Privacy policy

What we collect

Your account details — the name and username you choose, and the email and/or mobile number you sign up with. Your username is the only identity other members ever see. A verified mobile number is kept as a salted hash plus its last digits; until it's verified, it's simply held so we can verify it later. Contact details are never shown to other members.

Sign-in providers — if you use Google or Apple, we keep only the identifier they hand us. No contacts, no emails read, nothing else.

A private record of changes — when account details change (a new username, a new email), we keep a note of what they were before. It exists for safety: it lets us hold a dropped username for its previous owner and helps us look into impersonation or abuse. Only moderators and the site owner can see it, each only as much as their role needs.

Your contributions — places, dishes, menu photos, edits, votes, and anything else you post for other members are public by design; that's the product. They carry your username. Public writing may be screened automatically for spam and abuse before it appears.

Device sessions — a browser/OS label and sign-in time for each device, shown to you at /me so you can log any of them out.

Abuse-prevention logs — IP addresses around sign-in codes and attempts, kept to rate-limit and investigate misuse. They're never linked to anything you see or do publicly.

Location

You pick a locality to browse — that choice is a preference, not a track. GPS is used only if you tap "use my location" or "nearest to me", and stays in your browser: to centre you, sort lists by distance, or pin a restaurant's position when you add one. Once you have allowed it, the votes, "still accurate" taps and menu pages you open carry a rounded position (about 100 m) so we can tell whether you were actually at the place. We keep that as the place, a rough cell and a yes/no for 90 days, use it only to weight on-the-spot opinions, keep places fresh and guess your locality, and never show it to anyone.

Menu photos & AI

Photos you upload are of restaurant menus, become part of the public index, and may be processed by an AI service (Anthropic's Claude) once, to read the dishes off them. Your device strips the photo's hidden metadata (location, camera details) before it ever leaves your phone. Beyond menu reading and the spam screen above, nothing you do is sent to any AI.

What we don't do

No ads. No selling or sharing data with anyone. No analytics trackers or pixels. No reading your contacts. No private messages exist on the platform at all. Passwords are optional, and when set are stored with scrypt hashing.

Cookies

A few, all first-party: a session cookie (keeps you signed in; revocable from /me), an anonymous device id, your locality preference, and a note that you've dismissed a security notice. That's the lot.

Deletion & questions

Want your account or contributions removed, or have any question about your data? Email hello@jaabitaa.com from any address and include your public name — we'll verify and act within 30 days. Community corrections (wrong price, closed place) don't need email: use report / fix on the item itself.