Privacy policy

1. Who is responsible for your information

One Food Forward (Pty) Ltd. (“OFF”, “we”, “us”, or “our”), 101 Kyalami Drive, Killarney Gardens, Cape Town, 7441, South Africa, is responsible for this website and service. For privacy questions or requests, contact [email protected].

OFF intends to host production application and database data in the United States. The hosting company, precise region, email provider, and backup provider will be identified in this policy before production launch. The current development build does not verify those production arrangements.

2. Information we handle

Account information: email address, password hash, display name, verification and account status, timezone, unit preference, and saved account/report preferences. If you request an email change, the proposed replacement address is retained temporarily until confirmation, replacement, or expiry cleanup.

Health and activity information you enter: foods and meals; symptoms and severity; medication and supplement entries; conditions and allergies in your health profile; medical events; laboratory results; metrics; free-text notes; dates, times, quantities, units, and any additional details you choose to provide. This may reveal sensitive information about your health. Do not enter another person’s information unless you have authority and any legally required permission.

Catalogue suggestions: the category, proposed item name, optional note, account association, review status, and review timestamps. An approved catalogue name may be made available to other users; suggestion notes and account identity are used for review and are not intended to appear as part of the shared catalogue.

Security and service information: session identifiers, password-reset, verification and email-change token hashes, timestamps, and short-lived hashed identifiers used for rate limiting. The web server or hosting provider may also record technical connection data such as IP address, browser, and request time; production log contents and retention are not confirmed in this repository.

Payment information: the current public/live service is not configured to accept subscription payments. Development checkout is limited to Paddle Sandbox. OFF sends a pseudonymous internal account ID and plan code to Paddle to connect a completed checkout to the correct account. When live billing is launched, Paddle will collect payment details; OFF will store the account-linked Paddle customer and subscription identifiers, selected plan, subscription status, billing-period dates, and webhook event identifiers needed to provide paid access. OFF does not receive or store full payment-card numbers.

3. Why we use this information

• create and secure your account, verify your email, authenticate you, and help you recover access;
• store and display the health records, timeline entries, profile details, and preferences you choose to save;
• calculate reports and descriptive summaries from your own entries, and let you review patterns without claiming that one event caused another;
• review proposed catalogue changes, maintain shared catalogues, prevent duplicate or abusive submissions, and operate administrative review;
• maintain, troubleshoot, protect, and improve the service, and meet legal obligations; and
• if subscriptions are introduced, administer billing, paid access, cancellations, and customer support.

We do not currently send your health records or report facts to an AI provider. An optional consent record exists in the application, but the feature is not connected to a provider. If external analysis is introduced, we will explain what information is sent, to whom, and ask for the required consent before sending it.

OFF does not provide medical advice. Health records are used to store and display what you choose to enter and to produce descriptive summaries for your own review. OFF records the version of the Terms and Privacy Policy accepted and a separate health-data consent timestamp. A teen account remains paused until a parent or legal guardian confirms permission through a one-time email link. This flow is still under legal review and production email delivery is not configured; production health-data collection must wait until the legal and technical safeguards are approved.

4. When information may be shared

We do not sell personal or health information. We may disclose the minimum information needed to:

• service providers that host or maintain the application, database, backups, security, email, or payment functions, under appropriate safeguards and instructions;
• respond to a valid legal obligation or protect a person’s rights, safety, or the security of OFF; or
• review catalogue suggestions. If a suggestion is approved, its catalogue item name may be shared with users; we do not intend to publish the submitter’s account identity or note.

The timeline currently loads its web font from Google Fonts, so a visit to that page causes the browser to request font resources from Google. The legacy waitlist endpoint uses Cloudflare Turnstile when that endpoint is used. These integrations may receive technical connection information. We will update this list if the live service adds or changes providers.

Production data is intended to be hosted in the United States, so information about people in South Africa may cross an international border. Before launch, OFF will identify the providers and regions, document the transfer basis and safeguards, and update this policy with those details. We do not sell personal or health information.

5. Cookies, local storage, and technical logs

Sign-in uses a first-party session cookie needed to keep you authenticated. The application sets it as HttpOnly and SameSite=Strict; it is marked Secure when the page is served over HTTPS. The Timeline also saves a preferred-hand display setting in your browser’s local storage. The current pages reviewed do not include an advertising cookie or analytics tracker.

Your browser may make separate requests to third-party resources described above. Standard web-server and security logs may record technical request information. Exact production log fields and deletion periods must be confirmed with the hosting operator.

6. Security and retention

Passwords are stored as Argon2id password hashes, not as readable passwords. The application uses authenticated sessions and user ownership checks for account records. The application does not currently apply field-level encryption to health records or account details in the database. Production encryption at rest, backups, and HTTPS must be verified with the hosting provider before launch; this local development build is not a production security guarantee.

Expired account verification, password-reset, email-change, and guardian-confirmation tokens are removed during a once-daily cleanup the next time the account area or local outbox is visited. Because cleanup runs on a visit, deletion may be delayed while the site is inactive. Hashed rate-limit counters are removed after their last 15-minute window is more than 24 hours old. In local development, email messages that contain sign-in links are removed from the local outbox when they are more than seven days old; they are not sent externally. These cleanup periods are application defaults, and server and backup log retention is separate.

We keep account and health information while your account is active so the service can work. When you delete your account, the active database permanently removes the account and its associated profile, timeline, preferences, and suggestions. Some copies may remain in protected backups for up to 30 days, then are overwritten or deleted. This 30-day backup limit is the intended policy and must be confirmed in production backup settings before launch. We may retain a limited record where necessary to meet legal obligations, resolve disputes, or protect the service.

You can download a JSON export from account settings. It includes your account details, preferences, health profile, timeline records, personal catalogue suggestions, and meal-plan data. The export endpoint is currently restricted to the local development environment; it must be enabled and tested for the production account experience before launch.

7. Your choices and privacy rights

Depending on the law that applies where you live, you may be able to request access to your information, ask us to correct or delete it, object to or restrict certain processing, withdraw consent where processing relies on consent, or complain to a privacy regulator. You can change account settings and contact us at [email protected]. We may need to verify your identity before acting on a request.

For people whose information is processed in South Africa, health information is “special personal information” under POPIA. OFF will register the required Information Officer and confirm its lawful basis, specific consent, and cross-border safeguards before launch. The official POPIA text and Information Regulator guidance are available online.

8. Contact us

For privacy requests or questions, email [email protected]. Include enough information for us to identify your request, but do not send detailed health records or payment-card data by email. We may ask you to verify your identity before responding.

9. Children’s information

OFF does not intend to set a blanket minimum age. Adults manage their own accounts. For a teen aged 13–17, a parent or legal guardian must create and manage the account and confirm permission before health features are available. The current confirmation link records that approval but has not been legally validated as sufficient in every jurisdiction. The age category is self-reported and does not verify age. OFF does not currently support accounts for children under 13; an appropriate verifiable parental-consent process and an effective way to identify under-13 users must be implemented before serving them. In the current local build, consent messages are placed in a development outbox rather than sent by email.

10. Changes to this policy

We may update this policy as the service or applicable requirements change. We will revise the date above and provide notice of material changes through the service or by email where appropriate. The policy in effect when you use the service applies, subject to mandatory legal rights.

Related pages: Terms of use · Support.