Privacy Policy

The controller of the personal data described here is [TO BE SUPPLIED: legal entity name and registered address], contactable at [TO BE SUPPLIED: privacy contact email].

If you leave feedback without an account — which is the ordinary way to use this — we store what you wrote, the rating and topics you chose, any photo you attached, which business it was about and when. We do not store anything identifying you, and there is no account for it to be attached to.

If you create an account we store your email address, the gamertag you choose, your game scores, your points, which venues you follow and the feedback you have sent while signed in.

If you run a business here we store your email address, the business you claimed, the Google Places record for it, your QR codes, and anything you publish — notices, menus, polls and replies.

Technical data. To stop automated abuse of the public feedback form we keep a counter against a keyed one-way digest of part of your IP address. We do not store IP addresses. The digest cannot be reversed to an address and is kept in a store that holds no feedback.

We use no advertising or analytics trackers, and we do not build profiles for advertising or sell data to anyone, ever.

Photos are checked for location data before they are accepted. A photo carrying GPS coordinates is refused rather than quietly cleaned, so a failure is visible instead of trusted. What is in the picture is still up to you — a face or a name badge is something no file check can remove.

Where data protection law requires a lawful basis, ours are: performing the service you asked for (delivering your feedback, running your account); our legitimate interest in keeping the service working and free of abuse (the rate limiting and bot check above); and your consent where you have given it, which you may withdraw at any time.

These companies process data on our behalf, and no others:

• Supabase — the database and sign-in system. It holds everything described in section 2.
• Cloudflare — hosting, the bot check on the feedback form (Turnstile), and the abuse counter.
• Google — the Places service, used to look up a business by name and address. A search sends the text you typed; it is not connected to your account or to any feedback.
• Mapbox — the map on the Find page.

We will disclose data to law enforcement only where we are legally required to. There is often nothing useful to disclose: anonymous feedback has no author recorded, so no order can produce one.

A business sees the words, rating, topics and any photo. It never sees who sent them — not the email address, not the name, not the gamertag, on any tier.

This is enforced by the database, not by our screens. The column identifying an author is granted to no application role at all, so no query, filter, sort or export can return it, and that holds even if our own keys were stolen.

The one exception is one you choose: if you are signed in and turn on Let them reply, the business can send a reply to that piece of feedback. It still never learns your address — we deliver it.

Feedback and business content are kept until deleted by the account that owns them or by us. Account data is kept while the account exists. The abuse counter is short-lived and expires automatically.

[TO BE SUPPLIED: confirm exact retention periods before launch — this section must state numbers, not "until deleted"]

Depending on where you live you may have the right to see a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. To exercise any of these, write to [TO BE SUPPLIED: privacy contact email]. You can also complain to your local data protection authority.

There is a real limit on deletion and we would rather say it than hide it. When you delete your account, feedback you sent anonymously cannot be identified as yours by anyone, including us — so there is nothing to find and nothing to remove. Feedback you sent while signed in has the link to you removed, and stays with the business as if you had never signed in. We cannot un-say something a business has already read.

We use no advertising or tracking cookies. We store a sign-in token so you stay signed in, a marker identifying this device if you set a PIN, and a temporary copy of feedback you are part-way through typing so a mistaken tap does not lose it. The draft is cleared when you send it.

Our providers operate internationally and data may be processed outside your country, under the transfer safeguards those providers offer. [TO BE SUPPLIED: confirm the hosting region and the transfer mechanism relied on]

This service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child under 13 has given us data, write to us and we will remove it.

Data is encrypted in transit. Access is restricted by role at the database level rather than only in the application, and the strongest of those rules — the one that keeps feedback unattributable — sits below the layer an application bug could bypass.

No service is perfectly secure. If we discover a breach affecting your data we will notify you and the relevant authority as required by law.

If we change this policy we will update the date at the top. Where a change materially affects your rights we will say so in the product rather than relying on you to re-read this page.