Friji Policy
Friji is committed to protecting your personal information and rights.
The Company collects the following personal information to provide its services.
When using the app, the following device permissions are requested. The purpose of each permission is as follows.
For Friji's AI features (recipe recommendations, ingredient recognition, etc.), the ingredient lists and cooking requests you submit are sent to the Anthropic (Claude) and OpenAI APIs. We operate with data sharing for training purposes disabled in each provider's console, and transmitted data is used solely to provide the service. In Anthropic's case it is retained for 30 days for safety and security purposes and then deleted. See "5-1. Cross-Border Transfer of Personal Data" for details.
The Company uses the following third-party services to operate. Please review the privacy policy of each service.
We transfer personal data overseas as described below, only to the extent necessary to provide the service. Your account, ingredient and recipe data itself is stored domestically (Seoul region) and is not transferred overseas.
| Recipient | Country | Data transferred | Purpose | Timing and method | Retention period | Contact |
|---|---|---|---|---|---|---|
| Anthropic, PBC | United States | Ingredients and cooking requests you enter | AI recipe and chat generation | Sent via API (HTTPS) when the feature is used | Deleted after 30 days | privacy@anthropic.com |
| OpenAI, L.L.C. | United States | Ingredients and cooking requests you enter | AI recipe and chat generation | Sent via API (HTTPS) when the feature is used | Deleted after up to 30 days, retained for abuse monitoring | dsar@openai.com |
| Google LLC (YouTube Data API) | United States | URLs and search terms you enter | Converting video captions into recipes | Sent via API when the feature is used | Not retained | googlekrsupport@google.com |
Content sent to Anthropic and OpenAI is not used to train AI models. We operate with data sharing for training purposes disabled in each provider's console.
| Recipient | Country | Data transferred | Purpose | Timing and method | Retention period | Contact |
|---|---|---|---|---|---|---|
| Vercel Inc. | United States (operations), Seoul (edge) | IP address, browser information, request logs | Service hosting | Automatically on access | Runtime logs for 1 day | privacy@vercel.com |
| Sentry (Functional Software, Inc.) | United States | User identifier, device information and error details when an error occurs | Error diagnosis | Automatically when an error occurs | 30 days | compliance@sentry.io |
| PostHog, Inc. | United States | User identifier, usage events, device information | Usage analytics | On use after consent | Per the plan's retention period | privacy@posthog.com |
| Resend (Plus Five Five, Inc.) | United States | Email address and message content | Notification and invitation email delivery | On sending | Per the delivery log retention period | support@resend.com |
| Upstash, Inc. | United States | IP address | Blocking excessive requests | Automatically on request | The rate-limit window (seconds to minutes) | support@upstash.com |
| Google LLC (Firebase Cloud Messaging) | United States | Push token and device information | Push notification delivery | When a notification is sent | For the lifetime of the token | googlekrsupport@google.com |
| Stripe, Inc. | United States | Payment identifier and email address | International payment processing | On payment | Per statutory payment record retention periods | dpo@stripe.com |
| RevenueCat, Inc. | United States | App user identifier and purchase receipts | In-app subscription verification | On purchase or restore | For the duration of the subscription | compliance@revenuecat.com |
These transfers fall under Article 28-8(1)3 of the Personal Information Protection Act as processing entrustment and storage necessary to perform our contract with you, and are made without separate consent by disclosing them in this privacy policy pursuant to Article 28-8(2).
Account information and service data are stored in the Supabase Seoul region (ap-northeast-2) and are not subject to cross-border transfer.
If you do not want your data transferred overseas, you may contact privacy@friji.app. Note that where such a transfer is essential to providing the service, your use of the service may be limited or account deletion may be required.
In principle, personal information is destroyed without delay once the purpose of collection and use has been fulfilled. However, the following information is retained for the periods set by applicable laws.
Users may exercise the following rights at any time.
Account and data deletion can be performed directly within the app via Profile → Delete Account.
Friji is not intended for children under 14. If personal information of a child under 14 is collected, we will delete it immediately. Guardians may contact us at privacy@friji.app.
The Company may use Android Advertising ID and iOS IDFA for service analytics and advertising effectiveness measurement. You can limit ad tracking in your device settings.
If this policy is changed, we will notify you in advance through in-app announcements and email. Continued use of the service after changes is deemed as agreement to the revised policy.
For complaint handling and remedies related to personal information, you may report to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA).
This policy takes effect on August 3, 2026. This revision discloses transfers that were already taking place, so it takes effect on the same day it is announced. For inquiries, please contact privacy@friji.app.