EastOak App Privacy Policy
Effective date: November 15, 2026
1. Who we are and scope
Hangzhou Yixiang Technology Research and Development Co., Ltd., operating under the EAST OAK brand (we, us or our), is responsible for the personal information described in this policy. Our privacy contact is the IoT Project Manager at support@eastoak.com. Our U.S. mailing address is 8620 Thornton Avenue, Newark, CA 94560, USA.
This policy covers the EastOak App and compatible connected-appliance Services, including accounts, pairing, remote monitoring and control, cooking records, recipes, favorites, device sharing, notifications, updates and communications with us. The App is distributed through United States and Canadian app stores, and products are primarily sold in the United States. It also covers authorized use elsewhere when available. It does not state that we offer products or operate locally in every country. Mandatory rights apply according to the relevant law and circumstances.
The Services use the cloud. This policy is separate from the Bluetooth-only Probe App notice and from notices for shopping or other external websites. Our Terms of Use are at https://www.eastoak.com/pages/eastoak-app-terms-of-use.
2. Information we process
Account and authentication information. We process your email address, account identifier, username, verification codes, password-derived authentication information and login tokens to register, authenticate and protect your account. A telephone number is processed if you provide one or it is associated with your profile; it is not required by the email-registration flow.
Third-party sign-in. If you choose Apple, Google or Facebook sign-in where available, we receive the provider's account identifier, authentication result and profile information you authorize, such as a name and email address. Availability depends on the provider and the permissions you grant. We do not receive that provider account's password. We use this information to create or connect your EastOak account and manage access.
Appliance and connection information. We process device identifiers, including MAC addresses and device keys; product, model and device names; firmware versions; device bindings and sharing relationships; connection and signal status; operating time; and a Wi-Fi network name when reported. This supports identification, connectivity, management and updates.
Cooking and saved content. We process temperatures, targets, settings, commands, start and end times, duration, status, alarms, cooking-record identifiers, and titles or notes you save. We also process your recipe selections and favorites when you use those functions. The information supports monitoring, control, saved history and the functions you request. A device or record can be associated with your account and visible to authorized shared users.
Network setup information. The App accesses Wi-Fi network names and, where supplied by the operating system, an access-point identifier such as a BSSID. Wi-Fi passwords are handled as described in Section 4.
Notifications. We process your account identifier, push token, platform, language, notification settings, message information and read status to deliver and manage appliance and cooking notifications. Android uses Google Firebase Cloud Messaging (FCM); iOS uses Apple Push Notification service (APNs). The delivery provider also processes technical information needed for its service.
Technical communications and logs. Our endpoints process connection information, including IP addresses, request times, authentication and operational status, to deliver and protect the Services. Appliances automatically report operating status. Device communication logs include a device MAC address and precise timestamps. App and local native-component logs can contain connection events, errors and operating context, but exclude Wi-Fi passwords and authentication secrets. Necessary communications and operational logs are distinct from non-essential App usage analytics, which are disabled for the release covered by this policy.
Communications and marketing preferences. If you contact us by email or another offered feedback channel, we process the contact information, device details, message and other information you actively provide. We process email-subscription choices, consent evidence and unsubscribe requests to manage our own promotional emails. Please do not send passwords, authentication tokens or unrelated sensitive information.
3. Sources and purposes
We receive information from you, the App, your phone's operating system, connected appliances, sign-in providers and providers involved in infrastructure and message delivery. Another authorized user can provide your account name or email when inviting you to share an appliance.
We use the information to provide and secure accounts; pair and manage appliances; transmit commands and display status; maintain cooking history, recipes and favorites; manage shared access; deliver operational notifications and firmware updates; diagnose faults; respond to your messages and privacy requests; prevent misuse; send our own promotional emails under applicable consent rules; and comply with legal duties. We explain material purposes at collection and obtain any consent required by law. Acceptance of the Terms of Use is not blanket consent to unrelated uses.
The App does not use non-essential App usage analytics in the release covered by this policy. This does not stop the device communication, authentication or operational processing needed for the functions you request. We do not use App information for cross-platform targeted advertising or decisions based solely on automated processing that produce legal or similarly significant effects on you.
4. Permissions and Wi-Fi passwords
Bluetooth and nearby-device permissions support discovery and pairing. Wi-Fi and local-network access support network setup. On some systems, location permission is required for Wi-Fi information or discovery; that request does not itself mean we collect GPS coordinates. Notification permission allows alerts to appear. You can change permissions in your phone settings; the related function may then be unavailable. The functions described here do not require access to your contacts or photo library.
Your Wi-Fi password is used only on your phone and compatible appliance for local provisioning. We do not upload it to EAST OAK servers, AWS or other cloud platforms, or third-party servers. It is excluded from uploaded logs, exception reports, analytics and other server-bound data. If you select remember password, it is stored locally for that network and excluded from cloud backup and synchronization. The appliance retains credentials as needed to connect to your Wi-Fi network. Before transferring it, reset it according to its manual.
To stop remembering a network password, clear the remember-password option and continue through that network's setup. Signing out does not necessarily remove saved Wi-Fi credentials or local log files. Clearing App data or uninstalling the App generally removes local App data, subject to operating-system behavior, and does not delete cloud information.
5. Recipients and disclosures
We use Amazon Web Services (AWS) for supporting cloud infrastructure, Google FCM for Android push delivery and Apple APNs for iOS push delivery. Apple, Google and Meta/Facebook are involved when you choose their respective sign-in option. We use Espressif Wi-Fi components and provisioning SDKs to set up the local appliance connection; this does not authorize uploading your Wi-Fi password to Espressif or another provider. We limit disclosures to what is needed for the relevant service and apply contractual and access protections appropriate to the provider's role. Platform providers may also handle information under their own privacy notices.
Authorized shared users may receive the inviter's display information and shared-device information and may see activity and operate the appliance within the permissions provided. Cancel sharing when access is no longer appropriate.
We may disclose information when required by law or valid legal process, to protect rights and safety or investigate misuse, or at your request or with your consent, subject to applicable law. A merger, acquisition or similar transaction will be handled with the protections and notice required by law.
We do not sell personal information, share it for cross-context behavioral advertising, or provide it to partners for their independent marketing. We do not display third-party targeted advertising in the App. Our own promotional emails are described in Section 7.
6. Storage and international access
The EAST OAK-operated account and connected-device service data covered by this policy is stored in the United States. Authorized operations personnel in China may remotely access it for service operation, maintenance, security and troubleshooting. We limit access according to job needs and apply confidentiality, access-control and other appropriate safeguards.
United States storage does not mean that every provider processes information only there. Sign-in and push providers, including Apple, Google and Meta, may process delivery or account information in countries where they or their providers operate, according to their applicable notices and arrangements. Information processed outside your country or province may be subject to local laws and lawful government-access powers.
We remain responsible for our applicable obligations when using providers and apply the contractual, assessment and other cross-border safeguards required by the law that applies. You can contact our privacy officer for information about these arrangements. Merely accepting this policy does not waive mandatory cross-border protections.
7. EAST OAK promotional emails
EAST OAK sends its own promotional emails. We obtain the consent required by applicable law and distinguish marketing permission from account registration and essential service messages. Refusing or withdrawing marketing consent does not prevent use of core connected features.
Each promotional email identifies the sender and provides an unsubscribe method. Use that method or email support@eastoak.com to stop promotional emails. We process requests without delay and no later than 10 business days after receipt. Necessary account, security and service messages may continue. We retain only the minimal suppression information needed to respect your choice and prevent unwanted resubscription.
8. Retention
Account, active device-binding and sharing information is kept while needed to provide the requested account and access. Cooking history, saved notes and favorites are kept while you use the relevant function unless you delete them or your account. Account deletion is described in Section 9.
Raw device communication logs are retained on a rolling basis for no more than 90 days from creation. After account deletion, retained logs contain no account-binding information, but may still contain a MAC address and precise timestamps. We do not describe these raw logs as anonymous merely because a binding record has been removed. They remain subject to applicable personal-information protections and deletion requirements.
We may keep effectively anonymized aggregate technical data long term for legitimate reliability, safety and product-improvement purposes. Anonymization must prevent reasonably foreseeable direct or indirect identification; removing a name or replacing a MAC address with a stable hash is not, by itself, enough. We do not attempt to reidentify anonymized data.
Other operational notification, connection, security and correspondence information is kept only as long as necessary to deliver the relevant function, resolve the issue or meet an identified legal need. Factors include whether the request remains open, whether the data is necessary for a specific fault or security investigation, and applicable limitation or preservation requirements. We restrict and delete it when those needs end. Information is not retained indefinitely merely because storage is available.
Backups are subject to the applicable retention and deletion rules; freezing or archiving a copy does not create an indefinite retention exception. Copies awaiting scheduled erasure are isolated from ordinary use, and deletion requirements are reapplied if a backup is restored. Any narrowly applicable legal or necessary security-preservation exception is limited to relevant information, access, purpose and duration. It is not a general extension for every device log. Where law requires earlier deletion, that requirement prevails.
9. Account deletion and external requests
To delete your account in the App, use its account-deletion function and complete the confirmation. Your account is then deleted immediately, your associated cooking records are cleared, and account-based remote and sharing access is withdrawn. Other associated personal information is deleted or effectively anonymized when no longer lawfully required for the limited purposes in Section 8. The raw device-log rule and narrow lawful exceptions in that section remain applicable.
You can also request account and associated-data deletion without installing or opening the App. Email support@eastoak.com from your registered email address with the subject “EastOak App Account Deletion”. For third-party sign-in, identify your EastOak account using the associated or relay email address where available. We may request proportionate verification and explain the external processing steps and any applicable exception. Do not send your password. We confirm the outcome and respond within applicable statutory deadlines. If you cannot access the registered address, contact the same mailbox for an alternative verification route.
Deleting an account does not itself turn off an appliance. Check its state before deleting and follow its manual. Uninstalling, signing out, unbinding and deleting an account are different actions. They do not automatically erase one another's data. Reset an appliance before transferring it to another person.
10. Rights and choices
Contact support@eastoak.com to request information about our practices, access, a copy, correction or deletion, or to withdraw consent where applicable. We verify identity proportionately, do not request unrelated information and explain any lawful refusal or extension. Withdrawal does not make earlier lawful processing unlawful; it may affect functions that require that information. You may complain to our privacy officer and, where applicable, the competent regulator. We do not retaliate or unlawfully discriminate for exercising protected rights.
United States. Subject to your state's law and its applicability, rights may include access and portability, correction, deletion, authorized-agent requests, appeal of a refusal, and opt-outs from sale, advertising sharing, targeted advertising or certain profiling. To appeal, email us with the subject “Privacy Appeal”. California categories addressed here include identifiers, account and customer-record information, device/service activity, saved content, and authentication information that can be sensitive under applicable law. Sections 2–5 describe sources, purposes and recipients; Section 8 describes retention. Authentication information is used to provide and protect the service, not to infer personal characteristics. The collection and disclosure description applies to this release; for a service operating for less than 12 months, the relevant historical period begins when it started. We do not sell or share information for cross-context behavioral advertising as described above. Legally required preference signals are honored where relevant to processing we perform.
Canada. Subject to applicable federal and provincial law, you may request access, correction, information about disclosures, withdrawal of consent and any available deletion or portability rights. Our privacy officer is the IoT Project Manager at support@eastoak.com. You may also complain to the Office of the Privacy Commissioner of Canada or the relevant provincial authority, including the Commission d'accès à l'information du Québec. Where Quebec law applies, access, rectification, portability and other statutory rights, including applicable rights concerning dissemination and links, remain available under their legal conditions. A French version of this policy is provided.
Other locations. Mandatory privacy rights applicable to your circumstances remain effective. Contact our privacy officer to exercise them. Access from another country does not itself mean we actively offer the Services there or that every local law automatically applies.
11. Security and children
We use safeguards appropriate to the information and risks, including access controls, confidentiality measures and protection of account access and transmission. No system guarantees absolute security. Protect your account, phone and home network, install relevant updates and notify us if you suspect unauthorized use. We handle security incidents and required notices according to applicable law.
The Services are intended for adults who have reached the age of majority in their place of residence. We do not knowingly collect children's personal information in violation of law. If you believe a child has provided information, contact us so that we can investigate and take the legally required action.
12. External services and changes
Shopping pages, sign-in providers and external sites may process information under separate notices. This policy does not replace those notices. We will update this policy when practices change, identify the effective date and provide additional notice or seek consent for material new purposes where required before carrying them out.
13. Contact
Organization: Hangzhou Yixiang Technology Research and Development Co., Ltd.
Privacy officer: IoT Project Manager
Email: support@eastoak.com
U.S. mailing address: 8620 Thornton Avenue, Newark, CA 94560, USA
Please identify the EastOak App and describe your request. Do not include your password or authentication tokens.