Privacy Policy

This Privacy Policy explains how TasteRex LLC (“TasteRex”, “we”, “us”) handles personal information when you use the TasteRex mobile app, the websites at tasterex.com and business.tasterex.com, and related services (together, the “Service”). It applies to diners using the app and to restaurant owners and staff using the restaurant portal.

If you don’t agree with this policy, please don’t use the Service. Our Terms of Service also apply.

The short version

• What we collect: your account details, the ratings, reviews and photos you post, your location when you allow it, and a few optional things you choose to share (dietary needs, contacts to find friends, lists you import).
• What we don’t do: we don’t sell your personal information, we don’t share it for cross-context behavioural advertising, and the app contains no third-party advertising or tracking SDKs.
• What’s public: your username, profile photo, and any rating you set to “Anyone”. You choose the visibility of each rating.
• Location: used to show what’s near you and to confirm you ate where you say you did. We store the restaurant and the distance, not a trail of where you’ve been.
• Your controls: change rating visibility, turn off location or contacts, download your data (CSV and JSON), or delete your account from Settings.

Information you give us

Account information. When you sign up with Apple, Google or email we receive your email address and, if you choose, your name. If you use Sign in with Apple’s “Hide My Email”, we receive a relay address instead. We do not offer phone-number sign-in.

Profile information. Username, display name, profile photo, home city and a short bio, if you add them.

Phone number (optional). You can add a U.S. phone number in Settings so friends who have it in their contacts can find you. We don’t verify it, don’t send texts to it, and don’t show it to anyone.

Date of birth. We ask for your date of birth when you sign up. We use it only to check that you are old enough to use TasteRex (13 or older) and to hide alcohol-related content from anyone under 21. It is never shown on your profile.

Ratings, rankings and reviews. The dishes you rate, your scores, where each one sits in your ranked lists, any review text, the restaurant location, and the visibility you choose (Private, Followers or Anyone). Each visit to a dish is recorded separately so repeat visits can be averaged.

Photos. Photos you add to a rating. See Photos and photo metadata for how we handle the location and time stored inside them.

Dietary needs (optional). Dietary preferences and allergies you add, such as gluten-free, vegan or a nut allergy, and whether you want your ratings weighted for people with the same needs. Because some of these relate to your health, we treat them as sensitive. See Consumer health data.

Social activity. People you follow, groups you create or join, people you block or mute, your Want to Try list, and invitations you send.

Imported lists (optional). If you import a Google Maps list, a file exported from another app, or a list emailed to import@tasterex.com, we read the places in it to find matching restaurants. We keep the restaurants we matched, not the original file.

Reports, appeals, feedback and support messages. What you tell us when you report content, appeal a moderation decision, send feedback or contact support, including any screenshot you attach.

Restaurant owners and staff. If you use the restaurant portal, see Restaurant portal users.

Information we collect automatically

Location (only with your permission). If you allow location access, the app uses your device’s location to:

• show restaurants and dishes near you;
• confirm a “verified dine” by checking you are within about 200 metres of the restaurant when you rate; and
• set your city for local rankings and leaderboards.

We store the result of the check (verified or not, and your distance from the restaurant), the restaurant, and the region it is in. We do not store your coordinates with your ratings or keep a history of your movements. You can turn location off at any time in your phone’s settings; the app still works and you can choose a city by hand.

Device and usage information. Basic technical information needed to run the Service securely: device type, operating system and app version, IP address, and server logs of requests (for example sign-in attempts and errors). We use these for security, abuse prevention and fixing bugs.

Websites. Our websites do not use advertising or analytics cookies. Our hosting provider (Cloudflare) processes IP addresses and request logs to deliver the site and protect it from attacks. The restaurant portal stores a sign-in token in your browser so you stay signed in.

Photos and photo metadata

Photos taken with a phone often contain hidden metadata (EXIF), including where and when the photo was taken. When you add a photo to a rating, the app may read the time and location from the original photo on your device to check whether it was taken recently at the restaurant (a “photo-verified dine”). We keep the photo’s timestamp with your rating for that check.

The copies of your photo that we store and show to others are re-encoded and do not contain the original location metadata.

Contacts (optional)

If you choose to find friends from your contacts, the app converts each phone number and email address in your address book into a one-way hash (a scrambled code) on your device and sends only those hashes to us. We use them to tell you which of your contacts are already on TasteRex and to credit you when someone you invited joins. We never upload or store your contacts’ names, raw phone numbers or email addresses. You can stop sharing contacts in your phone’s settings at any time.

How we use information

We use personal information to:

• Provide the Service: create your account, save your ratings and rankings, show feeds, maps, search results, group rankings, leaderboards and taste matches.
• Calculate public scores fairly: decide which ratings count toward public scores (for example, only once a person has eaten a category at enough different restaurants), weight verified dines, and exclude private and moderated ratings.
• Personalise: show dishes near you, rank results using your dietary needs if you’ve added them, and suggest people with similar taste.
• Keep TasteRex safe and honest: detect fake ratings, spam, review manipulation and abuse; moderate photos and text; enforce our Terms and Community Guidelines.
• Communicate with you: send sign-in codes, security messages, replies to support requests, moderation outcomes, and, if you opt in, notifications about your rankings and friends.
• Improve the Service: understand how features are used in aggregate and fix problems.
• Meet legal obligations: keep records we are required to keep and respond to lawful requests.

Automated moderation and AI

We use artificial intelligence services to help run TasteRex:

• Content moderation. Photos and review text you post are checked automatically for inappropriate content, non-food images and spam. A photo the check can’t confirm is food may be held for review; your score and review still post. Decisions that remove content can be appealed to a person (see Community Guidelines).
• Menus. Restaurant menus are read and classified with AI. This uses restaurant information, not your personal information. See Where menu data comes from.

Photos and text you post are sent only to AI providers under paid business terms that do not allow them to use the content to train their models. We do not use your personal information to train AI models.

What other people can see

Blocking someone stops them seeing your profile and ratings in feeds, search and profiles. Your earlier contributions to a group ranking you share with them stay in that group’s ranking so the list doesn’t silently change for everyone else.

How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural (targeted) advertising.

We share personal information only:

• With service providers who process it on our behalf under contracts that limit how they use it:

• With other users, as described in What other people can see.
• With restaurants, only in aggregate. Restaurants that use our portal see aggregated statistics about their dishes (for example average rank, number of ratings and verified dines) and the same public ratings anyone can see. Their statistics count ratings that aren’t private, but they never see who gave a private or followers-only rating, and never see your contact details or your location.
• For legal reasons, if we believe in good faith it is required by law, subpoena or other legal process, or needed to protect the rights, property or safety of TasteRex, our users or the public.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to this policy.
• With your consent or at your direction.

Advertising

Restaurants may pay for sponsored placements that appear in clearly labelled spots in search and discovery. These are chosen by context, such as the category or area you are browsing. They are not chosen by tracking you across other apps or websites. Sponsored placements never change rankings or scores. Advertisers receive aggregated performance reports (such as impressions and taps), not information that identifies you.

TasteRex does not use Apple’s advertising identifier (IDFA) or Google’s advertising ID and does not track you across apps owned by other companies.

How long we keep information

Your choices and controls

• Visibility: set each rating to Private, Followers or Anyone, and set a default in Settings.
• Location, contacts, photos and notifications: turn each on or off in your phone’s settings.
• Dietary needs: add, change or remove them in Settings at any time.
• Download your data: Settings → Download my data gives you a copy in JSON, with your ratings and Want to Try list also available as CSV.
• Delete your account: Settings → Delete my account, or see how to delete your account. Deletion completes within 30 days, and you can cancel in Settings until then.
• Emails: service emails such as sign-in codes and security notices can’t be turned off, but we don’t send marketing email without your consent.

Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your personal information;
• opt out of the sale of personal information, targeted advertising, or profiling that has legal or similarly significant effects (we don’t do any of these); and
• limit or withdraw consent to our use of sensitive information (such as precise location and dietary or allergy information).

Residents of states including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have some or all of these rights under state law. We give these rights to every user, wherever they live.

How to make a request. Most requests can be done yourself in Settings. Otherwise email privacy@tasterex.com from the address on your account. We may need to confirm your identity before acting. You can use an authorised agent; we’ll ask for proof that they act for you. We respond within 45 days, and will tell you if we need up to 45 more.

Appeals. If we decline your request, you can appeal by replying to our decision with “Appeal” in the subject line. We’ll respond within 45 days. If you’re still unhappy you can contact your state attorney general.

No discrimination. We won’t treat you differently for using your privacy rights.

Global Privacy Control. We honour the Global Privacy Control signal as a request to opt out of sale and sharing, which we don’t do anyway.

California notice at collection

In the last 12 months we have collected these categories of personal information, for the purposes described in How we use information, from you and your device: identifiers (email, username, IP address); customer records (name, email); characteristics of protected classifications (age, through date of birth); internet or other electronic network activity (app and website usage logs); geolocation data (precise, with permission); audio, electronic or visual information (photos you upload); inferences (taste matches and personalised rankings); and sensitive personal information (precise geolocation; dietary and allergy information you choose to add; account sign-in credentials). We use sensitive personal information only to provide the Service you request, as permitted by California law. We do not sell or share personal information, and we have no actual knowledge of selling or sharing personal information of anyone under 16.

Consumer health data

Some dietary information, such as a food allergy, may be considered “consumer health data” under laws like Washington’s My Health My Data Act and Nevada’s similar law. This section is our consumer health data privacy policy.

• What we collect: only the dietary preferences and allergies you choose to add, and your choice about weighting your ratings for people with the same needs.
• Where it comes from: you.
• Why: to personalise rankings for you and, if you opt in, to weight your ratings for people who eat the same way. Others see only aggregate effects, never your individual dietary needs.
• Who we share it with: only the service providers that host our database (Supabase), under contract. We never sell it, never use it for advertising and never share it with restaurants.
• Your rights: you can see, change or delete it at any time in Settings, withdraw consent by removing it, and ask us to confirm what we hold or delete it by emailing privacy@tasterex.com. The appeal process above applies.

We collect this information only with your consent, given when you add it.

Children and teens

TasteRex is not for children under 13, and we do not knowingly collect personal information from them. If we learn that someone under 13 has created an account, we will delete it. If you think a child under 13 has given us information, email privacy@tasterex.com.

Users aged 13 to 17 must have permission from a parent or guardian. Alcohol-related dishes and content are hidden from anyone under 21, and from any account without a date of birth. We do not show sponsored placements for alcohol to anyone under 21.

Restaurant information

TasteRex lists restaurants using open place data and information restaurants publish on their own websites. This is business information, but it can include names, phone numbers or email addresses of people who run a restaurant. We use it only to list the restaurant accurately. A restaurant can correct its listing by claiming it, or ask questions at restaurants@tasterex.com. See Where menu data comes from.

Restaurant portal users

If you claim or manage a restaurant, we collect:

• your name, email, role at the restaurant and, if you give it, phone number;
• verification information: the domain email we send a code to, the result of a call to the restaurant’s listed phone number, or business documents you upload (such as a business licence). Uploaded documents are visible only to our verification staff and are deleted 90 days after your claim is decided;
• the content you add to your restaurant’s page (descriptions, photos, hours, menu details, dietary details);
• billing information: payments are handled by Stripe, so we never receive your full card number. We keep the billing contact, plan, invoices and ad spend; and
• a log of changes made by each team member, so a restaurant can see who changed what.

We use this to verify you, run your account, bill you, prevent fraud and keep records required by law.

Security

We protect information with encryption in transit (HTTPS/TLS) and at rest, database access rules that limit each account to its own data, two-step sign-in for restaurant accounts, and limited staff access. No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and authorities as the law requires.

Where information is stored

TasteRex is operated from the United States, and our service providers store and process information in the United States. If you use TasteRex from outside the United States, your information will be transferred to and processed in the United States.

Changes to this policy

We’ll post any change here with a new “last updated” date and version. If a change is material, we’ll tell you in the app before it takes effect and, where required, ask you to accept the new version. We record which version you accepted.