Privacy Policy
1. Who we are
The Epicure's Journal / 腹地笔记 ("we", "us", "our") is operated by Mengxin Ran. Our website is accessible at gn-ava.org. You may contact us at ranpsy2001@gmail.com.
2. What data we collect and why
Account registration and authentication
When you create an account, we collect your email address, username, and password (stored as a hashed value). We use this information solely to create and manage your account. Authentication is handled by our own server using JWT access tokens and refresh tokens. We do not share this data with third parties.
User-generated content
When you post food records, we collect the content you submit, including text and images. Images are compressed and stored in Firebase Realtime Database or Cloudflare R2. This data is stored to operate the core features of the platform.
Comments
When you post a comment on a food record, we collect your comment text, your username or user ID, and the timestamp of submission. These are stored in Firebase Realtime Database and are visible to other users. On the ej (desktop) version of the platform, comments may also include an optional image attachment; such images are stored in Firebase Realtime Database (up to 500 KB per comment).
Social interactions and activity
When you interact with content or other users — including liking food records, saving items to your collection, following or blocking other users — this data is stored in Firebase Realtime Database under your account. We also store notification records (such as who liked, collected, followed, or commented on your content) so that you can be informed of activity on your posts. This data is deleted when your account is deleted.
Trip memories and route data
When you save a trip memory, we store the trip name, date, description, cover image (compressed), user-defined waypoint coordinates and travel mode, per-stop notes, and your chosen visibility setting (public, followers-only, or private). This data is stored in Firebase Realtime Database under your user account. Route geometry data is not stored. Cover images are compressed to reduce size before storage. When you view a saved trip, waypoint coordinates are sent in real time to Google Directions API for route calculation (see "Google Maps Platform" below). You may delete any trip memory at any time from your profile.
Technical and authentication log data
When you visit our website, our hosting provider (GitHub Pages) may automatically collect standard server log data including your IP address, browser type, and pages visited. We do not control this data collection. Please refer to GitHub's privacy policy for details.
Our authentication server logs authentication events (such as logins, registration, and password resets) along with your IP address. These logs are used for security monitoring, abuse prevention, and debugging. Authentication logs are retained in our database and are deleted when you delete your account (the log entries are anonymized by removing the user association).
Location data
When you use the "Nearby" feature, the app requests your browser's geolocation permission. Your coordinates are used locally on your device to sort nearby food records by distance. Your location data is not transmitted to our servers or stored remotely. You can deny or revoke location access at any time through your browser settings.
3. Third-party services
We use the following third-party services that may process your data:
Supabase (Supabase Inc.)
We use Supabase to store account credentials, including your username, email address, and hashed password. This data is stored on Supabase-hosted PostgreSQL servers located in the United States. Supabase's privacy policy applies: supabase.com/privacy.
Firebase Realtime Database (Google LLC)
We use Firebase Realtime Database to store food records, images, comments (including comment image attachments), likes, collections, follow and block relationships, notification records, and page view counts. Data may be stored on Google servers. Google's privacy policy applies: policies.google.com/privacy.
Firebase App Check / Google reCAPTCHA
We use Firebase App Check with Google reCAPTCHA Enterprise to protect our database from abuse. reCAPTCHA may collect hardware and software information (such as device and application data) and send it to Google for analysis. This runs automatically in the background and does not require user interaction. Google's privacy policy applies: policies.google.com/privacy.
Google Fonts
We load fonts from Google Fonts via fonts.googleapis.com. When your browser requests these fonts, Google may collect your IP address. Google's privacy policy applies: policies.google.com/privacy.
Resend
We use Resend to send transactional emails such as verification codes. Your email address is transmitted to Resend for this purpose. Resend's privacy policy applies: resend.com/legal/privacy-policy.
Google Maps Platform (Google LLC)
Our interactive map uses the Google Maps JavaScript API to display maps and food location markers. When you use the map, your browser connects to Google servers to load map tiles and related resources. Google may collect your IP address, device information, and map interaction data.
Route planning uses the Google Directions API. When you plan a route, your waypoint coordinates and travel mode are transmitted to Google servers.
Location search uses the Google Geocoding API. Search queries you enter are transmitted to Google servers.
Google's privacy policy applies to all Google Maps Platform services: policies.google.com/privacy. See also Google Maps Platform Terms of Service.
OpenFreeMap and MapLibre GL (fallback map)
When Google Maps is unavailable, we fall back to MapLibre GL with map tiles from OpenFreeMap (tiles.openfreemap.org). When you use the map, your browser connects to OpenFreeMap servers to load map tiles. Your IP address may be collected by their servers.
OSRM — Open Source Routing Machine (fallback routing)
When Google Directions is unavailable, route planning falls back to OSRM via routing.openstreetmap.de. Your waypoint coordinates are transmitted to OSRM servers. No personal account data is sent.
Nominatim / OpenStreetMap (fallback geocoding)
When Google Geocoding is unavailable, location search falls back to Nominatim, operated by the OpenStreetMap Foundation. Search queries and coordinates may be transmitted to their servers. Their privacy policy applies: osmfoundation.org/wiki/Privacy_Policy.
Photon by Komoot (fallback geocoding)
As an additional fallback for location search, we may use Photon (photon.komoot.io), operated by Komoot. Search queries may be transmitted to their servers.
Cloudflare R2 (image storage)
User-uploaded images (food photos, avatars) are stored on Cloudflare R2 and served via images.gn-ava.org. When images are loaded, your browser connects to Cloudflare's network. Cloudflare's privacy policy applies: cloudflare.com/privacypolicy.
MyMemory Translation API
When food names are automatically translated, the text is transmitted to MyMemory (translated.net) for translation. No personal account data is sent. MyMemory's terms apply: mymemory.translated.net.
PostHog
We use PostHog for product analytics. PostHog is only loaded if you have accepted cookies. It collects anonymized data about how you interact with the platform (pages visited, features used, session duration). No personally identifiable information is sent unless you are a logged-in user, in which case your username may be associated with your analytics data. PostHog's privacy policy applies: posthog.com/privacy. You can opt out at any time by selecting "Reject" in the cookie banner.
Cloudflare
Our authentication API (api.gn-ava.org) is proxied through Cloudflare. All authentication requests pass through Cloudflare's network, which may process your IP address and request metadata. Cloudflare's privacy policy applies: cloudflare.com/privacypolicy.
Vercel
Our authentication server is hosted on Vercel. Authentication requests, including your IP address, may be processed by Vercel's infrastructure. Vercel's privacy policy applies: vercel.com/legal/privacy-policy.
WeChat / Tencent
We offer a version of the platform accessible via WeChat (微信) as a miniprogram. If you access the platform through the WeChat client, Tencent's privacy policy governs the data collected by WeChat itself. When you log in via WeChat, we receive a token from WeChat to authenticate you; we do not receive your WeChat contact list, payment information, or other WeChat profile data beyond what is necessary for authentication. Tencent's privacy policy applies: tencent.com/en-us/privacy-policy.
Share cards and link previews
When you share a food record or profile link, your username, display name, avatar URL, and the food record's title and description are embedded in the share URL and transmitted to our share card server (api.gn-ava.org). When the link is opened or previewed by a third-party platform (such as WeChat, Twitter/X, iMessage, or Discord), that platform's crawler may request the share card and process the embedded metadata. We do not control how third-party platforms handle this data once a link is shared.
4. Legal basis for processing (GDPR)
If you are located in the European Economic Area, we process your personal data under the following legal bases: performance of a contract (to provide the service you signed up for); legitimate interests (to operate and improve the platform); and your consent (for any optional data processing).
5. International data transfers
Your personal data may be transferred to, and processed in, countries other than the country in which you reside. Our infrastructure is hosted primarily in the United States (Supabase, Vercel, Cloudflare). Firebase servers may be located in various regions worldwide.
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on appropriate legal mechanisms for international data transfers, including our service providers' adherence to applicable data protection frameworks and the necessity of the transfer for the performance of our contract with you.
6. California privacy rights (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
- Right to delete: You may request that we delete the personal information we have collected about you, subject to certain exceptions.
- Right to correct: You may request that we correct inaccurate personal information we maintain about you.
- Right to opt out of sale or sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
- Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise your rights, contact us at ranpsy2001@gmail.com. We will verify your identity before processing your request.
7. Data retention
We retain your account data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us at ranpsy2001@gmail.com. We will process your request within 30 days.
8. Your rights
Depending on your location, you may have the following rights regarding your personal data: the right to access your data; the right to correct inaccurate data; the right to request deletion of your data; the right to object to processing; the right to data portability; the right to withdraw consent at any time.
Data export: You can download a copy of all your personal data directly from your profile page — tap your avatar, scroll to the bottom, and select "Export my data."
To exercise any other rights, contact us at ranpsy2001@gmail.com.
9. Children's privacy
Our service is not directed to children under the age of 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
10. Changes to this policy
We may update this policy from time to time. We will notify registered users of significant changes by email. The date at the top of this page reflects the most recent update.
11. Contact
For any privacy-related questions or requests: ranpsy2001@gmail.com