Privacy Policy

1. Who we are

This app, Cheese on Toast ("we", "us", "our"), is operated by Cheese on Toast (ABN 82 097 590 964). You can contact us at john.create@protonmail.com or by mail at Three Centenary Heights, Toowoomba QLD 4350, Australia.

2. What we collect

• Anonymous device ID — a random ID generated in your browser to remember your achievements and subscription on this device.
• Email address — only if you choose to link an email for cross-device sync via our magic-link sign-in.
• App activity — which simulators you play, outcomes, badges earned, theme selections, page views.
• Payment metadata — if you subscribe, our payment processor Stripe handles the card itself. We only receive a Stripe customer/session ID, the package you bought, and renewal/expiry dates. We never see your card number.
• Technical data — IP address, browser type and operating system, captured in standard server logs for security and debugging.
• Cookies & local storage — we use browser localStorage to remember your settings and achievements offline. No third-party advertising cookies.

3. Why we collect it

• To run the app and keep your progress between visits.
• To process subscription payments and grant access to premium features.
• To send you a one-tap sign-in link when you ask for one.
• To understand which features are being used so we can build better ones.
• To protect against fraud, abuse and bot traffic.
• To meet our legal obligations (tax, consumer law, etc.).

4. Who we share it with

We use the following third-party processors — each is contractually bound to protect your data:

• Stripe, Inc. — payment processing. Stripe is PCI-DSS compliant. stripe.com/au/privacy
• Resend, Inc. — sending magic-link sign-in emails. resend.com/legal/privacy-policy
• Emergent Labs (hosting platform) — runs our backend infrastructure.
• MongoDB Atlas — hosted database for your account & achievements.
• Google (Gemini API) — used internally to generate the AI illustrations on our recipe pages. Your personal data is not sent to Google.

We do not sell your personal information, ever.

5. Overseas disclosure

Some of our processors (Stripe, Resend, MongoDB Atlas) store data on servers in the United States and the European Union. By using the app, you consent to the overseas transfer of your data to these jurisdictions for the purposes described above. We take reasonable steps to ensure these providers handle your data in line with the APPs.

6. How long we keep it

• Device records & achievements: until you reset them in Settings, or 24 months of inactivity.
• Account / email links: until you ask us to delete the account.
• Payment transactions: 7 years, as required by Australian tax law.
• Magic-link tokens: 15 minutes (auto-expired).

7. Your rights

Under the Privacy Act, you have the right to:

• Access the personal information we hold about you;
• Ask us to correct it if it's wrong;
• Ask us to delete your account and associated data;
• Withdraw consent for marketing emails at any time;
• Complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you're not happy with how we've handled your information.

To exercise any of these, email john.create@protonmail.com. We'll respond within 30 days.

8. Children

This app is rated suitable for ages 13+. We don't knowingly collect personal information from under-13s. If you believe a child has signed up, email us and we will delete the account.

9. Security

We use industry-standard measures: HTTPS everywhere, hashed tokens, isolated databases, and least-privilege access. No system is perfectly secure though — if a data breach affects you, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme.

10. Changes to this policy

We may update this policy from time to time. We'll post the new version here with an updated effective date. Material changes will also be announced inside the app.

11. Contact