Privacy Policy

Chof ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application, whether as an account holder or a guest user.

1. Information We Collect

Account Information

When you create an account, we collect your email address and password. If you use Sign in with Apple, we receive your Apple ID identifier and optionally your name and email.

Where you signed up from. When you create an account, we also save the country your connection came from when you finished signing up. We read it from your IP address and keep only the country, not the address. It tells us which countries new members come from. If you used Chof as a guest before creating an account or signing in, we also keep which guest record became your account, so you are counted once.

Guest & Usage Data

You may use certain features of Chof, such as scanning chocolate bars, without creating an account. In these cases, we may collect a unique device identifier or "fingerprint" to enforce daily scan limits and ensure service quality.

User's Content

We collect photos of chocolate bars that you scan using your camera or select from your photo library. These images are uploaded to our servers to identify the product. If you are not signed in, these scans are temporarily associated with your device identifier.

Usage Activity

We track interactions such as the chocolate bars you scan, rate, and add to your lists to provide and improve our services.

Where you got a bar. If you tell Chof where you got a bar, it is saved with that bar in your library. Other people don't see it. Chof staff can see it when running the service, as with your notes. You can change or remove it on the bar's page at any time.

Bars you add from an order. If you add bars from a screenshot or PDF of an order, we send the document to Google Gemini to read the shop's name, the order date and the chocolate bars on it. We don't store the document, and we don't keep your name, address, payment details or prices from it. We keep which bars you added, which shop they came from and when, for 13 months, so we can see how the feature is used. We also keep a note of when you added each order this way (not what was on it), so the free limit holds, until you delete your account. Deleting your account deletes all of it.

Links from shops and makers. Some shops and makers put an "Add these bars to Chof" link in their emails or on a card in your parcel. The link names only the bars: the shop doesn't send us your name or email. If you use it, we record that you added those bars through that shop's link, for 13 months. We may tell the shop or maker how many people added and rated its bars, only in groups of at least five people, and never who they were.

Event totals. After an event Chof takes part in, such as a chocolate festival, Chof may give the organiser two totals for each exhibiting maker: how many Chof accounts said they got that maker's chocolate at the event (answers given up to 30 days after it), and how many opened that maker's event code and then rated one of its bars, or scanned one of its bars with Chof's camera, during the event days. To make that count, Chof records when you open an event code in the app. A total is given only when at least five accounts are in it, and it is rounded. Chof never shares who is in a total, any rating, or anything else about you. We do this because it helps the event and its makers, and events help Chof reach new people (our legitimate interest). To be left out, turn off "Count me in event totals" in the app's settings, with or without an account, or email support@chof.nl. You are then left out of any total not yet made.

2. How We Use Your Information

• To provide and maintain the Chof service
• To identify chocolate bars using AI analysis
• To personalize your chocolate collection
• To improve our product identification accuracy
• To understand how Chof is used and improve it (product analytics, see PostHog in Section 4)
• To send service-related communications

Emails We Send

We send email to the address on your Chof account. If you use Chof without an account and ask for updates about a bar, we email the address you give us for that.

Account emails. We send these because they are part of using your account, and they cannot be turned off:

• Password reset
• A confirmation when you change your email address

Emails about your use of Chof. We send these on the basis of our legitimate interest in helping you get value from Chof and in keeping its chocolate data accurate:

• A welcome email shortly after you sign up
• Up to two emails in your first week that help you get started, depending on whether you have scanned, saved or rated a bar yet
• An email shortly after your first scan
• A reminder to rate a bar you scanned but did not rate, at most once a week
• A monthly recap of your own month on Chof, if you have 3 or more bars in My Bars. It covers your scans and ratings, the bars you added to Chof and what happened to them, new bars from makers in My Bars, and new details on your bars. We send it at most once a month, between the 3rd and the 7th, and not at all in a month with nothing new for you.
• A short email when a bar your scan added to Chof gets its first rating from someone else or reaches a community score. We send at most one a week.
• Now and then, a one-off email about a new Chof feature

Apart from the welcome email and the email after your first scan, we send at most one of these every 48 hours.

What these emails are built from. Your bars, scans and ratings, the bars your scans added to Chof, and new bars and details in the Chof catalog. When you rate a bar that another person's scan added, that person may get an email saying another Chof user rated it. We never tell them who you are.

Bar updates. If you ask to follow a bar, we email you once when the details you were waiting for are added. If you are not signed in, we first send a confirmation email, and nothing else is sent until you confirm it.

Chof Monthly. A monthly email about what is new in the Chof catalog. If you have a Chof account, we add you on the basis of our legitimate interest, unless you have unsubscribed from Chof Monthly or from our other emails before. Anyone else can subscribe at chof.nl/newsletter and confirms by email first. It has no advertising, and nobody pays to be in it.

Unsubscribing. Every email except account emails lets you unsubscribe. Some do it with one click. Others open an email to us, from a link in the email or your mail app's unsubscribe button, and we process those by hand. Unsubscribing from the emails about your use of Chof also stops Chof Monthly. Unsubscribing from Chof Monthly stops only Chof Monthly. You can also reply to any of these emails and ask us to stop.

Link tracking. In every email except Chof Monthly, our email provider Resend records when you click a link. Most links in our emails also carry a short tag naming the email, not you, so our analytics can count visits that came from it. We do not use open-tracking pixels.

3. Subscription and Payment Data

If you purchase Chof Premium, your payment is processed directly by the Apple App Store or Google Play Store. We do not collect or store your full credit card details.

We receive subscription metadata (such as subscription status, product ID, and expiration dates) to provision your Premium access, managed via our provider RevenueCat.

4. Third-Party Services

Google Gemini AI

We send image data to Google's Gemini AI for the sole purpose of identifying chocolate bars, including the order screenshots or PDFs you choose to add, to read the bars on them. Google does not use this data to train their models.

Supabase

We use Supabase for authentication and database services. Your data is stored securely on Supabase infrastructure.

Sentry

We use Sentry to monitor app crashes and errors to improve the user experience. This may include device information and error context.

Braintrust

We use Braintrust to monitor and debug AI identification quality. We log operational metadata about AI calls. We do not store raw scan images in Braintrust.

RevenueCat

We use RevenueCat to manage cross-platform subscriptions and in-app purchases. RevenueCat receives anonymized app user IDs and purchase receipts to validate and provision your Premium access.

PostHog

We use PostHog for product analytics on this website and in the app, to understand how people use Chof and to improve it.

Approximate location. PostHog reads the IP address your browser or phone sends with each analytics event and looks it up in a location database. It adds the continent, country and city to the event, then discards the IP address, so our analytics do not keep it. Until October 6, 2026 it also added the region, postal code and rough coordinates of that area, and records from before then keep them. We never receive your device's GPS location. We look at location in aggregate, for example to see which countries and cities Chof is used in and to filter out automated traffic.

How long we keep it. PostHog keeps analytics events, including this approximate location, for up to 7 years. It also keeps the first and the latest location it saw on an analytics profile for your device or account, until that profile is deleted. Both are linked to a random ID for your device or your account, not to your name or email address. When you delete your account in the app's settings, or delete your data there as a guest, we also ask PostHog to delete the analytics profile linked to it, with its events. PostHog removes them in the background. If that request fails, your account is still deleted but those analytics may remain. Analytics from your visits to this website are linked only to a random ID for your browser, so deleting your account does not remove them. In either case, email support@chof.nl and we will delete them.

From this website to the app. When you tap a Google Play link on this website, the link carries a random ID made for that tap. Google Play passes it to the app when you install it, and the app sends it to PostHog when you first open it. This tells us which page led to the install. It links that one website visit to the app on your phone, and carries nothing else about you.

Shared ratings. When you share a rating from the app, the message holds your star rating, up to three of your flavour notes and a link. Your private notes never go out, and the message is sent by the app you choose, not by us. The link carries a random code. Our analytics record the code with your share, and again when someone opens the link or rates the bar after opening it, so we can count how many shared ratings are opened and rated. The code contains no name or account details.

Resend

We use Resend to send email, including password reset emails. Resend receives your email address and the content of each email, and records delivery, bounces, and link clicks as described in Section 2.

Mapbox

When you view our interactive maker map on the website, we use Mapbox to render the map. Mapbox may receive your IP address and map interaction data (such as the area you view and your zoom level) to deliver and improve the mapping service.

5. Data Security

We implement appropriate security measures to protect your personal information. All data transmission is encrypted using HTTPS.

6. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and associated data
• Export your data
• Opt out of non-essential emails, and object to processing based on our legitimate interest

You can stop the emails in Section 2 at any time, as described there.

7. Account Deletion

You can delete your account at any time through the mobile app's Settings page. This will permanently remove your scans, ratings, and personal information from our database. We also ask PostHog to delete the analytics profile linked to your account, with its events. If that request fails, your account is still deleted but those analytics may remain; email support@chof.nl and we will remove them. See PostHog in Section 4.

Email history (which emails we sent you, when, and whether you unsubscribed): retained while your account is active, and deleted when you delete your account. Resend keeps its own delivery and click records under its own retention terms. An address you gave for bar updates without an account is kept until you unsubscribe or ask us to delete it.

8. Children's Privacy

Chof is not intended for children under 13. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or via email.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

support@chof.nl