Privacy Policy

BiteWorthy keeps the data we need to make the dietary filter work and not much more. We don’t sell your personal information. Your dietary profile, the diets you filter by, and your reviews are never sent to advertisers. On a few public pages of our website, the Meta Pixel tells Meta that a page was viewed or a sign-up happened, so we can measure our ads; you can switch that off (see “Your rights and controls”). The list of third-party services we use is short and named below. You must be at least 13 years old to use BiteWorthy.

• Account: email address, hashed password, OAuth identifier (if you sign in with Apple or Google), display handle. Optional photo.
• Dietary profile: the ingredients and tags you mark “avoid,” the dietary preset (e.g. Celiac) you picked, your strictness setting, and any taste signals (ingredients/tags you like or dislike) you add to improve your picks, and any notes you save for the chat assistant. Stored against your account so it follows you across devices.
• Reviews: the rating, body, and optional photo you submit on a dish. Reviews are public — see “What’s public” below. Location and other camera metadata (EXIF/GPS) is stripped from the photo before it is saved.
• Dish photos: if you submit a photo of a dish (from the dish page, or by offering a review photo), we store the image and whether you confirmed you took it. Location metadata is stripped the same way as review photos. A moderator reviews every submission before it can appear as the dish photo.
• Restaurant visits: when you open a filtered restaurant page while signed in, we record one row per (user, restaurant, day) so you can find it again in My filtered menus. Anonymous browsing creates no such row.
• Suggested edits: if you submit a fix to a dish (e.g. “this actually contains dairy”), we keep the suggestion + its decision history for the moderation queue.
• Waitlist: if you join the launch waitlist, we store your email address so we can tell you when BiteWorthy is available.

• Real name (unless you put it in your display handle).
• Phone number.
• Address or GPS coordinates (we strip location metadata from photos you upload).
• Device fingerprints, advertising IDs, or cross-app tracking signals.

Your reviews — the rating, text, and any photo — appear publicly next to your display handle on the dish page and on your profile at /u/your-handle. If a moderator approves a dish photo you submitted, it can appear as that dish's photo with a small “Photo by <your display name>” credit. Your dietary profile is never shown publicly: what you avoid, your presets, your strictness, and your taste signals stay private to your account. Be aware that a pattern of public reviews can let someone infer your preferences.

If you share a filtered menu link, the link itself encodes your avoid-lists and strictness so the recipient sees the same filter. It does not include your identity, email, or taste signals — but treat a shared link like any private link, since anyone who has it can read those filter settings.

• Neon Postgres (AWS, US East): your account, profile, review text, suggestions, and visit history.
• Hetzner (Ashburn, USA): the servers that run the API.
• Cloudflare R2: review photos and diner-submitted dish photos (metadata stripped; dish submissions unpublished until a moderator approves them), and the cropped per-dish photos that the ingestion pipeline extracts from menu images.
• Anthropic: when a menu is being ingested, the menu image is sent to Anthropic Claude for OCR + structuring. The image leaves our servers but is not used to train the model. When you use the chat, your messages, your dietary profile, any notes you saved for the assistant, and your own reviews when you ask about them (including any hidden by moderation) are sent to Anthropic so it can answer. Reviews are public, so when anyone asks the chat about a dish, the reviews on it (with the reviewer's username and display name) can be sent to Anthropic too.
• Resend: outbound email (claim verification, password reset). The recipient address and message body pass through Resend; we don’t store the message itself.
• PostHog: product analytics, and error reports and logs from our own servers — the latter two never from your browser or phone, with the request body and your IP address removed before they are sent. See “Your rights and controls” for exactly what we send from your device and how to opt out.
• Meta (Facebook): the Meta Pixel on our website measures whether our ads on Facebook and Instagram bring people to BiteWorthy. We don’t load Meta’s own script; each pixel event is one request we build ourselves. It runs only on public pages (the home page, sign-up, our story, press, updates, and restaurant, dish, and city pages), and never on diet pages, people’s profiles, your history, chat, settings, onboarding, or sign-in. It tells Meta that a page was viewed and, when you create an account, that a sign-up happened. Each request carries the page’s path but never anything after a “?” or “#”, so Meta is never sent which diet you filtered by. It also carries the site you came from (only its domain, or one of the public pages above), your IP address and browser details, and two cookies we set for Meta: a random browser id, and the ad-click id when you arrived from a Meta ad. Meta may link that to your Facebook or Instagram account under Meta’s privacy policy. The mobile app does not use the Meta Pixel.

• Account & dietary profile: kept for as long as your account is open; removed when you delete it (see below).
• Reviews & suggested edits: kept as part of the shared menu graph; if you delete your account we delete or anonymize them.
• Dish photo submissions: pending, rejected, withdrawn, and accepted-but-not-used-as-the-dish-photo submissions are deleted with your account (including the stored image). An approved photo that is still the dish photo stays on the menu; the byline is anonymized to “a diner”.
• Restaurant-visit history: kept for as long as your account is open. After you delete your account it’s removed from active systems within 30 days and fully purged within 12 months.

• Access / export your data: email privacy@bite-worthy.com and we’ll send a JSON archive within 30 days.
• Delete your account: same email, same window. We remove your personal data within 30 days and delete or anonymize your reviews. Some records may be retained where the law requires it.
• Correct your data: update your dietary profile any time in the app; for anything else, email us and we’ll fix it.
• Opt out of analytics: on web, analytics are on by default — turn them off with the toggle in /profile/settings, and we honor your browser’s Do-Not-Track signal automatically. Either one also turns off the Meta Pixel. On mobile, analytics are off by default and only fire if you enable them in Settings → Analytics. Funnel events are tied to a random analytics ID, not to your account — signing in does not connect them to your identity. What they carry is deliberately narrow: menu_filtered sends the restaurant, how many items were visible or hidden, and which kind of filter was applied — not the filter itself. Toggling strictness on a menu sends the before and after value. Saving your dietary profile sends only that it happened, never the preset, the strictness, or how much you avoid — that association is the one we most want to avoid making. We never send review text, your email, or your specific avoid-lists. Page views send the page’s address with the part after the “?” removed, and without which diet page you opened or whose profile you viewed. Like every event, they also carry that random analytics ID and basic browser and device details (browser, OS, screen size, approximate location from your IP), and the domain of the site that sent you. We don’t record what you click or type, and we don’t record your session.
• We do not sell your personal information. The Meta Pixel described above sends Meta limited website activity for advertising, which California law counts as “sharing”. To opt out of that sharing, turn off analytics in /profile/settings, or use a browser that sends Global Privacy Control or Do-Not-Track: we honor each of them, and any one switches the pixel off. We will not discriminate against you for exercising any of these rights.

BiteWorthy is available in the United States at launch. If you’re in the EU or UK, additional rights may apply — contact us and we’ll honor them.

BiteWorthy is for diners managing their own or their family’s dietary needs. You must be at least 13 to create an account. If we learn we’ve collected personal data from a child under 13, we delete it. BiteWorthy is not directed at children under 13.

We’ll update the date at the top when this page changes. Material changes get a highlighted note on the homepage and an email to active accounts.

Email privacy@bite-worthy.com for anything in this policy, including data access, deletion, or correction requests. For copyright takedowns, see Terms § Copyright & DMCA.