Privacy policy

1. What you send us

We only receive what you choose to send through the Site's forms:

• Add a spot: the restaurant you pick, the meal, its price and the other details the form asks for, your evidence (a photo or a link) and any note. You can also add a name or nickname, which only our reviewers see, and an email address, which we use only if a reviewer needs a detail from you.
• Suggest an edit, and our price questions: the restaurant, what changed and what you wrote, or your answer. After a trip or at a place you saved: the dish you got, then Same or Different ("Something else" sends nothing). On a place's page, "Was it $X?": Same or Different. For Same we also keep the dish and price you answered about.
• A menu price: the restaurant, the item, its price, a link or text showing it, a note, and an email address if you add one.
• Feedback: your note, the page you sent it from, and an email address if you add one.

These are stored in our database so we can review them and keep the map correct. An edit or a menu price also records where it was sent from: the part of the Site you used, or the campaign tag of the link you arrived from, if it had one.

2. What is collected when you send something

• A hashed IP address. When you send a form, our server turns your IP address into a one-way hash and stores only the hash, with your submission and in rate-limit counters, to stop spam and abuse. We also use this scrambled address to tell two networks apart, so two answers from the same network never count as two diners.
• A private receipt. After you add a spot or suggest an edit, your browser gets a private code to follow its review (for a spot, a private status page). We store only a hash of the code; the code itself stays on your device. Analytics never record the status pages.
• A device token. When you answer Yes or Same, your browser sends a random token it created, and our server stores only a hash of it, so one device counts once a day for a place, and the same answer about the same dish and price counts only once in 30 days.
• When two diners agree. If diners on two different devices and two different networks both say a dish is still the same price, we mark that one dish "Confirmed by a diner" with the date. We store the restaurant, the dish, its price, the date and which answers agreed. We do not store who you are, and the mark never shows your device or network. If many answers come from one device or network in a short time, they are kept but never count toward a mark.

3. Photos

A photo you send is re-encoded on our server before it is stored, which removes its metadata, including any GPS location and camera details. A photo may appear on the restaurant's page, credited as "Photo from a visitor".

4. Your location

If you ask the Site to find food near you, your browser asks for permission first. Your location is used inside your browser to show and sort nearby places, and it is never sent to our servers.

5. What is kept on your device

This browser stores these items. Clear this site's data to delete the local copies.

• a random device token (see section 2);
• the date of your first visit, and whether a first or return visit was counted;
• the private receipts for spots and edits you sent (up to 10 of each), with the restaurant's name and, for a spot, the dish, so you can check on them, and which of their results you have already seen;
• Directions: places, dishes and prices shown at the tap.
• Answered questions, so you are not asked twice.
• Your dish confirmation marks, shown at once, for 30 days.
• Saved places and save dates. From your last visit: lowest price and dish, checked date, deals and places a short walk away. Your last visit date. These records stay on this device and are never sent. They show what changed at your saved places.
• whether you closed or accepted the "add to home screen" prompt;
• for the current visit only: whether you closed the intro, which map areas were already counted, and the campaign tag of the link you arrived from, if any.

6. Analytics and error reports

• Vercel Web Analytics counts page views and the anonymous actions below, without cookies.
• Google Analytics counts the same page views and actions. It may set its own analytics cookies. Google's advertising features are turned off.
• The actions we count include searches (the first 40 characters of the search), filter changes, taps on Directions or a restaurant's website, the name of the neighborhood or city shown on the map, and first and return visits. They never include restaurant ids, coordinates, email addresses or private status links.
• Sentry receives a report when something on the Site breaks: the error, where in our code it happened, and the page address without its query part. It is set up not to collect account details, cookies, request contents or form contents.

7. Service providers

These companies process data for us only to run the Site: Vercel (hosting and Web Analytics), Supabase (our database and photo storage), Google (the restaurant search in our forms, which sends what you type to Google Places, and Google Analytics), Sentry (error reports) and OpenFreeMap (the map images your browser loads). We share information with others only when the law requires it. We do not sell or rent personal information.

8. Your choices

Browse without contributing. Location is optional. To ask what we hold or request deletion, email hello@affordabite.app. Include your status link, or the restaurant and date sent. We keep submitted answers until you request deletion. Price answers carry no name, so if we cannot tell which answer is yours, we delete every answer from that day for that dish.

9. Children

The Site is not for children under 13, and we do not knowingly collect their information.

10. Changes

When this policy changes, we update the date at the top of this page.

11. Contact us

Questions about this policy or your information: hello@affordabite.app