Privacy Policy

Last updated: November 4, 2026

WhatTheFood is a restaurant discovery app. This policy explains what we collect and how we use it. By using the app you agree to this policy.

What we collect

  • Account info — your email and name via Firebase Authentication (email/password, Google, or Apple sign-in), plus an optional profile photo you choose in the App.
  • Your activity — restaurants you save, mark Want to go or Been, posts you create or like, people you follow, places you view, which restaurant cards you see and for how long, and your taste preferences, so we can run social features, recommend places, and understand how the product is used.
  • Messages — message text, restaurant shares, plan-interest reactions, delivery order, Story read state, and Activity-folder read state that you choose to send in WhatTheFood. We use this data only to deliver and display conversations, message requests, and social activity to the relevant accounts, and to apply safety checks.
  • Coarse app activity — authenticated app entry, entry to Discover, Map, the friends feed, Profile, Search, or Messages, and fixed visit-alert milestones such as enabling alerts or opening a reminder. These records do not include search text, conversation IDs, message content, restaurant IDs, location, notification endpoints, device IDs, session IDs, rating or Post content, and are assigned a 30-day expiration.
  • Location — only if you grant permission, to show nearby restaurants and distances. When you sort by distance, the App sends your current location with that request. We use it to calculate distance and don’t keep a location history.
  • Nearby partner alerts — if you separately turn this on, the visible App can read your device location and compare it on your device with eligible partner restaurants. Raw coordinates and a continuous route are not sent to our server. When the App detects a nearby eligible restaurant, it may send that restaurant’s ID, a coarse proximity band, and server timestamps so we can show the offer and schedule a follow-up. Proximity alone is not treated as proof that you visited; you decide whether to confirm.
  • Notifications — if you allow them, we store the browser push endpoint and encryption keys needed to deliver App notifications. Restaurant notifications may show a restaurant name and offer or review prompt on your lock screen. Follower and dining-plan join alerts require a separate in-App confirmation for that browser subscription; their lock-screen text is generic and does not identify the other person or restaurant.
  • Review photos — photos are uploaded only when you choose one and submit a review. If you publish a Post, its photo, verdict, and caption are shared under the same social visibility rules as your other Posts.
  • Basic technical data — standard logs your browser or device sends (such as device type) for reliability. In the App, the Google Maps, Firebase, and Google sign-in services we use may also collect device identifiers and diagnostic data.

How we use it

To run the app: sign you in, generate recommendations, power the map and social features, troubleshoot account-specific issues, and improve the product. We do not sell your data or use it for third-party advertising.

Visit prompts and offers

Nearby partner alerts run only after you turn them on and only while the web App is open and visible. We use the partner restaurant match to check for a currently published offer. We do not claim that you visited until you explicitly confirm it.

If you confirm arrival, we may create a short-lived visit follow-up and send or show a review prompt later. Tapping that prompt opens the relevant restaurant review flow. Visit follow-ups expire after 48 hours; delivery jobs are assigned a seven-day expiration. A selected review photo is kept private while pending and becomes eligible for deletion after 24 hours if it is not attached to a published Post. Push delivery details remain until you turn alerts off, the browser expires them, or delivery reports that the subscription is no longer valid.

Social notifications

We do not add follower or dining-plan join alerts to an older restaurant-alert subscription without asking. If you choose to add social alerts, that choice is recorded for the current browser subscription; another device must make its own choice.

A new follow or plan join creates a short-lived delivery job. Before delivery, we confirm that the follow still exists or that the person is still a member of the open plan. The event is no longer eligible after 24 hours, delivery records are assigned a seven-day expiration, and repeated leave/rejoin or unfollow/refollow actions are rate-limited. The notification payload does not contain the other person’s account ID.

Messages and requests

Direct messages and restaurant shares are available only to the two accounts in that conversation. A message from someone you are not mutually connected with is separated into Message Requests, where you can accept or decline it before continuing the conversation.

Restaurant cards are refreshed from our restaurant catalog when they are viewed. Distance is calculated on your device when location is available and is not stored in the message. A plan heart is a conversation reaction and does not silently change your separate Saved or Want to go choices.

The Activity folder can show when another account followed you or liked one of your Posts. We store the current follow or Like state and a recipient-facing event record so the interaction is not silently removed from their activity history if it is later undone. Deleted Post content is not returned in that activity view, and read cursors are private to the receiving account.

Mochi is WhatTheFood’s official account. It may be added as a default contact and pinned in Messages; it is clearly labeled and is not presented as a person.

Merchant applications

If you apply through WhatTheFood for Business, we collect the business and restaurant name, business type and address, website, authorized-representative confirmation, and the representative’s name, email, and optional phone number. We use this information only to save your draft, review the application, contact you about it, and administer an approved merchant account.

Contact details and application-review data are not shown to consumer App users or other merchants. A submitted application does not publish a restaurant, image, offer, coupon, or reply. We retain application records while they are needed for review, account administration, fraud prevention, or legal obligations. You may request correction or deletion through the contact below, subject to records we must retain.

Who we share it with

With Public social visibility, other signed-in users may find and view your profile and explicit restaurant activity such as Saved, Want to go, Been, and posts. A Private profile shares its full profile and restaurant activity only with people you follow back.

When you create or join a dining plan, people with its unguessable share link can see the restaurant, host, participant count, and whether the plan is open, completed, cancelled, or expired. Active or completed plan participants can also see the current participant names and profile photos; anonymous visitors and non-participants cannot. We keep terminal plan records so hosts and participants can revisit their own plan history. Leaving a plan does not change your separate Saved or Want to go choices.

We keep a private follower-notification cursor so the App can show how many new followers you have across your devices. That cursor is never included in another user’s profile response.

We also use service providers that run the app on our behalf: Google Firebase / Google Cloud (authentication, database, file storage, hosting) and Google Maps / Places (map and restaurant data). Any service provider we share your data with must provide the same or equal protection of user data as stated in this policy. We do not sell your data or share it for third-party advertising, except when required by law.

Storage & security

Your account data is stored in Google Cloud / Firestore, and a profile photo you choose is stored in Google Cloud Storage. We take reasonable measures to protect it, but no online service can be 100% secure.

Profile photos use versioned, unguessable image links so they can appear in profile and dining-plan views where basic identity is allowed. Anyone who receives or copies one of those links may load that image until the link is retired after you replace the photo.

We keep your account data until you delete your account. Records with a shorter life are kept only for the periods stated above. Logs and backups kept for security and reliability may hold some data for a limited time after that.

Your choices

  • You can edit your profile and taste preferences anytime in the app.
  • You can switch between Public and Private social visibility in Friends or Settings.
  • You can revoke location permission in your browser/device settings.
  • You can turn off Nearby partner alerts and push notifications in Settings, and you can also revoke notification permission in your browser/device settings.
  • You can decline the social-alert upgrade and keep an existing restaurant-reminder subscription unchanged.
  • You can accept or decline a message request. Declining prevents that request from becoming an active conversation.
  • You can ignore or dismiss an arrival or review prompt without publishing a Post.
  • You can delete your account in the iOS app: Settings → Delete account. It happens right away. Your profile, posts, comments, photos, saves and follows are removed, and upcoming plans you host are cancelled. Messages you sent stay in other people’s chats, shown as “Deleted account”. Safety reports are kept without your identity. You can also email us (see below).

Contact

Questions or a deletion request? Email elksjake@gmail.com.

This policy may change as the product evolves.