私隱政策 · Privacy Policy

食譜分享連結同 app 食譜庫

公開 Instagram 帖文、Reel 或 Threads 帖文整理成功後，食譜文字、可用嘅來源圖片同 @作者會加入 app 食譜庫。共用更正更新同一份食譜；私人備註、雪櫃、計劃同另存嘅私人版本唔會自動分享。原帖連結會保留，你可以喺 app 回報內容或來源問題。

建立分享連結或撳「發佈最新版本」，會上載你所揀食譜嘅目前版本，包括名稱、材料、份量、步驟、時間、人數同標籤。私人食譜嘅一般儲存唔會更新分享版本。一般分享唔會自動列入食譜庫；「畀埋大家睇」仍須另行確認分享權利、完整性同食譜守則，並通過檢查或審核。

食譜庫、分享內容、版本記錄同更正只可以喺 app 閱讀，內容 API 需要有效裝置憑證。網頁連結只用嚟開啟 app，唔會顯示食譜名稱、圖片或內容。分享連結唔係私人或保密連結；收到或獲轉寄連結嘅人可以喺 app 開啟。

為咗處理舉報、限制濫用同隱藏分享者，伺服器會保留用途分隔嘅假名化分享者識別、分享及審核事件、舉報原因同處理紀錄。app 用用途分隔嘅安裝識別記住隱藏選擇；分析只記錄不含食譜內容或身份嘅總量訊號。單一舉報唔會自動令食譜全局下架。

「停止公開」會移除 app 食譜庫列表，但保留分享連結；「停止分享」會移除分享內容，只保留防止網址重用嘅代碼。安全及舉報處理紀錄可繼續保留。遺失原本裝置時，需要完整分享網址或六位代碼先可以定位呢類無帳戶分享。

自選電郵登入同恢復

你可以揀將已驗證嘅電郵連結到你現有嘅家庭成員身份。呢個電郵唔會建立帳戶、增加家庭席位或改變訂閱。要求驗證碼時，伺服器會保存短效 challenge、經密鑰處理嘅電郵指紋、驗證碼雜湊、嘗試次數、到期同使用狀態；唔會保存原始六位驗證碼。驗證碼 10 分鐘後失效；challenge 紀錄喺建立 24 小時後符合每次有界批次清理資格。已驗證電郵會保留至你喺 app 解除連結、刪除家庭成員，或我哋完成可核實嘅刪除要求。驗證電郵經 Resend 傳送；Resend 會處理收件地址同郵件內容以完成投遞。

1. 我哋處理嘅資料

目前廚房資料

包括材料名稱與別名、雪櫃／冰格／儲物櫃存量、數量、到期日、食譜、餐單、購物項目、包裝文字備忘、反應同其他活動。可保存嘅「目前廚房」會儲存喺 Shio Box 伺服器，並快取喺成員裝置供使用同同步。伺服器亦會保存每個廚房最近一次成功連線嘅日期（UTC），供管理員按廚房成員嘅顯示名稱核對連線及街市食譜儲存紀錄。一個訂閱涵蓋一個廚房，可供一至兩人使用；邀請多一個人係自選。服務使用隨機裝置憑證；你可以揀用電郵登入，唔使開設電郵同密碼帳戶。裝置設定同小工具快照可以只留喺裝置；30 秒示範廚房只存在記憶體，離開後會清除。

包裝相片

你明確加入目前廚房嘅包裝相片會先喺裝置縮細、壓縮同移除內嵌 metadata，再儲存到 Shio Box 私有 RustFS object storage，畀獲授權嘅廚房裝置查看。儲存服務憑證唔會交俾 app；上載同讀取只會使用短效 signed URL，伺服器亦會先檢查目前廚房存取權。30 秒示範廚房唔會保存或上載包裝相片。

煮食手記同餐相

你加入嘅餐相、今次心得同下次提醒會保留喺目前廚房，供獲授權嘅成員查看。餐相會先喺裝置縮細、壓縮同移除內嵌 metadata；伺服器只保存壓縮版本同縮圖，唔會上載或保存原圖。相片使用同一個私有 RustFS 儲存服務同短效存取連結，心得同煮食紀錄保存在 Shio Box 伺服器。離線修改會留喺裝置等候同步。記低餐相唔會自動交俾 AI 或公開發佈。你可以自行分享一張相卡；預設唔包含心得，勾選後只會加入你自己嘅心得。送到其他 app 嘅相卡副本由該服務同收件人管理。

自家啟用分析

為咗了解設定、持續使用同共享計劃流程係咪有效，Shio Box 會向自家伺服器傳送少量、唔含內容文字嘅資料。首次里程碑包括完成或略過 30 秒示範廚房、見到訂閱頁、開始商店確認、完成購買、完成 onboarding、首個雪櫃項目或食譜、廚房啟用／邀請／加入、首個能證明兩位不同家庭成員參與嘅已確認餐單，同首個剔選購物項目。訂閱漏斗只記錄經限定嘅入口、月費／年費選擇，以及商店當時有冇顯示試用資格；唔會記錄價格、付款資料或商店帳戶。每日使用訊號只記錄：每個安裝喺啟動或返回前台時每日最多一次、每個家庭成功驗證同步嘅活躍日，以及通過上述兩位不同有效家庭成員證明後嘅共同決定日。首次里程碑紀錄可包括隨機 event ID、經用途分隔雜湊處理嘅安裝或家庭 ID、時間、app 版本、平台、粗略語言，同嚴格限定嘅布林／分類資料；每日紀錄只包括用途分隔 subject hash、固定事件名稱、UTC 日期同收件時間，冇額外 properties。分析 payload 同資料表唔會儲存食譜或材料名稱、餐單／slot 名稱、留言、相片、網址、錄音、逐字稿、顯示名稱、人物／裝置 ID、邀請碼、登入憑證或推送 token、廣告識別碼或任意文字；現有隨機安裝憑證只用嚟驗證傳送。失敗事件可暫存喺最多 100 項嘅本機 queue 再重試。伺服器首次里程碑同每日紀錄最多保留 180 日，之後由有界、非阻塞嘅自動清理移除。管理摘要只回傳 DAU／WAU／MAU、活躍家庭、共同決定家庭同首次漏斗總數，唔會回傳 subject hash。呢套分析由 Shio Box 自家處理，冇加入第三方分析 SDK。

食譜同排餐 AI 嘅資料處理

符合資格嘅廚房可以選擇將食譜資料或排餐要求交俾 OpenAI 處理。請先核對草稿，再決定儲存或套用。為咗處理重試，Shio Box 可以暫存產生嘅草稿最多 24 小時。唔含原文或圖片嘅狀態同配額紀錄會喺八日後符合清理資格。詳情見 OpenAI 私隱政策。

用文字或截圖補充食譜

你喺支援「補充食譜」嘅食譜頁明確提交文字或最多五張截圖時，所揀內容會經 Shio Box 傳送畀 OpenAI，整理成可修改嘅食譜草稿。你輸入嘅原文會同截圖擷取文字分開保留。分享圖片會暫時複製到裝置／app group 私有儲存作交接同恢復；24 小時後唔再可用，下次處理分享時會清理過期檔案。明確完成或放棄匯入會清除該批檔案。喺 app 內揀嘅圖片只留喺記憶體，中途退出後可能要重新揀。圖片上傳 AI 前會重新編碼並移除 EXIF／GPS；截圖唔會當成永久食譜相片或雪櫃內容儲存。原文、結果同來源連結會留喺該裝置嘅廚房草稿，直到儲存或放棄。只有你明確按「儲存食譜」，食譜先會保存。Server 結果快取同配額紀錄沿用以上保留期限。

每週排餐建議

獲開放嘅廚房明確送出安排要求時，原文、所選日期及最多六十個已儲存食譜摘要（名稱、材料名稱及已知需時）會經 Shio Box 傳送畀 OpenAI。呢個入口唔會傳送庫存數量或煮食歷史。原文、請求及結果會留喺該裝置嘅廚房草稿供稍後繼續，直到套用或放棄草稿；唔會當成正式安排同步畀另一位成員。Server 嘅結果快取及配額紀錄沿用以上保留期限。AI 唔會直接更改餐單、買餸清單或雪櫃；你要核對建議、放入草稿，再明確套用。

晚飯回饋

再煮、太費工夫、不合口味、避開材料同「未煮」記錄會保存在目前廚房，供同一廚房成員查看，並標明記錄人。呢啲記錄唔係雪櫃庫存或已煮證據。重設會清除目前偏好或撤回「未煮」狀態，唔會刪除伺服器保留嘅追加事件歷史；刪除整個廚房會一併刪除。裝置只快取最近最多 256 個餐單結果，較舊事件仍留在伺服器。

舊版 Scribe 紀錄

Scribe 錄音及逐字稿整理服務已停止。過往使用服務時留下嘅紀錄可能包括逐字稿、整理結果、狀態同時間。呢啲紀錄目前冇自動到期日，會保留至營運清理或完成經核實嘅刪除要求。你可以按下面嘅聯絡方法要求刪除。

訂閱及裝置資料

Shio Plus 購買由 Apple App Store 或 Google Play 收款，RevenueCat 幫我哋處理權益狀態、購買紀錄及用於啟用／還原購買嘅 app 使用者或裝置識別資料。我哋唔會收到完整付款卡資料。

通知同小工具

如果你允許通知，裝置推送 token、平台同語言設定會交俾 Shio Box 伺服器，並加密儲存，用嚟經 Firebase Cloud Messaging 傳送家庭提議、回應、確認及購物更新。你可以隨時喺系統設定關閉通知。當你加入主畫面小工具，今晚餐單、快到期數量同最多三項購物內容會寫入作業系統嘅共享小工具儲存空間，可能喺 app 外顯示。

2. 用途、保留及分享

• 提供目前廚房、跨裝置同步、食譜分享、食譜補充、排餐建議、訂閱權益、通知同客戶支援。
• 保護服務、防止濫用，同埋診斷技術故障。
• 目前廚房資料會快取喺成員裝置，並保留喺 Shio Box 伺服器，直至你刪除相關內容，或我哋完成可核實及可定位嘅刪除要求；作業系統備份可能另行保留副本，需喺裝置設定管理。
• 訂閱權益完結後，同一個廚房會保留並變成唯讀，直至重新訂閱。
• 已發佈食譜內容保留至你停止分享；停止後即時移除內容，只留不含內容嘅代碼 tombstone。
• 訂閱紀錄由 Apple、Google 及 RevenueCat 按提供服務、退款、法律及會計需要保留。

處理服務包括 Zeabur／Shio Box 自家基礎設施、PostgreSQL、私有 RustFS object storage（目前廚房包裝相片同餐相）、OpenAI（食譜處理及排餐建議）、Firebase Cloud Messaging（通知）、RevenueCat、Apple 同 Google。除咗向呢啲服務供應商提供完成指定功能所需資料，或法律要求外，我哋唔會向第三方披露資料。

3. 你嘅選擇

訂閱前，你可以使用只存在記憶體、離開後唔會保留內容嘅 30 秒示範廚房。建立可保存嘅真實廚房需要有效嘅商店試用或 Shio Plus；權益完結後，現有廚房資料會保留並可唯讀查看，直至重新訂閱。食譜分享可喺 Shio Box 嘅有效分享連結清單停止。要刪除其他資料，請睇 刪除資料指引。同步、自家分析、推送或 RevenueCat 客戶紀錄可電郵 coffeebb71@gmail.com 開始刪除要求；我哋會先按你嘅使用方式提供安全核實步驟，只有喺可以核實擁有權同定位相關紀錄後先會刪除。Apple 或 Google 為交易、退款或法定義務保留嘅紀錄，要按其政策處理。

Shio Box 面向一般家庭煮食用途，唔係特別為 13 歲以下兒童而設；我哋唔會在知情情況下向 13 歲以下兒童收集個人資料。如你認為兒童向我哋提供咗資料，請聯絡我哋。

Recipe share links and the in-app library

After a public Instagram post, Reel or Threads post is processed successfully, its recipe text, available source image and creator username appear in the app library. Shared corrections update that recipe. Private notes, fridge inventory, plans and personal copies are not automatically shared. Original sources remain linked, and content or source issues can be reported in the app.

Creating a share link or tapping “Publish latest version” uploads the selected recipe's current version, including its name, ingredients, quantities, steps, time, servings and tags. Ordinary private edits do not update the shared version. Listing an ordinary share in the library remains a separate confirmation of rights, completeness and recipe rules, followed by automated checks or review.

The library, shared recipes, revision history and corrections are read only in the app. Content APIs require a valid device credential. Web links only open the app and display no recipe title, cover or content. A share link is not private or secret: recipients, including people it is forwarded to, may open it in the app.

To limit abuse, process reports and support viewer-specific publisher hiding, the server retains domain-separated pseudonymous publisher identifiers, publication and review events, report reasons, resolutions and timestamps. The app uses a separate installation identity for hiding preferences. Analytics contain only content-free aggregate signals. A single report does not automatically remove content globally.

“Stop publishing” removes the in-app listing while keeping the share link. “Stop sharing” removes its recipe content and reserves the content-free code. Safety and reporting records may remain. If you lose the creating installation, email the exact share URL or six-character code to coffeebb71@gmail.com so we can locate it.

Optional email sign-in and recovery

You can link a verified email to your existing Household Person. The email does not create an account or seat and does not change subscription access. When a code is requested, the server stores a short-lived challenge, keyed email fingerprint, code hash, attempt count, expiry and consumption state; it never stores the raw six-digit code. Codes expire after 10 minutes; challenge records become eligible for bounded, request-triggered batch cleanup after 24 hours. A verified address remains until you unlink it in the app, delete the Household Person, or we complete a verifiable deletion request. Verification emails are delivered through Resend, which processes the recipient address and message content for delivery.

1. Data we process

Current Kitchen data

This may include ingredient names and aliases, inventory locations, quantities, expiry dates, recipes, meal plans, shopping items, packaging notes, reactions and related activity. A persistent Current Kitchen is stored on Shio Box servers and cached on its members' devices for access and sync. The server also keeps the most recent UTC date on which a Kitchen connected successfully so the operator can identify Kitchens by their members’ display names when checking connections and saves of Marketplace recipes. One subscription covers one Kitchen with one or two people; inviting a second person is optional. Random device credentials protect access. Email sign-in is optional and does not require a password. Device settings and widget snapshots may remain local to a device. The 30-second Sample Kitchen exists only in memory and is discarded when you leave it.

First-party activation analytics

To understand whether setup, continued use and shared planning work, Shio Box sends a small content-free set to its own server. First-only milestones cover completing or skipping the 30-second Sample Kitchen; viewing the subscription screen; starting Store confirmation; completing a purchase; onboarding completion; the first fridge item or recipe; kitchen activation, invite and join; the first confirmed meal that proves two distinct valid household people participated; and the first checked shopping item. Subscription-funnel events contain only an allowlisted entry source, monthly/yearly selection and whether the Store showed trial eligibility; they do not include price, payment details or a Store account. Daily activity records cover an installation at most once per UTC day on launch or resume, a household after a successful authenticated sync request, and a shared-decision day only after that same two-person household proof passes. Milestone rows may contain a random event ID, a domain-separated installation or household subject hash, timestamps, app version, platform, coarse locale, and tightly allowlisted boolean/category fields. Daily rows contain only a domain-separated subject hash, fixed event name, UTC day and received timestamp, with no properties. The analytics payload and tables do not store recipe or ingredient names, meal or slot names, comments, photos, URLs, audio, transcripts, display names, person or device IDs, invite codes, sign-in credentials or push tokens, advertising identifiers, or arbitrary text; the existing random installation credential is used only to authenticate delivery. Failed client events may wait in a bounded on-device queue of at most 100 rows. Server milestone and daily analytics rows are automatically deleted after 180 days by bounded, non-blocking cleanup. The admin summary returns only DAU/WAU/MAU, active-household, shared-decision-household and activation-funnel counts, never subject hashes. This is handled by Shio Box without a third-party analytics SDK.

AI recipe and planning requests

Eligible Kitchens can choose to send recipe material or planning requests to OpenAI. Review the draft before saving or applying it. Shio Box may cache the generated result for up to 24 hours to handle retries. Status and quota records exclude source text and images and become eligible for cleanup after eight days. See the OpenAI Privacy Policy.

Recipe supplements from text and screenshots

When you submit recipe text or up to five screenshots from an eligible recipe’s Add recipe details screen, selected content goes through Shio Box to OpenAI to form an editable recipe draft. User-entered source text is kept separate from extracted screenshot text. Shared image attachments are temporarily copied into private on-device/app-group storage for handoff and recovery. They become unavailable after 24 hours, and expired files are cleared on subsequent share handling. Explicit completion or discard clears that batch. Images selected within the app stay in memory and may need reselection after interruption. Images are reencoded without EXIF/GPS before AI upload and are not saved as permanent Recipe photos or cloud inventory. Text, result and source link stay in a device-local Kitchen draft until saved or discarded. Only an explicit Recipe Save persists a recipe. Server result-cache and quota-record retention follow the limits above.

Weekly planning suggestions

When an enabled Kitchen explicitly submits a planning request, its text, chosen dates and up to sixty saved recipe summaries (names, ingredient names and known cooking times) are sent through Shio Box to OpenAI. This entry does not transmit inventory quantities or cooking history. The source text, request and result stay in that device’s Kitchen draft for recovery until the draft is applied or discarded; they are not synced to the other member as an agreed plan. Server result-cache and quota-record retention follow the limits above. AI does not directly change meals, Shopping or Fridge: you review the suggestions, add them to the editable draft, then explicitly apply it.

Dinner feedback

Repeat, effort, taste, ingredient preferences and skipped-dinner records stay in your private Current Kitchen, shared with its members and attributed to the person recording them. They are not Fridge inventory or evidence that a meal was cooked. Reset clears the current preference or undoes a skipped outcome; it does not delete the append-only event history retained by the server. Deleting the whole Kitchen removes that history. Devices cache only the latest 256 meal outcomes; older events remain on the server.

Historical Scribe records

The Scribe recording and transcript processing service has closed. Records from past use may include transcripts, structured results, status and timestamps. They have no automatic expiry date and remain until operational cleanup or a verified deletion request. You can request deletion using the contact details below.

Subscriptions and device data

Apple App Store or Google Play processes payment. RevenueCat helps us manage entitlements, purchase history, and app-user or device identifiers needed to activate and restore purchases. We do not receive full payment-card details.

Notifications and widgets

If you opt in, a push token, platform and locale are sent to Shio Box and encrypted at rest to deliver Kitchen proposals, comments, confirmations and shopping updates through Firebase Cloud Messaging. You can disable notifications in system settings. A home-screen widget writes tonight's meal, expiring counts and up to three shopping items to operating-system shared widget storage, where they may appear outside the app.

Packaging photos

A packaging photo you explicitly add to the Current Kitchen is resized, compressed and stripped of embedded metadata on the device, then stored in Shio Box's private RustFS object storage for authorized Kitchen devices. Storage credentials are never sent to the app. Uploads and reads use short-lived signed URLs, and the server checks Current Kitchen access before issuing them. The 30-second Sample Kitchen does not save or upload packaging photos.

Cooking journal and meal photos

Meal photos, notes and reminders you add stay in the Current Kitchen for its authorized members. The app resizes, compresses and strips embedded metadata before upload. The server stores only compressed photos and thumbnails, never originals. Photos use the same private RustFS storage and short-lived access links; notes and cooking records stay on Shio Box servers. Offline edits wait on the device for sync. Recording a meal does not automatically send it to AI or publish it. You can explicitly share a meal card. Notes are excluded by default; opting in adds only your own notes. Copies sent to another app are then managed by that service and their recipients.

2. Uses, retention and providers

We process data to provide the app, prevent abuse, diagnose failures and answer support requests. Current Kitchen data is cached on member devices and remains on Shio Box servers until you delete it or we complete a verifiable and locatable deletion request; operating-system backups may retain a separate copy that must be managed in device settings. When subscription access ends, the same Kitchen is preserved read-only until you resubscribe. Store and subscription providers may retain transaction records for service, refund, legal or accounting needs.

Processors may include Zeabur/Shio Box infrastructure, PostgreSQL, private RustFS object storage for Current Kitchen packaging and meal photos, OpenAI for recipe processing and planning suggestions, Firebase Cloud Messaging, RevenueCat, Apple and Google. We disclose only what is needed for those functions or as required by law.

3. Your choices and contact

Before subscribing, you may use the 30-second Sample Kitchen, which exists only in memory and does not keep its contents after you leave. A Store trial or active Shio Plus entitlement is required to create a persistent real Kitchen. When access ends, existing Kitchen data is preserved and remains available read-only until you resubscribe. See Delete Your Data. To start a deletion request for synced, first-party analytics, push-registration or RevenueCat customer records, email coffeebb71@gmail.com. We will provide verification steps appropriate to your setup and can delete records only after ownership can be verified and the records located. Records retained by Apple or Google for transactions, refunds or legal duties remain subject to their policies.

Shio Box is a general household cooking product and is not directed to children under 13. Contact us if you believe a child has provided data.