One Bite Together

Privacy notice

One Bite Together is operated by Maya Loka Media. Effective 15 September 2026. Contact sid@mayalokamedia.com for privacy questions or deletion requests.

For parents and families

A parent sets up and supervises this physical-book companion. We do not run advertising or AI features. You do not need to provide an email address or phone number to activate an issued book code.

Information on your device

Names or labels you enter, book progress, certificates and activity photos are stored on your device, or in browser site storage on the web. Take photos of the activity or book page and avoid including children or private information. The app does not automatically upload these activity photos to our servers.

Book activation

New book codes are verified online. Our Cloudflare access service receives the code and a random installation credential over an encrypted connection, and stores their hashes, the book identifier, device-registration timestamps and access status. It does not receive your child name or activity photos. We use these records to provide paid-book access, enforce two active installations and handle support or abuse. First activation requires internet. The signed access record then keeps working on this device without further internet; when the device does have internet, the app re-verifies the record from time to time.

Other connections and sharing

The app uses hosting and media services, including Firebase Hosting and Cloudflare, and loads shop information from Shopify. These providers receive network information such as IP addresses when contacted and may process it under their own infrastructure/privacy practices. The access service temporarily uses a salted hash of the IP address to limit repeated attempts. If you choose to share, the selected image and text go to the app or service you choose. Review them before sharing. Store purchases and payments are handled by the store and its payment providers under their own policies.

Permissions and reminders

Camera and photo access are used when you choose to capture or select an activity photo. You can decline permissions or skip the photo. Daily reminders are optional and can be disabled in Settings or your device settings. Campaign push notifications are disabled in this version; an existing installation may contact Firebase to remove an older push token.

Storage, retention and deletion

Use the app’s Settings controls to remove books, reset progress or delete photos as described in each confirmation. These are different operations; removing a book does not necessarily delete its photos. Clearing app/site storage or uninstalling can remove local data. Operating-system backups and device transfer may copy local information according to your device settings; they are not backups operated by One Bite Together. The secure installation credential is excluded from Android backup/transfer and uses device-only Keychain accessibility on iOS.

Server records and your choices

We retain access records while the code is active or needed for access administration. To request removal of server-side device registrations, withdrawal of access, or deletion of information sent to support, email sid@mayalokamedia.com. We may ask for limited evidence of ownership, such as purchase details, and will explain any information we must retain for an unresolved dispute, fraud prevention or a legal obligation. A revoked code’s hash and status may be retained to prevent reuse. Rate-limit records expire and are cleaned up. Providers may retain backup or security records according to their own retention controls.

Support and policy changes

We receive the information you choose to send to support and keep it only as needed to resolve the request and meet justified recordkeeping obligations. Do not send passwords, full payment details or unnecessary child information. Contact sid@mayalokamedia.com to request access, correction or deletion. If we introduce email/WhatsApp purchase verification or change these data practices, we will update this notice before using the new flow.

Contact privacy support / request deletion