Privacy Policy

This Privacy Policy explains how Open Cottage LLC (“Open Cottage,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Open Cottage website and related services (the “Service”).

1. Information we collect

1.1 Information you provide

• Account information (email address and password credentials via our auth provider)
• Creator profile information (name, username, location, tagline, biography, specialties, photos, contact links)
• Communications you send us (for example, support, legal requests, or profile reports)
• Profile report details (reason, description, and the email you provide so we can verify the report and follow up), plus optional account ID if you are signed in when reporting
• In-product feedback you submit (category, message, optional experience rating, and optional screenshot). Screenshots may contain personal or third-party information visible on your screen; we never capture your screen automatically

1.2 Information generated by use

• Basic technical and usage data typical of web services (such as device/browser type, pages viewed, and approximate timestamps)
• Authentication session information (cookies or similar technologies needed to keep you signed in)
• Help chat messages you send to the on-site assistant, plus short-lived server-side chat history used to continue a conversation (typically retained for about 24 hours, then discarded)
• Waitlist and invite-related contact details (email and reserved username) when you join the waitlist or invite a friend. If you choose Continue with Google on the waitlist, we receive your verified Google account email (and Google account id) from Google Identity Services to confirm the address without a separate verification email — we do not create an Open Cottage login from that step alone
• Feedback context collected with in-product feedback: page path, browser and device category, operating system when available, app/deploy version when available, your account id and account type (Food Creator or Food Lover), and recent browser error messages from the current tab
• Limited abuse-prevention data such as hashed or stored IP-related strike/ban records used to rate-limit spam and automated abuse
• Automated bot-protection signals (Vercel BotID) used to reduce abuse on public forms such as waitlist, invites, help chat, profile reports, and the in-product feedback form
• Privacy-limited visit analytics: Vercel Web Analytics plus first-party page-view counts that store only the page path, host, time, and a hashed daily visitor id (not raw IP addresses, emails, or cookie values). Feedback-related analytics events contain event names and limited metadata only — not feedback message text or screenshots

2. How we use information

We use information to:

• Provide, operate, and improve the Service
• Create and manage accounts, saves, and creator profiles
• Display published creator profiles publicly
• Send transactional email (account confirmation, password recovery, waitlist confirmation, and invite messages)
• Answer product questions through the Help chatbot
• Review and act on profile reports for Trust and Safety
• Send a confirmation email so you can verify a profile report before it is filed
• Review feedback to fix bugs and improve the Service
• Communicate about account or Service matters
• Protect security, prevent abuse, and enforce our Terms
• Diagnose errors and monitor reliability (privacy-limited application telemetry)
• Comply with legal obligations

3. How we share information

We may share information with:

• Service providers that help us run the Service, including:
  • Hosting, authentication, database, and storage (for example, Vercel and Supabase)
  • Email delivery (Resend) for invites, waitlist confirmation, and related transactional messages
  • Google Identity Services when you use Continue with Google on the waitlist, so we can receive your verified Google email address
  • AI processing for the Help chatbot: message text is sent through Vercel AI Gateway to an AI model provider (currently OpenAI) to generate answers. We do not use help-chat content for advertising
  • Bot protection (Vercel BotID) when you submit certain forms, such as waitlist, invites, help chat, profile reports, and in-product feedback
  • Error and performance monitoring (Sentry) with privacy-limited telemetry. We configure Sentry not to collect Session Replay, request bodies, or help-chat message content, and we do not intentionally collect email or IP as identifying fields in those events
  • Advertising measurement (Meta Pixel / Facebook) to measure ad campaign performance and help us understand how visitors use the Service after interacting with our ads
• The public, when you publish a creator profile (profile content you choose to publish becomes visible to visitors)
• Legal and safety recipients, when required by law or to protect rights, safety, and security
• Business transfers, in connection with a merger, acquisition, or similar transaction

We do not sell your personal information for money. See our Do Not Sell or Share page for California privacy request information.

4. Retention

We retain information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Help-chat transcripts are short-lived (about 24 hours) and then pruned. Abuse/IP strike records are kept only as needed for rate limiting and security. Profile reports may be retained as moderation audit records after related accounts or profiles are deleted. Feedback records are retained up to 24 months after submission or until resolved and no longer needed for product improvement or legal obligations. Feedback screenshots are kept only while the related feedback record exists and are deleted when that record is deleted or when you delete your account. Feedback text may be retained after account deletion in anonymized form (account identifiers removed). You can download a copy of your account data and permanently delete your account from Account Settings → Data & Privacy; some information may remain in backups or logs for a limited period.

5. Your choices and rights

Depending on your location, you may have rights to:

• Access, correct, or delete personal information
• Export certain account data (available in Account Settings)
• Object to or restrict certain processing
• Opt out of “sale” or “sharing” of personal information where those terms apply

Signed-in users can export JSON account data or delete their account from Account Settings → Data & Privacy. You may also email info@opencottage.net. We may need to verify your identity before fulfilling email requests.

6. Cookies and similar technologies

We use cookies or similar technologies as needed for authentication sessions and core site functionality. We also use the Meta Pixel (Facebook) cookie and related technologies for advertising measurement and analytics, as described above. You can control cookies through your browser settings; disabling cookies may affect sign-in and other features.

7. Children’s privacy

The Service is not directed to children under 13 (or under 16 where required). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will take appropriate steps.

8. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of transmission or storage is completely secure.

9. International users

The Service is operated from the United States. If you access it from elsewhere, you understand that information may be processed in the United States and other locations where our providers operate.

10. Changes

We may update this Privacy Policy from time to time. We will post the updated policy with a revised “Last updated” date.

11. Contact

Open Cottage LLC
539 W. Commerce St., Dallas, TX 75208
info@opencottage.net