Legal
Privacy Policy
Effective 13 August 2026 · Last updated 13 August 2026
- 1. Introduction
- 2. Definitions
- 3. Information we collect
- 4. Why we process your information
- 5. Who we share information with
- 6. Retention and security
- 7. Children’s privacy
- 8. Your rights
- 9. Contact us
- 10. Changes to this policy
1. Introduction
The operator of Yummy (“Yummy”, “we”, “us”, or “our”) takes the privacy of Personal Information seriously and is committed to protecting it in accordance with Applicable Law, including the Protection of Personal Information Act, 4 of 2013 (“POPIA”).
This Privacy Policy (“Policy”) explains how we collect, use, share, and protect Personal Information when you use the Yummy mobile application and the website at yummyapp.co.za (together, the “Platform”).
This Policy applies to:
- registered Users of the Yummy app;
- people who visit this website;
- people who email support@yummyapp.co.za; and
- people whose content appears on the Platform because another User tagged or mentioned them, or because they posted while signed in.
By creating an account or using the Platform, you understand that your Personal Information will be processed as described in this Policy and our Terms of Use.
Yummy is a social food-review service. It is not a marketplace, payment processor, or mapping product. We do not sell goods, take card payments, or collect GPS coordinates.
2. Definitions
In this Policy:
- Applicable Law means South African law that applies to us, including POPIA and, where relevant, the Promotion of Access to Information Act, 2 of 2000 (“PAIA”).
- Child means a natural person under 18 years, as contemplated in POPIA.
- Consent means a voluntary, specific, and informed expression of will giving permission for Processing.
- Electronic Communications means email, in-app notices, and push notifications.
- Operator means a person who Processes Personal Information for us and on our instructions (for example Google Firebase).
- Personal Information has the meaning in section 1 of POPIA. It includes information that identifies you or relates to your use of Yummy, such as your email, username, photos, and reviews.
- Platform means the Yummy Android app and this website.
- Processing has the meaning in POPIA (collecting, storing, using, sharing, deleting, and related operations).
- Responsible Party means the person who decides why and how Personal Information is Processed. For this Policy, that is the operator of Yummy.
- Special Personal Information has the meaning in section 26 of POPIA (for example health, biometric, or religious information). We do not ask for this.
- User / you means anyone who visits the website, creates an account, or uses the app.
- Yum means a meal review you post (photo, place, ratings, and short text).
3. Information we collect
3.1 Purpose limitation and minimisation
We collect only what is reasonably necessary to run the Platform: accounts, city-scoped feeds, posting Yums, following other cooks, public city chat, moderation, security, support, and (if enabled in a given release) advertising on Home.
We do not collect more than we need for those purposes.
3.2 Categories of Personal Information
Depending on how you use Yummy, we may Process:
| Category | Examples |
|---|---|
| Identity | Username (permanent after signup), display name, authentication identifiers (including a Google account identifier if you use Google Sign-In). |
| Contact | Email address. We do not require a phone number. |
| Account and profile | Password (stored by our authentication provider, not in readable form), profile photo, bio, theme preference, follow relationships, bookmarks. |
| User-generated content | Yums (photos, vendor/place name, ratings, review text), comments, public chat messages, reports you submit, and reactions. |
| City choice | The city you select in the app (for example Cape Town). This is a manual picker. We do not use GPS, maps, geocoding, or precise location. |
| Photos | Images you take or pick from your gallery for a Yum or profile photo. These are uploaded to cloud storage and shown to other signed-in Users. |
| Device and security | Push notification token, App Check / device integrity signals, crash logs, coarse technical data (app version, OS, timestamps) used for security, diagnostics, and stability. |
| Usage and analytics | Events such as opening Home, creating a Yum, following someone, or opening chat — used to understand product use and fix problems. |
| Advertising (only if ads are on) | If a release is built with advertising enabled, Google Mobile Ads may process device and advertising identifiers to show banners on Home. Launch builds may ship with ads off. We will not claim ads in store listing until that is verified. |
| Support records | Emails you send to support, and records of in-app deletion or moderation actions. |
3.3 What we do not collect
- GPS or precise location
- Contacts, SMS, call logs, or calendar
- Identity documents or biometric templates
- Bank, card, or other financial details (Yummy has no in-app payments)
- Health or allergen data as a structured field (a review might mention food; that is your content, not a health record we request)
3.4 Special Personal Information
We do not intentionally collect Special Personal Information. Do not put health, biometric, or similar details in reviews or chat. If you volunteer such information in free text, we treat it as ordinary User content and apply the same public-content rules.
3.5 Website cookies and similar technologies
This marketing and legal website is static. It does not set advertising cookies. The app uses local device storage (for example city choice and theme) and Firebase services described below. You can control notification permission on your device.
4. Why we process your information
4.1 Purposes
| Purpose | What we do |
|---|---|
| Operate the Platform | Create and sign you in, keep your username unique, show city Home and Discover, accept Yums, comments, follows, and public chat. |
| Show public social content | Display profiles, posts, comments, follow relationships, and city chat to other signed-in Users. |
| Safety and moderation | Receive reports, remove content, suspend or disable accounts, and keep audit records of admin actions. |
| Notifications | Send push notifications (for example chat) if you grant permission. |
| Security and fraud prevention | App Check, rate limits, crash reporting, and abuse controls. |
| Analytics and improvement | Understand which screens work and where the app fails. |
| Support | Answer email and process deletion requests. |
| Advertising | Only if ads are enabled in that build: show Home banners via Google Mobile Ads. |
| Legal compliance | Keep records we must keep, and respond to lawful requests. |
4.2 Lawful bases under POPIA
We Process Personal Information on one or more grounds recognised under POPIA:
- Contract — to provide the account and features you signed up for.
- Legitimate interests — security, moderation, analytics, and running a social app, balanced against your rights.
- Legal obligation — where the law requires us to keep or disclose information.
- Consent — where we ask for it (for example notification permission, or camera/gallery access on your device). You may withdraw device permissions in system settings. Withdrawing consent does not make past lawful Processing unlawful.
You may object to Processing based on legitimate interests, including any future direct marketing, by emailing us. Service, security, and account emails are not marketing.
We do not sell Personal Information. We do not send promotional SMS or WhatsApp. We do not enrich profiles from credit bureaux.
5. Who we share information with
5.1 Other Users (public by design)
Profiles, Yums, comments, follow relationships, and city chat are visible to other signed-in Users. Chat rooms are public. There are no private direct messages. Do not post anything you do not want that audience to see. See the Chat Room Policy.
5.2 Operators
We use Operators to host and run the Platform. They Process Personal Information on our instructions, not to build their own Yummy user list for unrelated sale of your data.
| Operator category | What they do for us |
|---|---|
| Google Firebase (authentication, Firestore, Storage, Cloud Functions, Hosting) | Accounts, database, photo files, server logic, and this website. |
| Firebase Analytics and Crashlytics | Usage events and crash reports. |
| Firebase Cloud Messaging | Push notifications. |
| Firebase App Check / Play Integrity | Reduce abuse from modified or automated clients. |
| Google Sign-In | Optional sign-in with your Google account. |
| Google Mobile Ads | Home banners only if that release has ads enabled. |
| Cloudflare | DNS and email forwarding for support@yummyapp.co.za. |
Those Operators have their own privacy notices. Google services are described at policies.google.com/privacy.
5.3 Legal disclosures
We may disclose Personal Information to a regulator, court, or law-enforcement body where Applicable Law requires it, or to protect Users, the Platform, or our legal rights.
5.4 Cross-border Processing
Google and other Operators may Process Personal Information outside South Africa, including in the United States and other countries where they operate. We use reputable providers and the contractual and security controls they offer so that the transfer remains subject to protection comparable to POPIA, including written operator terms, access controls, and encryption in transit.
5.5 Corporate changes
If the Yummy service is transferred as part of a sale or restructure, Personal Information may move with it, under confidentiality and this Policy or a successor notice.
6. Retention and security
6.1 How long we keep information
We keep Personal Information only as long as needed for the purposes above, and for legal, security, and moderation needs.
You can delete your account in the app: Profile → Settings → Delete account. That disables the login immediately and marks the account deleted. It does not always erase Yums, photos, comments, or chat you already published. We may keep those records where needed for security, fraud prevention, legal claims, or moderation integrity. Email support@yummyapp.co.za if you need help with a deletion request. We aim to complete emailed requests within 30 days.
When information is no longer required, we delete or de-identify it where reasonably practicable.
6.2 Security
We use technical and organisational measures appropriate to a small consumer app, including:
- HTTPS and encrypted transit to our cloud providers;
- authentication and access rules on the database and file storage;
- admin access limited to operators;
- rate limits and App Check (enforcement may be phased in);
- audit logs of sensitive admin actions.
No system is perfectly secure. If a compromise is reasonably believed to have given unauthorised access to Personal Information, we will assess and contain it and notify affected people and the Information Regulator where POPIA requires that.
7. Children’s privacy
Yummy is a social app with public posts and public chat. It is not directed at Children (under 18). Our Terms of Use also require you to be at least 13, or older if the law where you live says so.
We do not knowingly create accounts for Children. If you believe a Child has given us Personal Information without the consent of a competent person, email support@yummyapp.co.za. We will investigate and delete or disable the account where appropriate.
8. Your rights
8.1 Rights under POPIA
Subject to Applicable Law, you may:
- ask whether we hold Personal Information about you, and request access to it;
- ask who we have shared it with;
- request correction of information that is wrong, incomplete, or out of date;
- request deletion where no lawful ground requires us to keep it;
- object to certain Processing, including legitimate-interest Processing;
- object to direct marketing (we do not currently send promotional campaigns);
- lodge a complaint with us or with the Information Regulator.
You can already edit display name and profile photo in the app, change city, control notification permission on the device, and start account deletion in Settings.
8.2 How to exercise these rights
Email support@yummyapp.co.za from the address on the account, and say what you want us to do. We may ask you to confirm your identity. We will respond within a reasonable time as required by POPIA. We may refuse a request where the law allows (for example information that must be kept for a dispute or that identifies another User).
8.3 PAIA
You may also request access to certain records under PAIA. Those requests follow PAIA’s forms, time limits, and grounds for refusal, and may attract a prescribed fee. Write to the same support address and mark the subject “PAIA request”. We do not currently publish a separate PAIA manual; if that changes, we will link it here.
9. Contact us
Responsible Party: the operator of the Yummy Platform.
Website: https://yummyapp.co.za
Privacy and support: support@yummyapp.co.za
Please contact us first so we can try to resolve the matter.
If you are not satisfied, you may complain to the Information Regulator (South Africa):
- Website: https://inforegulator.org.za/
- Phone: 010 023 5200
- General: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
10. Changes to this policy
We may update this Policy when the product, our Operators, or the law changes. The effective date at the top will change. Material updates will be published on this page. Continued use of the Platform after an update is subject to the new Policy, to the extent Applicable Law allows.