Privacy Policy

• Your profile and your ratings are public by default. You can change both in Settings.
• We run no third-party analytics, tracking or advertising. There is no Google Analytics, no advertising pixel, no session recording and no fingerprinting on Tastbudz. We do keep our own counts — how many people used the site on a given day, which broad parts were read, and what was searched for — as daily totals on our own servers. Two first-party cookies support this: one is the same fixed value for every visitor and only tells us a browser was already counted today; the other holds a random identifier so we can tell that a browser has returned on a later day, which is how we measure whether Tastbudz is useful enough that people come back. Neither is used for advertising, neither leaves Tastbudz, and neither is combined with your name or email unless you create an account — see “How we count visitors” below for exactly what that identifier can and cannot do.
• The app asks before it uses anything on your phone. It uses your location only while you are using it, to find what is near you, and your camera or photo library only when you add a photo. It contains no advertising or analytics software and does not track you across other companies’ apps or websites.
• Share links. Sharing from Tastbudz gives you a short tbudz.me link. We count how many times each link is opened, as daily totals, without recording who opened it. If you create an account after opening a friend’s link we record that they introduced you, so we can thank them; nothing else about your visit is tied to the link.
• We never store your raw IP address in our database. Where we need it for abuse prevention, we store a salted hash of the network block and delete it after 30 days.
• Photo location data is removed. The app re-encodes a photo on your phone, so its GPS position and camera details never leave the device. On the website they are stripped as soon as the upload arrives, before the photo is published.
• You can delete your account yourself, in Settings on the website or from your profile in the app. How to delete your account.

Creating an account. Your email address, a username, a display name and a password (stored only as a hash — we never see or keep the password itself). If you sign in with Google, we receive your Google account identifier, email address, name and whether Google has verified that email; we do not receive or store your Google password, and we do not keep Google access tokens.

Signing in with Apple. In the iPhone app you can sign in with Apple instead. Apple then gives us an identifier for your Apple account, the email address you chose to share and whether Apple has verified it, and, the first time only, the name you chose to share. If you choose Hide My Email, the address we receive is a private relay address that Apple created for Tastbudz, and Apple forwards mail sent to it on to your real address, which we never learn. We do not receive your Apple password, and we do not keep Apple’s sign-in tokens.

Two-factor sign-in. If you turn it on, we create a secret that your authenticator app uses to make sign-in codes. We store the secret encrypted, under a key kept apart from our database, so a copy of the database alone cannot produce your codes. Your authenticator app keeps its own copy, labelled with your username. We also give you ten recovery codes, shown once, and keep each only as a one-way hash, so we cannot read them back.

Your profile. Optionally a short bio, a city and state, and a profile picture.

Preferences. Your privacy settings, an optional spice tolerance, and any dietary preferences you select. Some dietary options may reveal information about your religion (for example halal or kosher) or your health (for example gluten free or dairy free). We use them only to tailor what we show you, and they are not displayed on your profile.

A note on email addresses. Alongside the address you give us, we store a normalised form of it — lower-cased, with provider-specific aliases such as +tags removed. This lets us tell that two sign-ups belong to the same mailbox, which is how we prevent one person from quietly operating several accounts. It means an alias will not create a separate identity here.

Messages to us. When you send feedback or write to us, we keep what you send so that we can act on it and reply. Feedback sent from a page also records which page it came from, the version of the site or app, and your account if you were signed in.

Claiming a restaurant. If you claim a restaurant so that you can manage its listing, we record how you are connected to it (its owner, a manager or an agency working for it, for example) and that you accepted our declaration that you are authorised to act for it, including which version of the declaration you accepted. You then show that you speak for the restaurant in one of these ways:

• A work email address at the restaurant’s own website domain. We email a code there and keep the address you typed. To limit how many codes go to one address in a day, we count them against a one-way hash of the address, not the address itself.
• A DNS record on the restaurant’s domain. We keep only the value we asked you to publish.
• Documents: a business licence, health permit or utility bill in the business’s name, and a photo of the storefront showing a code we give you. They go straight from your browser to private, encrypted storage that only our administrators can open, and each time one is opened it is logged. They are never published or shown to anyone at the restaurant. Unlike photos added to ratings, they are kept exactly as you upload them, so details embedded in a photo, such as where it was taken, are not removed.
• A phone call from us to the restaurant’s listed number.
• A request to join, which goes to whoever already manages the restaurant on Tastbudz.

We never ask for a personal identity document, such as a driving licence or passport.

Ratings (an overall score plus optional taste, presentation and value scores), the notes you write, the date you say you visited, photos you upload, dishes and restaurants you submit, corrections you propose, lists you create, which ratings you have marked helpful, and the reports you send us about content or other users.

Ratings keep their history. Re-rating a dish does not overwrite your earlier rating — it supersedes it. The earlier version, including its note and photos, is retained so that the record of what you thought at the time stays intact.

Photos. In the app you can add a photo from your phone’s camera or photo library to a rating, to a dish or as your profile picture; only the photo you take or pick is uploaded. The app re-encodes it on your phone before sending it, and the embedded metadata does not survive that, so the photo’s location never leaves your phone. On the website, and as a second check on every upload, we strip embedded metadata as soon as a photo arrives and before it is published. That removes GPS coordinates, camera make, model and serial number, timestamps and any embedded thumbnail. The only field we deliberately keep is the orientation flag, without which photos display rotated. A file uploaded from the website reaches our storage provider before its metadata is removed; the original is never shown, and it is erased from our storage after 30 days. Stripping metadata does not change the picture itself — anything visible in the image is still visible.

Working for a restaurant. If you help manage a restaurant, the changes you make to its listing and menu and the replies you write to its ratings are published as the restaurant’s, not yours. We record which account made each one, so that it can be reviewed and, if need be, undone.

IP addresses. We do not store your IP address in our database. When you submit content, we record a salted, one-way hash of your network block (the first three parts of an IPv4 address) so we can detect abuse coming from one source without being able to recover the address. Those records are deleted automatically after 30 days. Your IP is also used transiently, in memory, to enforce rate limits, and may appear in server logs when a request is rejected for hitting an authentication rate limit.

Activity signals. We record certain events tied to your account: when you follow a link to an ordering provider, when you earn an achievement, when gamification features are shown to you, when you searched on a given day, and — once, at signup — how you found Tastbudz (for example, an invitation, or arriving from a search engine or social platform) and a coarse market area (for example, San Diego) resolved from your IP address or the restaurant you were viewing, never precise coordinates. We use these to understand which dishes, restaurants and markets draw interest and to decide what to build next. These records do not currently expire.

Session activity. Separately, on the website we record what happens on a page so we can tell whether the site is any good at its job: which dish you tapped from a list of results and what else was in that list, when a link out to a restaurant's own site or phone number is followed, and when a rating is begun. These records carry no account and no visitor identifier. They are grouped by a random key derived fresh each day, so events from one visit can be read together and events from different days cannot be connected — not as a matter of policy, but because the key is not the same key. Signing in does not change what is recorded: the same row is written either way.

We keep these raw records for 13 months and then delete them; the daily totals derived from them are kept. What they are for is ordinary and worth stating plainly: knowing which dish someone picked out of ten is the only way to tell whether the ten were in a sensible order.

Location. Tastbudz shows dishes near you. Your location may come from three places: your device's location service if you allow it (your browser's on the website, your phone's in the app — see section 4); an approximate city derived from your IP address; or the city on your profile. Coordinates from your device are sent to us only as part of the search they are for, and are never stored on your account. You can override all of these by choosing a city yourself. The IP lookup is resolved either by our content delivery network as it serves the page, or on our own servers from a local database — either way your IP is not sent to a third-party geolocation service, and we do not store it. We use the result to pick a sensible default city and, if you are outside the area our menus cover, to say so once.

No third-party analytics or tracking. We do not use analytics platforms, advertising networks, tracking pixels, session-recording tools or device fingerprinting, on the website or in the app, and no third party receives your activity on Tastbudz.

Our own aggregate counts. So that we can tell whether the service is working and what is missing from it, our servers keep a small set of daily totals: how many signed-in accounts were active on a calendar day, how many pages were served and to which broad part of the site, and which search terms were typed — including the ones that found nothing, which is how we learn what to add.

These are counts, and their shape is what protects you. For a signed-in account, our daily active-user total records at most that the account was active on a given date — not what was read or from where; the separate activity signals described above are the only account-tied records that carry a specific action, and are limited to the list given there. Counts of pages served and of searches by anonymous visitors carry no account, no identifier and no IP address at all, so they cannot be traced back to a person, by us or by anyone we might be compelled to answer. We do not build a profile of you or follow you across other websites. The one per-visitor record we do keep — the return-visit identifier described just below — holds nothing but a random token and a pair of dates; it is never disclosed or sold, and it is not personal information unless and until you attach it to an account by signing up.

How we count visitors. We use two first-party cookies for this, and they do different jobs.

The first expires at midnight and holds a single fixed character, identical for every visitor — it can only tell us “this browser has already been counted today”, cannot distinguish you from anyone else, and cannot be read by any other website. It backs the fully anonymous page- and search-count totals described above.

The second, newer cookie holds a random identifier and lasts up to 12 months, renewed each time you visit. It lets us recognize that the same browser has returned on a later day, which is the only way to answer questions like “do people come back to Tastbudz” and “how many distinct browsers visit in a month”. This identifier is not your name, email or account — until you sign in, we have no way to connect it to who you are — and it is never sent to or readable by any other website. If you sign up for an account while this cookie is present, we record, once, that this browser converted into that account and carry forward only the coarse arrival information described above (how you found Tastbudz, and a coarse market area); we do not attach your prior anonymous browsing to your new account.

You can clear this cookie at any time in your browser settings, which resets you to a new, unlinked identifier — this is the mechanism for opting out of return-visit counting. What this buys is still limited, and worth being plain about: we can see how many browsers return, not how many people. Two devices are two; a browser you clear is a new one; a shared computer is one.

The Tastbudz app for iPhone and Android uses the same account as the website, and this policy covers it. The app asks your permission before it uses any of the following. Each is optional, the app works without them, and you can change your answer at any time in your phone’s settings.

• Location, while you are using the app. Your phone’s precise location, used to show the dishes and restaurants near you and to recognise the restaurant you are at when you rate a dish. The app does not use your location in the background. The coordinates are sent to our servers with those searches and are not stored on your account. When you search for a place to rate or add a new one, they also go to Komoot, so results can be ranked by distance and a new place filed under the right city (section 7). If you say no, the app uses an approximate location from your IP address, or a city you choose.
• Camera and photo library. Used only when you add a photo: to a rating, to a dish without rating it, or as your profile picture. Only the photo you take or pick is uploaded, re-encoded on your phone first so that its location and camera details stay behind (section 2). Your profile picture is visible to other people (section 6).

Signing in. Your sign-in tokens are kept in your phone’s secure storage — the iOS Keychain or the Android Keystore — and signing out removes them. On iPhone you can also sign in with Apple (section 1). The app keeps a list of your last few searches on your phone too; the list itself never leaves it.

No advertising and no tracking. The app contains no advertising or analytics software, does not use your phone’s advertising identifier, and does not track you across other companies’ apps or websites.

Updates. Updates to the app’s own code are delivered by Expo, the platform the app is built on (section 7).

To operate your account and authenticate you; to publish your contributions and compute dish ratings; to show you relevant dishes and restaurants near you, and to recognise the restaurant you are at when you rate; to check that someone claiming a restaurant can speak for it; to send you the emails we send — address verification, password reset, an invitation if we invite you, the codes and notices that come with claiming and managing a restaurant, and a notice whenever two-factor sign-in on your account is turned on, turned off or reset; to review reports and prevent spam, manipulation of ratings, and abuse; to moderate content; and to fix problems and improve the service.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

By default your profile and your ratings are public. A public profile shows your username, profile picture, bio, city and state, your counts (dishes rated, restaurants, helpful votes) and your follower and following lists. Your ratings appear on dish pages with your username attached.

Your display name and email address are never shown on your public profile. Your dietary preferences, spice tolerance and lists are private.

You can turn both off in Settings. Making your profile private reduces it to your username and picture. Making your ratings private hides them from everyone but you — they still count toward each dish's average, without being attributed to you publicly.

If you help manage a restaurant, what you do for it appears under the restaurant’s name, never yours. A reply to a rating is shown as “Response from” the restaurant, and the “Claimed” mark on a restaurant’s page names no one. You are named in one place only: the restaurant’s own dashboard, where the people on its team see each other’s names, roles and standing (in a review period, verified or suspended), and when each of them joined. If you ask to join a team, its people see your name and how you said you are connected to the restaurant. The name shown is the one on your account, or your username if you have not given one. Emails and notifications about a claim or a team name the restaurant, not the people.

The people managing a restaurant see the same ratings everyone else can: a rating you have made private is not shown to them.

We use these providers to run Tastbudz. Each receives only what it needs:

• Amazon Web Services — hosting, our database, and storage for uploaded images and for the documents sent with a restaurant claim (in the United States).
• Resend — sends our emails: address verification, password reset, invitations, the codes and notices for claiming and managing a restaurant, and two-factor sign-in notices. Receives the recipient’s email address and name; a claim code goes to the work address you gave us, with no name attached.
• Google — if you use “Sign in with Google”, on the website or in the app, Google authenticates you and we exchange your identity token with them. The Google sign-in button and our map view load code from Google, so Google can see your IP address and which page you are on when they appear; where the app shows a map, Google Maps draws it, so Google receives your phone’s IP address and the area shown. Google also distributes the Android app through Google Play.
• Apple — distributes the iPhone app through the App Store, and, if you use Sign in with Apple, authenticates you and tells us what section 1 describes. If you chose Hide My Email, our emails to you pass through Apple’s relay. When you delete an account that uses Sign in with Apple, we tell Apple to disconnect your Apple ID from Tastbudz.
• Expo — delivers updates to the app’s code. When the app checks for an update, Expo receives your phone’s IP address, a random identifier for that installation of the app, and technical details such as the app version and operating system. It receives nothing about your account or what you do in the app.
• Cloudflare — provides the anti-bot check on the sign-up and forgot-password forms, and when you start a restaurant claim or ask for a claim code. Cloudflare receives your IP address for that check.
• Komoot (Photon) — powers restaurant address lookup when you add or edit a restaurant, and postal-code suggestion. When you type into those fields, your search text is sent to Komoot, along with your approximate coordinates when you have shared them, so results can be ranked by distance. In the app, searching for a place to rate does the same, and adding a place sends your location to Komoot to find the city it is in. City and place search (the location picker in the navigation bar and your profile) is served entirely from our own database — nothing you type there is sent to a third party.

We share information with these providers only so that they can do the work described, and only with providers whose own privacy commitments protect it at least as well as this policy does.

We may also disclose information if we are legally required to, or where necessary to investigate abuse or protect the rights and safety of our users. If Tastbudz is acquired or merges with another company, information may transfer as part of that transaction; we will give notice before your information becomes subject to a different policy.

We use no advertising or analytics cookies, and nothing we store is readable by another website. What we do store in your browser:

• Sign-in tokens — kept in your browser's local storage so you stay signed in. Cleared when you sign out.
• Your chosen city — a cookie lasting one year, so the site opens where you left it.
• An in-progress contribution — kept locally so a half-finished rating survives a page reload.
• A visit counter — a cookie set the first time you arrive on a given day and expiring at midnight, holding one fixed character that is identical for every visitor. It lets us count how many browsers arrived without recording anything about who they belong to. It is not an identifier and nothing about it is stored on our servers.
• A return-visit identifier — a cookie holding a random value, lasting up to 12 months and renewed on each visit, so we can tell that a browser has come back on a later day. See “How we count visitors” in section 3 for exactly what it does and does not let us know. Clearing your cookies resets it.

Google and Cloudflare may set their own cookies within the sign-in and anti-bot widgets, governed by their own policies.

The app keeps only what section 4 describes — your sign-in tokens and your recent searches — plus a cache of the pictures it has already shown you, so they load faster.

Account information and your contributions are kept while your account is open. Abuse- prevention records are deleted after 30 days. Expired sign-in tokens are cleared automatically.

Ratings, superseded rating versions, photos, account-tied activity signals and moderation records do not currently expire on a schedule. If you want something removed, ask us — see below.

The session-activity records described in section 3 are deleted after 13 months. They carry no account and no visitor identifier, so there is nothing in them to connect to you once the day's grouping key has rotated.

The return-visit identifier and the daily activity it records for anonymous browsers are deleted after 13 months of inactivity; signed-in account activity signals are retained as described above.

Restaurant claims. The documents sent with a claim, and the work email address a code was sent to, are deleted 90 days after the claim is closed (approved, declined, withdrawn or expired), or straight away if you delete your account. Of the address, we keep only a masked form, such as d•••@yourrestaurant.com. The documents are not part of our database backups, and our storage deletes every document 180 days after it was uploaded, even if its claim is still open. The rest of a claim (which restaurant, how you said you are connected to it, the declaration you accepted, how you verified and what was decided) is kept, and so is the record of which restaurants you have helped manage and when, so that what was done on a restaurant’s behalf stays traceable.

Two-factor sign-in. The secret and your recovery codes are deleted when you turn two-factor sign-in off or delete your account.

Backups. Our database is backed up every day, and each backup is kept for up to 12 months. Backups cannot be edited, so something deleted from Tastbudz remains in the backups made before it was deleted until they expire. We use them only to recover from a failure. Photos that are deleted or replaced are erased from our storage after 30 days.

You can edit your profile, change your privacy settings, adjust your food preferences, change your password and turn two-factor sign-in on or off in Settings. You can delete a photo you added to a rating or to a dish, replace your profile picture, and delete lists you created. You can withdraw a restaurant claim at any time, and leave a restaurant’s team from its dashboard. You can withdraw the app’s access to your location, camera or photos at any time in your phone’s settings.

Deleting your account. You can delete your account yourself, in Settings on the website or from the Profile tab in the app. An account that uses Sign in with Apple is deleted from the iPhone app, because we must disconnect your Apple ID at the same time and only the app can ask Apple to do that. Our support page lists the steps, what is removed and what is kept: how to delete your account.

Access, correction and a copy of your data are available on request. Self-service data export is not built yet — until it is, write to privacy@tastbudz.com and we will action it. You can ask us to delete your account the same way if you cannot do it yourself.

When we delete an account we remove or anonymise the information that identifies you. Ratings you left may be retained in an anonymised form, without your name attached, because dish averages other people rely on are built from them.

Deleting your account also deletes your two-factor secret and recovery codes, and ends your access to any restaurant you help manage. Your open claims, and anything you filed for a restaurant that is still waiting for review, are withdrawn, and your claim documents and the work addresses your codes went to are deleted. Changes and replies already published stay, as the restaurant’s, and the record of which restaurants your account managed is kept, anonymised like the rest of your account.

If you live in California, you have the right to know what personal information we collect and how we use it, to request deletion or correction, and not to be discriminated against for exercising those rights. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front. Use the address above to make a request; we will verify it against the email on your account.

Traffic is encrypted in transit. Passwords are stored only as hashes. You can turn on two-factor sign-in, so that signing in also needs a code from your authenticator app, and we email you whenever it is turned on, turned off or reset. In the app, sign-in tokens are kept in your phone’s secure storage. Sign-in sessions can be revoked, and changing your password signs out your other devices. Access to production data is limited to those who need it.

No service can promise perfect security. If you believe your account has been accessed by someone else, change your password and write to us.

Tastbudz is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child under 13 has given us personal information, write to privacy@tastbudz.com and we will delete it.

Tastbudz is operated from the United States and your information is stored and processed there. If you use it from elsewhere, you understand your information is transferred to the United States, where privacy laws may differ from those where you live.

Tastbudz is intended for people in the United States. Our restaurant and menu coverage is United States only, the app is offered only in the United States App Store and Google Play, we do not market or offer the service to people outside it, and we do not monitor or profile the behaviour of visitors from other countries — as noted above, we run no third-party analytics, advertising or tracking of any kind, and our own record-keeping, including the return-visit identifier described in section 3, is limited to browser-level counts and dates and is never assembled into a picture of an individual or their browsing history. We do not block anyone from reading the site, but it is not aimed at you if you are elsewhere.

We may update this policy. If a change materially affects how we handle your information, we will give notice by email or in the product before it takes effect. The date at the top of this page shows the last substantive revision.

Questions, requests, or anything that looks wrong — privacy@tastbudz.com. For help with your account, see our Support page or write to support@tastbudz.com. We also welcome corrections to this page itself.

Tastbudz LLC