Privacy Policy

When you use Dish Tracker, we collect information that you provide directly to us, as well as data automatically generated through your interaction with the service:

• Account Information: When you register or sign in via Apple Sign-In, Google Sign-In, or Email, we collect your authentication identifier, email address, and display profile name provided by the identity provider.
• Meal Sessions & Dish Details: Information you record in your dining journal, including dish names, restaurant names, ratings, notes, dates, meal tags, and meal period classifications (Breakfast, Lunch, Dinner, Late Night).
• Photos & EXIF Metadata: Meal photos you capture or import from your photo library. We read image metadata (such as timestamps and GPS coordinates embedded by your camera) strictly to determine the dining date/time and match the restaurant location.
• Device & Network Information: Technical telemetry including IP address, device type, browser specifications, and anonymous crash reports to maintain application stability and security.

We use the collected information solely for operational and functional purposes:

• Meal Clustering & Venue Matching: Correlating timestamps and photo coordinates to automatically organize your photos into coherent restaurant visits and prevent duplicate entries.
• Personal Dining Journal: Storing and syncing your meal history so you can retrieve past meals, track personal favorites, and review eating habits across your devices.
• Community Rankings (Optional): If you choose to share a dish publicly with the community, aggregated ratings and photos help build local dish rankings so other food lovers can discover great meals. Private journal entries remain completely inaccessible to other users.
• Service Improvement & Security: Preventing abuse, enforcing API rate limits, debugging crashes, and improving on-device performance.

To deliver high reliability, your data is processed by trusted cloud infrastructure providers under strict confidentiality agreements:

• Supabase: Handles secure database storage, user authentication, and encrypted file storage for dish photos.
• Google Maps Platform: Used for reverse geocoding to translate GPS coordinates into restaurant venue names and street addresses.
• Vercel & DigitalOcean: Host our web frontend application and backend API microservices.
• Cloudflare: Provides DNS routing, TLS encryption, and edge DDoS protection.

We do not share your personal data with advertisers or data brokers.

All communication between your device, our API, and our database is encrypted in transit using industry-standard TLS 1.3 / HTTPS. Photos and journal entries stored in Supabase Storage and PostgreSQL are encrypted at rest.

Your Deletion Rights: You have the complete right to request the deletion of your account and all associated personal data at any time. When an account deletion is requested:

• All meal sessions, dishes, and ratings are permanently removed from our databases.
• All uploaded meal photo files in cloud storage buckets are permanently destroyed.
• Your authentication record in Supabase is completely erased.

To request account or data deletion, email our privacy team at privacy@dish-tracker.app with the subject line "Account Deletion Request". Requests are fulfilled within 30 days.