Privacy policy

1. Who we are

munchcrunch (“we”, “us”) is a community snack database run by an individual based in Malaysia. We are the data user responsible for your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA). You can reach us any time through our contact form.

2. What we collect

• Account details — your display name and email address. If you register with a password, we store only a secure hash of it, never the password itself. If you sign in with Google, we receive your name, email address, profile photo link and Google account ID.
• What you contribute — ratings, reviews, comments, bookmarks, reports, and suggestions such as new snacks, corrections, prices, places to buy and photos.
• Messages to us — the name, email address, topic and message you send through the contact form.
• Approximate location — our host, Cloudflare, tells us which country a request comes from so we can show snacks from your country first. We use this only to pick that default and do not store it.
• Technical data — like any website, our hosting provider processes your IP address and browser details to deliver pages and protect the service against abuse. To limit contact-form spam, we keep a one-way hashed identifier derived from your IP address for one hour; we do not store your IP address itself.

3. How we use it

• To run your account, keep you signed in and show your contributions.
• To review and publish community submissions, and to moderate content and accounts.
• To reply to your messages and requests.
• To keep the service secure and prevent spam and abuse.

We process your data with your consent, which you give by creating an account, contributing, or contacting us, and as needed to provide the service you ask for. We do not sell your personal data, use it for advertising, or send you marketing.

4. What is public

Content you contribute — reviews, comments, ratings and approved submissions, including photos — is published on munchcrunch and may be indexed by search engines. Your display name appears next to your reviews and comments. Your email address is never shown publicly. Please don't include personal information in reviews or photos.

5. Who we share it with

• Cloudflare hosts munchcrunch and stores its database and files. Cloudflare operates data centres worldwide, so your data may be processed outside Malaysia, under Cloudflare's own security and privacy commitments.
• Google, only if you choose to sign in with Google.
• Our moderators, who see submissions and reports in order to review them.
• Authorities, where the law requires it or to protect the rights and safety of our users.

Snack information and photos come from Open Food Facts; we don't send your personal data to them. Some snack pages link to other shops, including clearly labelled affiliate links. Those sites have their own privacy policies.

6. Cookies and tracking

We only use essential cookies. An encrypted session cookie keeps you signed in; it is set when you sign in and removed when you sign out. If you sign in with Google, a short-lived security cookie protects the sign-in and is deleted as soon as it completes. Visitors who aren't signed in get no cookies. We do not use analytics, advertising or social-media tracking cookies, and our fonts and images are served from our own site.

7. How long we keep it

• Account details: until you ask us to delete your account.
• Contributions: if your account is deleted, your ratings, reviews, comments and bookmarks are deleted with it. Snacks, photos, prices and places to buy that were approved for the catalogue stay published but are no longer linked to you.
• Photos from rejected submissions: deleted when the submission is rejected.
• Contact messages: only as long as needed to deal with your request.

8. Security

We use HTTPS throughout, store passwords only as secure hashes, encrypt session cookies, and limit access to personal data to the people who run and moderate munchcrunch. No online service can be completely secure, but we work to protect your data and will act promptly if something goes wrong.

9. Your rights

Under the PDPA you can ask us to:

• give you a copy of the personal data we hold about you;
• correct personal data that is inaccurate, incomplete or out of date;
• delete your account and personal data;
• stop processing your data, by withdrawing your consent.

Send your request through the contact form, choosing “Privacy or data request”, from the email address on your account if you have one. We may need to confirm your identity, and we aim to respond within 21 days, free of charge. Withdrawing consent may mean we can no longer provide your account.

10. Children

munchcrunch is not intended for children under 13, and they should not create an account. If you believe a child has given us personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy as munchcrunch changes. We will update the effective date above, and for significant changes we will make it clear on the site.

12. Contact

Questions about this policy or your data? Use our contact form.