to a person’s safety.
Debugging. A small number of authorized engineers may access technical logs that contain message metadata (such as timestamps and identifiers) when investigating an incident; access is logged and limited to what is necessary.

Access to user data inside ChefxDoor is restricted to authorized staff under a need‑to‑know basis, and administrative actions are logged.

5. Data Retention

Account information (profile, listings, messages) is retained for as long as your account is active. After deletion, content is removed or anonymized within a reasonable period, except where retention is required by law or for ongoing dispute resolution.
Consent records (Terms acceptance, Privacy acceptance, SMS consent) and authentication logs are retained for a longer period — typically several years — to comply with TCPA, consumer‑protection, and audit requirements, even after your account is deleted.
Backups may contain residual copies of your data for a limited period after deletion before they are overwritten in the normal backup rotation.

You may request deletion of your account at any time (see Section 8).

6. Security

We use industry‑standard safeguards including encryption in transit (TLS), hashed phone numbers in our database, signed authentication tokens, scoped access controls for staff, and audit logs of administrative actions. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

7. Age Restriction and Children

ChefxDoor is intended for users who are at least 18 years of age. The Service is not directed to, and we do not knowingly collect personal information from, anyone under 18. We do not knowingly collect personal information from children under 13, and the Service is not intended to be used by children under 13 in any capacity. If you are under 18, you may not create an account or use the Service.

We confirm age by collecting date of birth at signup and computing age server‑side; accounts that fail this check are not granted access. If you are a parent or guardian and you believe a person under 18 has provided us with personal information, please contact us at support@chefxdoor.com. We will promptly delete the account and any associated personal information, except where retention is required by law.

8. Your Rights and Choices

Access, correction, and deletion. You can update your profile in the app, or email support@chefxdoor.com to request access to or deletion of your account data.
Location and notifications. You can disable location access and push notifications at any time in your device settings.
SMS. Manage transactional and marketing SMS in Settings → Notification Settings → SMS Preferences. You may also reply STOP to any SMS to opt out; carriers typically treat STOP as a global block for all ChefxDoor messages from that number, including transactional ones, which may impair your ability to use the Service.
California residents. You have the rights described in the California Consumer Privacy Act, including the right to know, delete, and not be discriminated against for exercising your rights. We do not sell your personal information.

9. International Users

The Service is operated from the United States and is currently launching in Chicago, Illinois. By using the Service from outside the United States you consent to the transfer and processing of your information in the United States.

10. Changes to This Policy

We may update this Policy from time to time. Each version of this Policy has a version number and a “Last updated” date. We record which version of the Terms of Service and this Privacy Policy you accepted, when, and from which screen. If we make material changes, we will prompt you to review and accept the new version the next time you open the app and will not let you continue without accepting it. Continued use of the Service after the changes take effect means you accept the updated Policy.

11. Contact Us

Questions or requests about this Policy: support@chefxdoor.com