Privacy Policy

TastyPals Labs Ltd (“TastyPals,” “we,” or “us”) operates the TastyPals website and mobile apps. This policy describes what we collect, why, who receives it, how long we keep it, and your choices.

1. Account and profile information

When you create an account, we collect an account identifier, email address, authentication provider, username, and any display name, avatar, city, or bio you add. We use these details to authenticate you, provide your profile, sync the app and website, secure the service, and contact you about your account. Supabase provides authentication, database, and file storage. Google or Apple processes information when you choose its sign-in service.

2. Your content and Taste ID

We process ratings, reviews, photos and videos, posts, comments, reactions, follows, saves, lists, restaurant feedback, and support messages you submit. We also use restaurant choices, ratings, saves, preference signals, and generated taste profiles to provide recommendations and your Taste ID. New profiles, reviews, posts, lists, and visit photos are private unless you affirmatively make them public. Content already public remains public until you change or delete it. Public content can be seen and copied by anyone. Moderation systems and authorized staff may review submitted public content for safety.

3. Location: nearby search and Visit Reminders

Nearby search: when you ask for nearby restaurants, the app uses foreground location. Coordinates may be sent transiently to Supabase to return nearby candidates, but are not stored as part of your account. Android uses foreground location only.

Visit Reminders on iOS: this optional feature is off by default and requires a separate explanation and your permission for background location. Precise coordinates used to recognize a likely visit are processed on your device. If a visit is detected, we store the restaurant, entry and exit time, reminder time, duration, confidence, and detection source with your account. That derived record can reveal where you were and when. We use it only to provide and troubleshoot Visit Reminders—not for advertising. You can disable the feature and delete its history from your profile controls. Android does not request background location.

4. Device, usage, and website storage

Our hosting and security providers process IP address, request time, browser or device type, referring page, errors, and similar logs needed to deliver and protect the service. Essential cookies and local storage maintain sign-in, security, Taste ID drafts, preferred city, and your privacy choices.

If you enable notifications, we store an account-linked device push token and preferences and use Apple and supporting infrastructure to deliver requested notices. We also process limited app events, errors, and diagnostic identifiers to operate and troubleshoot the service. This repository contains no verified mobile crash-reporting SDK; native diagnostics must be disclosed if the shipped app enables one.

Optional analytics—Google Analytics, Vercel Analytics, and Vercel Speed Insights—loads only after you allow Analytics. Optional Google AdSense loads only after you allow Advertising and only where regionally available. Ads are configured as contextual/non-personalized; ad personalization storage remains denied. Rejecting or withdrawing consent stops future optional measurement or ad requests from TastyPals. The footer's Cookie Preferences control is always available.

5. Global Privacy Control, sale, sharing, and mobile advertising

We honor a browser Global Privacy Control signal by keeping website advertising off. Because there is no consistently accepted response to the older Do Not Track signal, we do not respond to it separately; optional website analytics and advertising remain off until you choose them.

TastyPals does not sell personal information for money. The mobile apps contain advertising SDKs. As disclosed in the applicable app-store privacy label, mobile advertising partners may process coarse location, device or advertising identifiers, advertising data, and product-interaction or other usage data for third-party advertising, ad measurement, and tracking across other companies' apps or websites. On iOS, you can deny or withdraw the system tracking permission and use device privacy controls. Website consent and Global Privacy Control apply to the website and do not change mobile SDK settings.

We do not use precise coordinates processed on-device for Visit Reminders or the derived restaurant-visit records described above for advertising. Mobile advertising disclosures and controls remain governed by the shipped app, its system permissions, and its current app-store privacy label.

6. When information is disclosed

We disclose only what is needed to service providers acting for us: Supabase (authentication, database, storage, and functions), Vercel (hosting and optional analytics/performance), Google (optional analytics, contextual advertising, sign-in, and restaurant/place data), Apple (sign-in, App Store distribution, and push delivery), and push-notification infrastructure. Providers may process information outside your province or country, including in the United States, where foreign authorities may lawfully access it. We may also disclose information when required by law, to protect users and the service, during a corporate transaction subject to appropriate safeguards, or at your direction. External restaurant, menu, map, video, and app-store links have their own practices.

7. Marketing

Marketing email is off unless you opt in. Each marketing message identifies us and provides an unsubscribe method. We process opt-outs promptly and no later than the period required by law. Service, safety, and transaction messages are not marketing.

8. Retention

• Account, profile, Taste ID, and private content: while the account is active, then deleted or anonymized after account deletion, subject to legal holds.
• Approved public reviews: retained without your account identity after account deletion unless removal of the content is required or requested because it contains personal information.
• Visit Reminder records: 90 days, with daily automated cleanup, or earlier when you delete them.
• Cookie consent record: up to one year in your browser, or until you clear or replace it.
• Operational/security logs: the shortest period needed for security, debugging, and provider operations, then deleted or aggregated under our provider settings.
• Support, legal, deletion, and incident records: for the time needed to resolve the matter and meet legal, audit, or limitation obligations.

When a retention purpose ends, we securely delete or anonymize the information.

9. Your rights and controls

Your profile provides controls to correct your username, display name, and city; make your profile private; hide your public-review byline; opt out of marketing; download a structured JSON copy; delete Visit Reminder history; and permanently delete your account. Account deletion removes account-linked data and de-identifies retained approved public reviews. You may also ask us for access, correction, deletion, consent withdrawal, or data portability, or challenge our compliance. We normally respond to a verified access request within 30 days, subject to lawful extensions and exceptions.

10. Security and incidents

We use access controls, row-level database security, restricted service credentials, encryption in transit, moderation boundaries, logging, and documented incident procedures designed to protect personal information. No system is perfectly secure. We assess incidents, notify regulators and affected people when legally required, and retain required breach records.

11. Age

You must be at least 14 to create an account or submit personal information. We ask for an age attestation and do not collect a full date of birth. If we learn that an underage person created an account, we will delete the account and associated personal information as appropriate. Contact us if you believe this occurred.

12. Changes

We will post updates here and change the date above. We will provide a prominent in-product or direct notice before a material change takes effect when required, and seek new consent if a new purpose requires it.

13. Privacy Officer and complaints

The person responsible for privacy compliance is Privacy Officer, TastyPals Labs Ltd. Email hello@tastypals.com. We will investigate complaints and explain our response. You may also complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or another competent regulator.