Privacy Policy

Updated October 9, 2026

This policy describes Zaki's current prerelease app and related services, operated by Laith Abuhaija ("Zaki," "we," or "us"). Contact team@zakilabs.ai with privacy questions or requests. Zaki is intended for eligible adults in the United States.

Information we receive

• Account information: first and last name, phone number, account identifiers and authentication/session information. Phone verification uses SMS.
• Tastes and meals: onboarding choices, dishes and restaurants you like or dislike, ratings, dietary rules, allergies or intolerances you choose to provide, meal logs and preferences inferred from your activity. Dietary rules may reveal health information or religious beliefs.
• Conversations: messages, answers, corrections and relevant conversation history.
• Photos: a meal image you capture or select, and its selected creation time when available. Photo-library permission lets the app display recent photos locally; we do not intentionally upload your entire library.
• Location and delivery: device coordinates and accuracy when you grant location permission, addresses you enter or obtain through a connected account, delivery instructions and location choices.
• Connected services: when you connect DoorDash, session cookies, account references and an email hint, saved addresses, payment-method display information, cart information and order history. Native payment entry is handled by Stripe or the provider; Zaki receives payment tokens/references and card display information rather than intentionally storing full card numbers or security codes.
• Operational information: request identifiers, service timing/errors, activity and operation records, AI usage and cost-accounting information, and infrastructure request metadata. Some records can be associated with your account.

How we use information

We use information to authenticate you, maintain your account, record meals, build and correct Flavor DNA, personalize food suggestions, operate connected-service features, recover interrupted operations, prevent duplicate actions, protect the service, manage costs and provide support. Food preferences and meal history contribute to taste profiling. You can correct learned preferences and remove meal entries in the app; removal of a meal entry does not necessarily physically erase every underlying operational record.

AI processing and OpenAI

Zaki sends data to OpenAI's API for food conversation, suggestions, meal-photo recognition and dish tagging. Depending on the feature, this includes messages and conversation history, food preferences and dietary rules, connected-account addresses and cart context, selected meal images, and meal names, restaurants and menu descriptions. The current prerelease implementation can also tag saved meals and imported order history automatically when the app opens, and generate suggestions in the background.

Selected photos are resized and encoded on your device. The Zaki photo-analysis endpoint processes the uploaded image in memory and does not intentionally write the image to its database, files or application logs. It saves the resulting meal information. This does not mean the image remains on your device or that OpenAI retains no data.

Photo and dish-tag requests specify store:false. OpenAI's API has separate abuse-monitoring retention, which by default can include customer content for up to 30 days, with exceptions described by OpenAI. Account-specific data-sharing settings may also affect provider handling. See OpenAI's API data controls and OpenAI's Privacy Policy. Avoid putting unrelated sensitive information in chats or photos.

Service providers and connected services

Supabase provides account authentication and database services. The configured SMS delivery provider receives information needed to send verification messages. Amazon Web Services hosts Zaki's API and associated infrastructure. OpenAI processes AI requests. DoorDash and payment providers, including Stripe where used, receive information needed for their connected account and payment features. When you submit an order, information necessary to fulfill it is handled by the ordering service, restaurant and delivery participants.

Connecting DoorDash grants Zaki access to the connected website session and account information needed for those features. Zaki stores the provider session encrypted. The current connection is a consumer website-session adapter, not an official DoorDash OAuth or ordering API. It is not a statement of endorsement by DoorDash. DoorDash and payment providers operate under their own policies; deleting your Zaki account does not delete their accounts or records.

We may disclose information when legally required, to respond to valid legal requests, or as necessary to protect users and the service. This app does not include an advertising SDK or request Apple's advertising-tracking permission. We do not sell personal information or share it for cross-context behavioral advertising.

Retention and deletion

We keep account, preference, conversation and meal information while your account exists, unless you remove it through available controls or request deletion. Account deletion removes the Auth identity and account-linked active records covered by the database's deletion rules. Some transaction, security, operational and AI cost-accounting records can remain, including identifiers in accounting references. Backups and independent providers' records may persist under their own retention arrangements. We do not promise immediate erasure from every backup or provider.

The current prerelease app may fail to complete deletion when account/payment operations prevent it. Email us if the in-app deletion fails so we can investigate and arrange appropriate deletion or retention of records that must be preserved. Retained records are restricted to operational, security, accounting or legal needs. Contact us for information about retained records and the applicable retention arrangements.

Your choices and requests

You can change your name and phone number, edit food rules, correct learned tastes, remove meal entries, disconnect DoorDash, sign out and initiate account deletion in Me. You can revoke camera, photo-library and location permissions in iOS Settings; manual address entry is available. Revoking an iOS permission does not delete information already processed.

For access, correction, deletion or applicable state privacy rights, email team@zakilabs.ai. We may verify account ownership before responding. In the current prerelease app there is no separate AI-sharing withdrawal switch; contact us about stopping processing or deleting your account. Do not use AI features if you do not want the associated information sent to OpenAI.

Security

Zaki uses HTTPS, access controls and encryption for stored authentication/provider sessions. No system guarantees absolute security. Do not share verification codes or credentials, and contact us if you suspect unauthorized access.

Children

Zaki is intended for users who are at least 18 and legally able to form a binding contract where they live. We do not intend to collect information from children. Contact us if you believe a child has supplied personal information so we can investigate and remove it as appropriate.

This website and policy changes

These policy pages are hosted by GitHub Pages. GitHub may process visitor request information under the GitHub Privacy Statement. We may update this policy as Zaki changes. The date above identifies the latest version; material processing changes will require appropriate notice and permission where applicable.