Privacy Policy

01 / Overview

Who we are and what this covers

Heated Social Club (“Heated,” “we,” “us,” or “our”) is based in Colorado, United States. We are responsible for the personal information described in this policy when you use the Heated mobile application, heatedsocialclub.com, our recipe-import tools, or related services (together, the “Services”). This policy is effective September 8, 2026.

This policy applies worldwide. Some sections give additional information for people in particular regions. If you use a third-party website or service through Heated, that third party’s privacy policy also applies to its service.

02 / Information we collect

What comes into Heated

Account and profile information

This includes your email address, account identifier, username, display name, avatar, authentication details, settings, and information received when you choose Sign in with Apple or Google. We do not receive your Apple or Google password.

Recipes and other content

We process recipes, source links, ingredients, instructions, nutrition details, photos, videos, audio, notes, cook posts, comments, follows, kudos, grocery lists, meal plans, and other information you create, upload, save, or share. We call this “User Content.” Camera, photo-library, clipboard, and sharing access occurs when you choose the related feature and subject to your device permissions.

Device, usage, and diagnostic information

Depending on your choices and location, this can include device and operating-system information, app version, IP address, language, time zone, push token, app screens and features used, referral or campaign information, approximate region derived from IP address, crash or failure details, and pseudonymous analytics identifiers. We do not need the full contents of your recipes or private notes for product analytics.

Purchases and communications

We receive subscription product, entitlement, transaction status, renewal, cancellation, and purchase-date information from Apple, Google, and RevenueCat. We do not receive your full payment-card number. We also collect messages you send to support and an email address you submit for a waitlist or product updates.

Information we do not seek

Heated does not ask you to provide government identifiers, financial-account credentials, precise location, or health records. Dietary choices can sometimes suggest sensitive facts; we do not use recipe or dietary information to infer health conditions, religious beliefs, or other sensitive characteristics for advertising.

03 / Recipe imports and AI

What happens when you import a recipe

Each import begins when you paste or share a link, select photos or video, provide text, or otherwise ask Heated to save something. Heated is a personal recipe organizer; it does not add recipes to your personal library through a general-purpose bulk crawl. We may follow redirects and creator-provided links to find the recipe associated with the item you submitted.

Source websites and social platforms

To complete an import, Heated or an in-app browser may request content from the source website or platform. That service can receive ordinary request information, such as an IP address, user agent, requested URL, and its own cookies. If you sign into a source inside a browser view, the source handles that sign-in under its own policy. Heated does not ask for your social-media password.

AI processing

We use automated extraction and AI providers to turn the material you submit into a structured recipe and to support recipe search or matching. Inputs may include source text, captions, images, video frames, and audio transcripts. We configure these services not to use your imports to train general-purpose models and use zero-data-retention options where available. AI output can be incomplete or wrong; review important ingredients, allergens, temperatures, and food-safety instructions.

Imported content belonging to other people

When you import content created by someone else, you direct Heated to process it for your requested feature. You are responsible for having permission or another lawful basis to submit and use that content. We preserve the original source link and available creator attribution where the product supports it. Copyright, acceptable-use, and takedown rules are addressed separately in our Terms.

Temporary import media is removed after processing and no later than seven days. Failed-import diagnostics are removed within 24 hours. A recipe you choose to save remains with your account until you delete it or your account, subject to the retention section below.

04 / Who can see your content

Your library, your audience

A person who receives a sharing link can copy it or send it to someone else. Link preview, messaging, social-media, and search services may also request the shared page when a link is posted through them. Do not include information in a shared recipe or cook post that you do not want its intended audience to see.

Email, authentication information, settings, private notes, grocery lists, meal plans, raw import artifacts, and billing information are not included in recipe sharing or follower-feed surfaces.

05 / How we use information

Why we process it

We do not use personal information to make decisions that produce legal or similarly significant effects about you. We do not repurpose personal information in a way that is incompatible with the reason it was collected without providing required notice or obtaining required consent.

06 / How we disclose information

The services that help Heated run

We disclose information only as needed for the purposes in this policy, when you direct us to share it, or when the law permits or requires it. Our principal provider categories and current providers include:

• Hosting, database, and storage: Supabase, Railway, and Backblaze B2.
• Purchases: Apple, Google, and RevenueCat.
• Authentication: Supabase, Apple, and Google.
• Notifications and app services: Expo, Apple, and Google.
• Product analytics and attribution: PostHog and AppsFlyer, subject to the controls below.
• Email and waitlist: Loops.
• Recipe extraction and transcription: OpenRouter and its selected model providers, including Google-hosted models, and Groq.

These providers process information for Heated under agreements and instructions appropriate to their role. Some providers also process limited information as an independent business—for example, Apple or Google when operating an app store or sign-in service—under their own privacy policies.

We may also disclose information to a successor in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets; to advisors protecting our legal rights; or to authorities when we reasonably believe disclosure is legally required or necessary to protect people, rights, and the Services. We will evaluate government demands and disclose only what the demand lawfully requires.

07 / Analytics and attribution

Optional measurement, with controls

PostHog helps us understand feature use, app and website performance, and where people encounter problems. Session replay can recreate interactions with Heated, but we configure it to mask text inputs, images, recipes, account information, and other user content. AppsFlyer measures app installation and subscription campaign performance.

In the EEA, United Kingdom, and other places requiring prior consent, optional analytics, session replay, cookies or similar local storage, and marketing attribution remain off until you affirmatively enable them. Session replay has a separate choice. Elsewhere, we may enable first-party measurement by default where permitted and provide an opt-out. Known minors receive the stricter defaults described below.

You can change available choices in Heated’s settings or the website’s Privacy Choices control. Withdrawal applies going forward and is as easy as granting consent. Essential authentication, security, purchases, imports, storage, and user-requested communications do not depend on optional analytics consent.

On Apple devices, we do not access the advertising identifier or conduct tracking as Apple defines it unless we first obtain the required App Tracking Transparency permission. Refusing that permission does not prevent purchases or core use of Heated.

08 / Retention

How long we keep information

When deletion is requested, information can remain briefly in encrypted backups until their normal expiry. We may retain a limited record longer when required for tax, accounting, fraud prevention, dispute resolution, or another legal obligation. We delete, aggregate, or deidentify information when it is no longer needed.

09 / Your choices and rights

You can ask, change, or leave

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of personal information; restrict or object to processing; withdraw consent; opt out of targeted advertising, sale, sharing, or certain profiling; and appeal a denied request. Heated extends access, correction, deletion, and analytics choices to users even where a particular law does not require each right.

• Update available profile and preference information in the app.
• Change optional analytics, replay, attribution, and notification choices in settings.
• Use the in-app account-deletion control to delete your account and associated content.
• Use the unsubscribe link in an email to stop marketing or product-update emails.
• Email [email protected] for access, correction, export, deletion, objection, restriction, or appeal requests.

We may need information reasonably necessary to verify your identity and protect your account. Authorized agents may submit requests where local law permits. We do not discriminate against you for exercising a privacy right. Deleting your Heated account does not cancel a subscription managed by Apple or Google; cancel it through the applicable store to stop future renewal.

10 / Regional disclosures

Additional information by location

EEA, United Kingdom, and Switzerland

Heated is the controller for the processing described in this policy. The legal bases appear in the table above. Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object and ask us about the balancing considered. You may also complain to the data-protection authority where you live, work, or believe a violation occurred.

California and other U.S. states

The categories collected are identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation, inferences about product preferences, and User Content. We collect them from you, your device, authentication or app-store providers, source services you ask us to access, and our service providers. We disclose these categories for the business purposes described above to the provider categories listed in this policy and to people you direct us to share with.

Heated does not “sell” or “share” personal information as those terms are defined by California privacy law, and has not done so in the preceding 12 months. We do not use sensitive personal information to infer characteristics. If these practices change, we will provide required notices and opt-out mechanisms before the change applies.

Colorado

Colorado residents may have rights to access, correct, delete, and receive a portable copy of personal data, and to opt out of sale, targeted advertising, or certain profiling. You may appeal a decision by replying to our response. Because Heated does not sell data or use it for targeted advertising, a universal opt-out signal does not currently change those practices.

11 / Children and teens

Heated is for people 13 and older

The Services are not directed to children under 13, and we do not knowingly collect their personal information. If you are below the age at which you may consent to data processing in your country, a parent or legal guardian must provide any consent required by local law. Contact us if you believe a child has provided information improperly.

For a user we know is a minor, optional analytics, session replay, and marketing attribution remain off until applicable consent is obtained. We do not sell minors’ information, use it for targeted advertising, or intentionally use design features to cause harmful or compulsive use.

12 / Security and transfers

Protecting information across borders

We use administrative, technical, and organizational safeguards designed for the nature of the information we process, including access controls, encrypted transmission, provider security reviews, restricted production access, and deletion procedures. No online service can guarantee absolute security. Use a unique password and contact us if you suspect unauthorized account activity.

Heated and many providers operate in the United States. Information may therefore be processed in the United States and other countries whose laws differ from those where you live. Where required, we use contractual and other approved transfer safeguards, including applicable standard contractual clauses, and assess our processors’ protections.

13 / Changes and contact

Questions belong at the table

We may update this policy as Heated changes. We will update the date above and provide additional notice when a change is material or consent is required. We will not use previously collected information for a materially incompatible new purpose without the notice or consent required by law.