Privacy Policy

Summary

• You can browse noodles, scores, comments and sightings without an account.
• To check in, comment, log sightings, keep lists or suggest a noodle, you sign in with Apple or Google.
• Your check-ins appear in the Feed and on noodle pages under your @handle, unless you make your profile private.
• The camera reads barcodes on your phone. Location helps you find a store when you add a sighting and, if you allow it, shows sightings near you. We never store where you are.
• A pack photo you send with a suggestion is seen only by our review team.
• The App shows ads from Google AdMob. Google's consent form appears where the law requires it, and Apple's tracking prompt decides whether ads can be tailored to you.
• You can delete your account in the App at any time.
• We don't sell your personal information.

Information we collect

Information you provide

• Your account. When you sign in, Firebase Authentication receives an account identifier from Apple or Google. Sign in with Apple shares your name, not your email address. Google Sign-In shares your name and email address with Firebase Authentication. We don't copy your email address into the App's database or use it to contact you.
• Your profile. A display name (from Apple or Google, or "Noodler" and a number), a unique @handle, your member number, the date you joined, and your counts, countries and badges. Your avatar is your initials; there are no profile photos.
• Check-ins. Your star rating, how hot it was, whether you ate it as it came or doctored it, any add-ins and sub-scores, the cook time, and the barcode you scanned, which is what makes a check-in verified. A check-in also records your phone's region setting as a country code, and the Feed uses it to show check-ins by country. It doesn't record your location.
• Comments. Up to 140 characters each.
• Sightings. The store's name, address, map position and country, which you pick from Apple Maps.
• Suggestions. The noodle's name, maker, country, format and weight, its barcode, and a photo of the pack if you add one.
• Likes and confirmations. The check-ins you like, and each "Still here" when you confirm a sighting.
• Reports. Reports you make about a comment or a member, with the reason you pick.
• Lists and settings. Your Want to try and Pantry lists, the members you block, and whether your profile is private.
• Inbox. Messages about likes, comments, approvals and badges, kept for 30 days.
• Email. If you write to us, your address and what you write.

Information collected automatically

• Usage and crashes. Firebase Analytics records how the App is used, such as which screens you open and when you scan or check in. Firebase Crashlytics records crash reports with the device model and the App version.
• Device details. Device model, iOS version, App version, language and region.
• Advertising identifiers. Google AdMob uses an identifier to deliver and measure ads. It is used to tailor ads only if you allow it (see Advertising and tracking).
• App Check. Apple's App Attest lets our server check that a request comes from the real App. It doesn't identify you.
• Notifications. If you allow notifications, the token your phone uses to receive them, and your time zone, so nothing arrives between 10 pm and 8 am.

How we use information

• To run the club: show noodles, scores, check-ins, comments, sightings and badges.
• To work out Slurp Scores. Verified check-ins count a little more. Scores are published as totals for each noodle, without names.
• To review suggestions and add approved noodles to the catalog.
• To award badges and send the notifications you allow: likes, comments, suggestion results and badges.
• To keep the club safe: filter offensive words, handle reports, and ban members who break the Terms.
• To show ads, fix bugs and improve the App.
• To answer your email.

Where the law asks for legal bases, ours are: running the club you joined (our contract with you), keeping it safe and improving it (our legitimate interests), and your consent for personalized ads and for notifications.

Where your data is stored

• With Google Firebase, in the United States: your account, profile, check-ins, comments, sightings, lists, suggestions and pack photos.
• With Amazon Web Services, in the United States: the noodle catalog and the published scores. These files hold no personal information.
• On your phone: a copy of the catalog, recent barcode lookups, your recent scans and cook timer, and your consent choices for ads.

If you live outside the United States, your data is transferred outside your country to the United States. Google and Amazon protect these transfers with the safeguards the law requires, such as standard contractual clauses.

Third-party services

We use only services that give your data the same protection as this policy, and they process it on our behalf. Each also handles data under its own terms: Firebase, how Google uses information from apps that use its services, Apple, Open Food Facts and Amazon Web Services.

Permissions

• Camera. To read the barcode on a pack, on your phone, and to photograph a pack you suggest. Only the barcode number is used; camera images aren't kept or uploaded. A photo you choose to send with a suggestion is uploaded for the reviewer.
• Photos. You can pick a pack photo with the system's picker, which shares only the photo you choose. The App doesn't ask for access to your library.
• Location, while you use the App. Asked when you add a sighting, to find stores near you. If you allow it, the App also uses it to show sightings near you on Discover and on the Where to find map. Your position is never stored, and searches use areas about 5 km across.
• Notifications. Asked when you start your first cook timer, for the "ready" alert, or after your first check-in.
• Live Activity. The cook timer on your Lock Screen and in the Dynamic Island runs on your phone.

You can change any of these in iOS Settings.

Advertising and tracking

• The App shows native ads from Google AdMob in Discover, Browse and the Feed, and nowhere else.
• Where the law requires consent, for example in the European Economic Area, the United Kingdom and Switzerland, Google's consent form appears before any ad is requested.
• Then Apple's tracking prompt asks whether ads can be tailored to you. If you decline either one, ads aren't personalized. You see the same number of ads either way.
• To change your choice, use the privacy options row in the App's Settings, where it applies, or iOS Settings › Privacy & Security › Tracking.
• The App has no purchases.

What other members see

• Your @handle and initials, with your check-ins in the Feed and on noodle pages, and with your comments and sightings.
• With a private profile, in the App's words: "Your check-ins stay out of feeds and a noodle's recent check-ins. Your ratings still count toward Slurp Scores."
• Comments and sightings are public, including to people who aren't signed in.
• The share card shows your @handle and member number. You choose where it goes.
• Your phone's region on a check-in decides which country's Feed it appears in.
• Some details saved with public items, such as your display name, can also be read by software that uses the App's service directly.

Sharing

We don't sell or rent your personal information. We share it only with the services above to run the App, when the law requires it, or to protect members and the club.

Retention and deletion

• How long: we keep your information until you delete your account, except as described here.
• Delete your account in the App: Me › Settings › Delete my account. It takes effect at once. It removes your check-ins and the ratings in them, your comments and likes, the sightings you found (with other members' confirmations of them) and your own confirmations, your lists, blocks and reports, your suggestions and their photos, your handle and profile, and your sign-in account. If you signed in with Apple, the App asks Apple once more so it can revoke your Apple sign-in.
• What stays: noodles added from your approved suggestions, stores from your sightings, anonymous totals, and your member number, which isn't given to anyone else. Published scores catch up at their next update.
• Pack photos sent with a suggestion are kept with it until you delete your account.
• Inbox messages are kept for 30 days. Sightings over 180 days old drop off the map.
• For anything else, email apps@kantoprojects.com.

Moderation

• You can report a comment or a member as spam, rude or hateful, or something else. Three reports hide a comment until we've looked at it.
• Blocking a member hides each of you from the other.
• An automatic filter stops offensive words in comments, names, handles and store names.
• We may remove content and ban members who break the Terms. A ban ends sign-in, hides that member's comments and check-ins, and takes their ratings out of scores. A ban can be lifted.

Your choices and rights

• Browse without an account, keep your profile private, and turn notifications, location and tracking on or off in iOS Settings.
• Depending on where you live, for example under the GDPR or the CCPA, you may have the right to access, correct, delete or export your data, or to object to how it's used. Email apps@kantoprojects.com to use these rights. You can also complain to your local data protection authority.

Children

Hot Water Club isn't directed at children under 13, and we don't knowingly collect personal information from them. If you think a child has given us information, email us and we'll delete it.

Security

We use encrypted connections, Firebase security rules, App Check and limits on how often things can be posted. No system is completely secure, but we work to protect your information.

This website

hotwaterclub.kantoprojects.com has no analytics, no cookies, no forms and no sign-up. It is hosted on Firebase Hosting, which sees your IP address when it serves the pages, and its fonts are served from this site. If you email us, we use your address and message only to answer you.

Data sources

Data from Open Food Facts and USDA FoodData Central. Open Food Facts data is available under the Open Database License. Nutrition and dietary information comes from the pack and these sources. We don't verify it.

Changes

If this policy changes, we'll post the new version here with a new date.

Contact

Kanto Projects · apps@kantoprojects.com