Privacy Policy

Last updated

1. Summary

This summary is provided for convenience and does not form part of this policy. EatWhat may be used without an account. Photographs taken in the application remain on your device unless cloud backup is enabled. Personal data is processed in order to suggest restaurants and to maintain your food diary. Personal data is not sold, rented or used for advertising.

2. Personal data we collect

We collect the following categories of personal data, and no others:

  • Account identifiers — whichever sign-in method you choose. For Sign in with Apple, Apple shares a stable identifier for you, an email address (which, if you choose to hide your address, is a private relay address that forwards to your own) and, on the first sign-in only, the name you give Apple. For Google sign-in, Google shares a stable identifier for you, your email address, your name and the address of your profile picture. No password is used.
  • Food diary entries — dish names, restaurant, price, payment method, three ratings, notes and reviews, district and nearest MTR station, and the time of the meal.
  • Photographs and receipt images — held on your device by default; see clause 4.
  • Location data — a foreground position fix obtained with your permission, or a district you select yourself.
  • Bill-splitting data — the participant names you save for reuse and your usual service charge. These are stored on your device and the division of a bill is calculated there. The names and amounts shown on screen are not masked, so they may appear in screen recordings as described in clause 6.
  • Submitted social-media content — where you send a post to us by direct message, the message identifier, your Instagram account identifier, the post address and any text you include.
  • Waitlist data — the email address and language preference submitted on this website. No IP address and no browser information is recorded with it.
  • Subscription data — where you subscribe to EatWhat Pro, the store's record of the subscription: the product, purchase and expiry dates, whether a trial applies, and an identifier for you, which is a random identifier or, where you are signed in, your account identifier. This record is processed by RevenueCat on our behalf. Where you are signed in, we also keep on our server a copy of the subscription's status, linked to your account, so that we can confirm whether EatWhat Pro is active: the entitlement, the product, the expiry date, the store, the type of period (such as a trial) and whether the purchase was made in the store's test environment. Payment card details are handled by the store and are never received by us.
  • Usage data — as described in clause 6.

3. Purposes of use

Personal data is used to rank restaurants by reference to your location, the time of day and your previous entries; to maintain your diary, spending totals and insights; to calculate bill splits; to identify restaurants in content you submit; to measure use of features, by means of usage events and screen recordings as described in clause 6; and to apply usage limits and prevent abuse.

4. Photographs and receipt images

Each photograph is re-encoded as a JPEG, which removes EXIF metadata including GPS coordinates and device model, and is stored in the application's documents directory rather than in a system cache. Cloud backup is a paid feature. Where it is enabled, the copy held on your device is not deleted: the cloud copy is a backup and not a substitute. Backups are held in a private storage bucket under a path bound to your account identifier, and local file paths are never transmitted.

5. Location data

Location is requested only while the application is in the foreground; background location is not collected. When you request a suggestion, your position, or the centre of the district you selected, is transmitted with that request in order to identify nearby restaurants, and it is not recorded in any database table. Where local data is insufficient and a Google Places search is performed, Google receives a search coordinate and radius and no identifier relating to you. Diary entries record district and MTR station only, and never coordinates. Weather data is requested by your device directly from the Hong Kong Observatory, which accordingly receives your device IP address.

6. Usage data and analytics

We use PostHog to measure use of the application and of this website. Events carry counts, flags and enumerated values — whether an entry has a note, not its text; whether a position was obtained, not the position — and coordinates are excluded from analytics, which is verified automatically on every change to the source. The application also records its own screen while in use, so that faults can be found: a recording shows your touches and what the application displays, including entries and photographs once you have saved them. Your email address, receipt images and the live camera view are masked, and no console or network content is captured. Usage events and recordings are not removed by deletion of your account. This website is not recorded. The website sets one first-party PostHog cookie containing an anonymous identifier. The website also counts page views through Vercel Web Analytics, which sets no cookie and stores no identifier, and removes the claim token from any claim link before the count is sent. No consent banner is presented, and the website functions if that cookie or either analytics request is blocked.

7. Automated processing of submitted content

Where you submit a social-media post to us by direct message, we retrieve the post on our server. Where the post contains a video, we download that video temporarily, reduce its resolution, and transmit the video in full, including its audio track, for up to three minutes of its duration; where the post contains still images, we transmit one image for each. In either case the media is transmitted together with the public description of the post, and any text you send with it, to the model google/gemini-3.7-flash through the Vercel AI Gateway, which routes the request to Google, for the purpose of identifying restaurant, address and dish names. No account data is transmitted with the request. The downloaded video, the reduced copy and any sampled image are deleted as part of the same operation and cannot be retained. We retain the address of the post, its public description, the restaurants, addresses and dishes identified, and the token counts. The model provider carries out processing that we do not control; content you would not wish a third party to process should not be submitted. We do not read the comments on a post. No cloud model is used for receipt recognition. Receipt images are held in the same manner as photographs and are included in cloud backup where it is enabled, as described in clause 4.

8. Service providers and transfer outside Hong Kong

Personal data is held principally by Supabase and is handled in accordance with the Personal Data (Privacy) Ordinance (Cap. 486). Each provider below is engaged to perform part of the service and may process personal data only for that purpose. All are located outside Hong Kong, and personal data may accordingly be stored or processed outside Hong Kong. The providers engaged are:

  • Supabase
  • Apple (Sign in with Apple)
  • Google (Google sign-in)
  • Vercel
  • PostHog
  • Resend
  • Instagram (Meta)
  • Zernio
  • OpenRouter
  • Google (Gemini)
  • Google Places
  • Hong Kong Observatory
  • Expo
  • RevenueCat
  • Apple App Store
  • Google Play

9. Retention

Retention differs by category:

  • Diary entries — until deleted by you, or until your account is deleted.
  • Retrieved media and sampled frames — deleted on completion of the processing described in clause 7, without exception.
  • Google Places content — thirty days, after which it is withheld at the point of reading.
  • Waitlist data — until you ask us to remove it, by reply to the confirmation message or in writing to privacy@eatwhat.land.
  • Restaurant records derived from submitted content — retained, as they form part of the restaurant database and cease to relate to you.
  • Subscription data — held by RevenueCat and the store as their record of the transaction, which they keep under their own retention rules. The copy of the subscription status held on our server is kept while the account exists and is deleted with the account.
  • Sign in with Apple authorisation — where you sign in with Apple, a token issued by Apple is held on our server for the sole purpose of revoking the application's authorisation when your account is deleted. An account that uses Sign in with Apple is not deleted until Apple confirms that the authorisation has been revoked or no longer exists. Where no token is held for the application, you are asked to confirm with Apple once more so that one can be obtained, and the account is not deleted if you decline. The token is deleted with the account.

10. Security

Access to each table is restricted by row-level security, so that a user may read only their own records; the photograph bucket is private and access is bound to the account identifier; session credentials are held in the operating system keychain or keystore and not in the application database; and all transmission is over HTTPS. No system can be guaranteed secure and no such guarantee is given. In the event of a breach affecting personal data we will act in accordance with the Ordinance and notify affected users where appropriate.

11. Your rights, and how to contact us

You are entitled to request access to, correction of, and erasure of your personal data. Account deletion is available in the application under Me, and removes cloud photographs and the records held on the device as well; step-by-step instructions, and a list of what deletion does and does not cover, are published at eatwhat.land/delete-account. A request for a copy of your data, or for access to or correction of it, should be sent to privacy@eatwhat.land, as may any other question concerning privacy. A complaint may be made to the Office of the Privacy Commissioner for Personal Data.

← Back to home