Privacy Policy
This Privacy Policy explains how Drank It! (published in Japan as 「呑んだよ！」, referred to below as "the Service", "we" or "us") handles personal information. It applies to the mobile app and to this website.
0Who we are
The Service is operated from Japan by the developer of Drank It!. For the purposes of the UK GDPR and the EU GDPR we are the controller of the personal data described in this policy. You can reach us at any time at support@salarymans-omakase.com; this is also the address for privacy requests and for any question about this policy.
- GPS or precise location — never requested, never collected.
- Your date of birth — we store only the fact that you confirmed you are of legal drinking age. The date itself is never sent to us.
- Tracking advertising identifiers — we do not use the IDFA/AAID to track you across other companies' apps and websites, and the app never shows Apple's App Tracking Transparency prompt because we have nothing to ask for.
1Information we collect
"Legal basis" in the table below applies to users in the United Kingdom and the European Economic Area. Elsewhere, we rely on your agreement to these terms and on applicable local law.
| Data | How we get it | Why | Legal basis (UK/EEA) |
|---|---|---|---|
| Email address | You enter it when you sign up | Account authentication, essential service notices | Performance of a contract |
| Handle, display name, bio, avatar | You set them | Showing your profile | Performance of a contract |
| Apple / Google sign-in identifier | If you use social sign-in | Letting you log in without a password | Performance of a contract |
| Confirmation that you are of legal drinking age | A checkbox at sign-up (we do not collect or store your date of birth) | Keeping the Service restricted to adults | Legal obligation / legitimate interests |
| Posts — photo, caption, drink, rating, place (free text), date and time | You post them | The core function of the Service | Performance of a contract |
| Follows, blocks, likes, comments | Your actions in the app | Social features | Performance of a contract |
| Reports — reason and details | You report a post, comment or user | Acting on inappropriate content | Legitimate interests (safety of users) |
| AI recognition logs — the result of recognising a label image, barcodes, search terms | Generated when you add a drink | Improving recognition accuracy, detecting abuse | Legitimate interests |
| Push notification token | Issued by your device if you allow notifications | Delivering notifications you asked for | Consent (you can turn it off in your device settings) |
2Location
The Service does not collect GPS or any other precise location data. The "place" on a post is free text that you type yourself. Please do not enter your home address or anything else you would not want to be public.
Separately, advertising and hosting providers can infer an approximate, city-level location from your IP address. That is described in sections 4 and 5.
3Camera and photos
We ask for access to your camera and photo library so that you can photograph a label, scan a barcode, or choose a picture for a post. Images are used only for your post and for identifying the drink. Access is requested at the moment you first use the feature, and you can refuse or revoke it in your device settings — the rest of the app continues to work.
4Advertising
The app shows banner advertisements supplied by Google AdMob.
- We have configured AdMob to serve non-personalised ads only. Ads are not selected on the basis of a profile built from your behaviour across other apps and sites.
- Even non-personalised ads require some data in order to be delivered at all: your IP address (from which an approximate location can be derived), device and browser type, and interactions with the ad. Google uses this for ad delivery, frequency capping, fraud prevention and aggregated reporting.
- In the United Kingdom and the EEA, a Google-certified consent message is shown before ads load. You can change your choice at any time in the app under Settings → Ad privacy settings.
- For the data it processes to serve ads, Google acts as an independent controller. See Google's Privacy Policy and How Google uses information from sites or apps that use our services.
5Who we share information with
| Recipient | What they receive | Purpose | Where |
|---|---|---|---|
| OpenAI, L.L.C. | The drink label image and the drink name you typed | Recognising the drink and generating basic information about it | United States |
| Google (AdMob) | IP address, device type, ad interactions (see section 4) | Serving non-personalised ads | United States and other countries |
| Expo (Expo Application Services), Apple APNs, Google FCM | Your push token and the text of the notification | Delivering push notifications | United States |
| Amazon Web Services | All service data, as our hosting provider | Running the Service | Japan (Tokyo region) |
| Google Analytics | Website usage only — not used inside the app | Understanding how this website is used | United States |
Only the drink image and the drink name are sent to OpenAI. Your name, handle and email address are not. Data sent through the OpenAI API is not used to train their models under their API terms.
We do not sell your personal information, and we do not disclose it to third parties for their own marketing. We may disclose information where we are legally required to do so, or where it is necessary to investigate abuse of the Service.
6Where your data is stored, and international transfers
The Service runs on servers located in Japan (AWS Tokyo region,
ap-northeast-1). If you use the Service from outside Japan, your data is transferred
to Japan.
- For users in the United Kingdom: Japan is covered by the UK's adequacy regulations, so transfers to our servers do not require additional safeguards. Transfers to US-based processors (OpenAI, Expo) are made under those providers' data processing terms, which incorporate the standard contractual clauses together with the UK International Data Transfer Addendum.
- For users in the EEA: Japan is covered by the European Commission's adequacy decision of 23 January 2019. Transfers to US-based processors are made under the standard contractual clauses.
7What is public and what is not
- Public: your handle, display name, bio, avatar, posts, drink log, rank and badges, and who you follow.
- Never public: your email address, your password, the list of people you have blocked, and the content of reports along with who filed them.
- If you set your account to private, your posts and drink log are visible only to your followers.
The weekly leaderboard shows handles and points only. It never shows what or how much anyone drank.
8Keeping and deleting your data
- You can delete your account from inside the app at any time. Your email address and handle are anonymised and your posts become private. Full instructions, including how to ask us by email, are on the Account & data deletion page.
- Reports and administrative audit logs are kept for 180 days after deletion so that we can respond to lawful requests and investigate repeat abuse. After that they are erased.
- Comments other people left on your posts belong to those people and remain.
- While your account is open we keep your data for as long as you use the Service.
9Cookies and analytics
The app does not use tracking cookies or advertising identifiers for tracking.
This website (osakenondayo.com) uses Google Analytics to understand how the site is used. It sets cookies that collect usage information in a form that does not identify you personally. You can block this by disabling cookies in your browser. See How Google uses information from sites or apps that use our services.
10Children
The Service is intended only for people who are of legal drinking age where they live, which is never younger than 18. We do not knowingly collect personal information from children. If we learn that we hold information about a child, we delete it promptly. If you believe a child has given us personal information, please contact us and we will remove it.
11Security
All traffic is encrypted with HTTPS. Passwords are stored hashed, never in plain text. Authentication uses tokens with a limited lifetime. No system can be guaranteed to be completely secure, but we review these measures as the Service changes.
12Your rights
Everyone
You can see and change most of your information directly in the app, and you can delete your account there too. For anything else — a copy of your data, a correction, or complete erasure — email us at support@salarymans-omakase.com. We verify who you are and then respond within 30 days. There is no charge.
United Kingdom and EEA (UK GDPR / GDPR)
You have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we process your data;
- receive the data you gave us in a portable, machine-readable format;
- object to processing that we carry out on the basis of legitimate interests;
- withdraw consent at any time, where we rely on consent — this does not affect processing that already took place.
We do not carry out automated decision-making that produces legal effects concerning you.
If you are unhappy with how we have handled your data you can complain to your supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.
California (CCPA/CPRA)
In the 12 months before the date of this policy, we collected the categories of personal information listed in section 1, which fall under the CCPA categories of identifiers (email address, account identifiers), internet or other electronic network activity (interactions with ads, app usage), geolocation only in the coarse, IP-derived sense described in section 4, and audio, electronic, visual or similar information (the photos you post). We collect it from you directly and from your device, for the purposes given in section 1.
- We do not sell personal information, and we have not done so in the preceding 12 months.
- We do not share personal information for cross-context behavioural advertising as the CPRA defines "share" — the app serves non-personalised ads only.
- We do not collect sensitive personal information as the CPRA defines it, so there is nothing to limit the use of.
- You have the right to know, delete and correct your personal information, and not to be discriminated against for exercising those rights. Use the contact address above; an authorised agent may make a request on your behalf with written proof of authorisation.
13Changes to this policy
If we change this policy we will post the new version on this page and update the date at the top. We will notify you in the app about significant changes.