Privacy Policy
This policy explains what personal information Veg Eats (“Veg Eats”, “we”, “us”) collects when you use vegeats.app, Veg Eats Pro, our emails and, when it launches, the Veg Eats iPhone app; why; who it goes to; how long we keep it; and the choices and rights you have. It is written to describe what Veg Eats actually does. Where a feature is built but not switched on yet, we say so.
The short version
- We collect what we need to run Veg Eats: your email and name if you make an account, the food preferences you choose to give us, your subscription status, and basic technical data every website receives.
- Allergy and celiac answers are health-related. They are optional, used only to filter menus for you, never used for ads, never sold and never shared except with the companies that host our systems.
- Web subscriptions are sold through Link, Stripe’s checkout service, which takes the payment. We never see or store your card number.
- We do not sell your personal information and we do not share it for targeted advertising. We use no third-party analytics or tracking pixels.
- You can download or delete your information yourself from the account menu, or email [email protected] for anything else.
Contents
- Notice at collection
- Who we are
- What we collect
- Allergy and health information
- How we use it
- Legal bases (EEA and UK)
- Who we share it with
- Ads
- Cookies and local storage
- How long we keep it
- Security
- Your rights and how to use them
- Your privacy choices
- California
- Other US states
- EEA, UK and Switzerland
- Children
- Emails from us
- Do Not Track and Global Privacy Control
- Changes to this policy
- Contact us
1. Notice at collection
This is the notice we give at or before the point we collect personal information, including under the California Consumer Privacy Act (CCPA). The sign-up window links here.
| What we collect | Why | Kept for |
|---|---|---|
| Account details: email, name, sign-in method, account ID | Create and secure your account, sign you in, send service emails | While your account is open; after you delete it, 30 days hidden and recoverable, then purged |
| Your preferences: diet, the ingredients you avoid, allergy or preference, home city, goals, a dish you picked | Set up and filter Veg Eats for you | Until you change them, or as for account details |
| Sensitive: allergy or celiac information (health-related) | Only to filter menus for you, with your consent (we keep a record of each consent and withdrawal) | Until you remove it, or as for account details |
| Subscription details from Stripe and Link, or Apple (status, plan, dates, a customer reference) | Give you Pro, handle billing questions, meet tax and accounting duties | As for account details. Stripe keeps its own payment records as the law requires |
| Email-list address and the page you signed up on | Tell you when Veg Eats opens and send the updates you asked for | Until you unsubscribe |
| Feedback: votes, corrections, notes, closure reports | Check and correct our listings | While the listing it is about is published. It is not linked to your account |
| Technical data: IP address, browser, pages and searches requested, a hashed device key, session cookie | Deliver the site, keep it secure, prevent abuse and scraping | Sign-in sessions up to 30 days, then deleted; hashed keys with the record they protect; request logs as in section 10 |
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use sensitive personal information for anything beyond providing the service you asked for. Details, sources and your rights are below.
2. Who we are
The company responsible for your personal information (the “controller” or “business”) is Veg Eats, 653 Coppertree Ct, Simi Valley, CA 93065, United States. Privacy questions and requests: [email protected].
3. What we collect
3.1 What you give us
- Account. When you sign up with Google, Apple or an email link, we receive your email address, whether it is verified, your name if the provider shares it, which sign-in method you used, and an account ID from Google Firebase Authentication. If you use Apple’s “Hide My Email”, we get Apple’s relay address instead of your real one. We never receive your Google or Apple password.
- Onboarding answers and preferences. The first name you want us to use; how you eat (for example strictly vegan); the ingredients you avoid (gluten, nuts, soy, sesame); whether that is an allergy or celiac disease, or a preference; your home city; what would make eating out easier; a dish you picked; whether you took our “try one new dish” pledge; and whether you want our newsletter and news about the iPhone app. You do not have to tell us about allergies or anything you avoid: “None of these” is always an answer. Until you sign up, your answers are kept only in your browser.
- Email list. If you join our list before accounts open, we keep your email address, the page you signed up on and when.
- Feedback. Votes on a dish verdict, whether you ordered it, corrections, short notes, and reports that a place has closed, together with the restaurant, city and dish they are about. Feedback is not linked to your account.
- Messages. What you send us by email, such as support or privacy requests.
3.2 What we collect automatically
- Request data. Like every website, our hosting provider Cloudflare receives your IP address, browser and device type, the address of each page or file you request (including search words, the city you choose, and, if you tap “use my location” on the home page, approximate coordinates that are placed in the search page’s address), the referring page, and the time. We use it to deliver the site and to protect it.
- A hashed device key. With feedback, email-list sign-ups and sign-in sessions we store a short one-way hash of your IP address and browser string. It lets us stop one browser flooding votes or the list. We never store the raw IP address with these records.
- Session cookie. When you sign in we set one cookie,
sd_sess, that keeps you signed in for up to 30 days. We store only a hash of it. - Browser storage. Some settings stay in your own browser (see section 9).
- No cross-site tracking. We do not use Google Analytics, advertising pixels, session recording or similar third-party tracking tools. We do use Cloudflare Web Analytics to measure how quickly pages load for real visitors. Cloudflare injects a small measurement script into our pages for visitors outside the EU; it is not injected for visitors in the EU. It sets no cookie, does not fingerprint your device and does not follow you to other sites: it reports page addresses, load timings and coarse details such as browser, operating system and country. Our host also produces aggregate traffic statistics from the request logs it keeps to serve and protect the site.
3.3 What we get from others
- Google and Apple, through Firebase Authentication, when you sign in with them: the account details listed in 3.1.
- Stripe and Link, when you subscribe on the web: a customer reference, your subscription’s status, plan, trial end and renewal date. Link, Stripe’s checkout service, sells web subscriptions as the merchant of record, and collects your card, your name and your billing address itself on its own checkout page (it needs the address to work out sales tax). If you choose to, Link can also save your payment details for faster checkout on other sites; that is between you and Link. We never see or store your full card number.
- Apple, when the iPhone app launches and you subscribe through it: a transaction reference and your subscription’s status and dates, but not your Apple ID or card details.
3.4 Location
We only use your device’s precise location if you allow it in your browser. It is used in your browser to show places near you or pick the nearest city we cover. We do not store precise location on our servers. The home page’s “use my location” passes rounded coordinates in the next page’s address, so they appear in request data as described in 3.2, and your browser may remember them for your next visit. What we save to your account is the city you choose.
3.5 What we do not collect
We do not ask for your date of birth, gender, contacts, photos or precise location history, and we do not buy personal information from data brokers.
4. Allergy and health information
If you tell us you avoid gluten, nuts, soy or sesame, and especially that this is an allergy or celiac disease, that is information about your health. Several laws treat it as sensitive, including the CCPA (“sensitive personal information”), Washington’s My Health My Data Act and Nevada’s similar law (“consumer health data”), and the GDPR in the EEA and UK (“special category” data). We handle it accordingly:
- It is optional. Veg Eats works without it.
- We ask for it only on the question that explains what it is for, and we collect it with your consent. We keep a record of that consent (which version of our health-data notice you saw, when, and which answers it covered), and a record when you withdraw it.
- We use it only to filter menus and set up Veg Eats for you, and to show it back to you.
- We never use it for advertising, never sell it, never share it with advertisers, and never use it to infer anything else about you.
- Only the service providers that host our systems (Cloudflare) process it for us, under contract.
- You can withdraw consent at any time by removing the answers with Edit your filters in the account menu (choose “None of these”), or delete your account. Withdrawing deletes the answers.
Our separate Consumer Health Data Privacy Notice gives the details Washington and Nevada law require.
5. How we use it
- To provide Veg Eats: sign you in, remember your preferences, filter menus for Pro subscribers, and show the right city.
- To run Pro: start and manage your subscription and trial, know whether you have Pro, and answer billing questions.
- To communicate: send sign-in links, receipts and subscription notices (such as trial reminders and price change notices), respond to you, and, if you opted in, send our newsletter and tell you when the iPhone app is out.
- To improve our listings: use feedback to find and fix wrong verdicts.
- To keep Veg Eats safe: prevent fraud, abuse, spam and scraping, enforce our Terms, and fix problems.
- To follow the law: keep required records, respond to lawful requests, and establish or defend legal claims.
We do not use your personal information to make decisions that have legal or similarly significant effects about you. Our verdicts are about dishes, not people. We do not use your personal information, feedback or preferences to train AI models. Our public restaurant and city pages, which contain no information about you, may be read by the search engines and AI crawlers our robots.txt names (see section 10 of the Terms); your account, preferences and feedback are never on those pages.
6. Legal bases (EEA and UK)
If the GDPR or UK GDPR applies to you, we rely on these legal bases:
- Contract: to provide your account, your preferences and Pro.
- Explicit consent: for allergy and celiac information (special category data), and consent for the newsletter and any non-essential cookies or personalised ads. You can withdraw consent at any time, without affecting what we did before.
- Legitimate interests: to keep the service secure, prevent abuse and scraping, use feedback to correct listings, and understand how the service is working. We have weighed these against your rights, and you can object (see section 12).
- Legal obligation: tax, accounting and responding to lawful requests.
7. Who we share it with
We do not sell your personal information. We share it only as follows.
7.1 Service providers (processors)
These companies process personal information on our behalf, under contracts that limit them to providing their service to us:
| Provider | What they do for us |
|---|---|
| Cloudflare, Inc. | Hosts the site and our databases (accounts, preferences, feedback, email list), delivers pages, and protects against attacks and bots. |
| Google LLC (Firebase Authentication) | Handles sign-in with Google, Apple and email links, and sends email sign-in links. When you delete your account, we delete your sign-in record there too. |
| Stripe, Inc., including Link | Runs our subscription portal and, through Link, sells web subscriptions as the merchant of record: takes payments, works out and pays sales tax, sends receipts and invoices, handles payment questions and disputes, and records your agreement to the Terms at checkout. When your account is purged we delete your Stripe customer record; Stripe and Link keep what the law and their role as seller require them to keep. |
| Adobe (Adobe Fonts) | Serves the typeface our pages use. Your browser requests it from Adobe, which receives your IP address and the page address; Adobe says it uses this to count font use for licensing, and sets no cookies. |
| An email delivery provider — none is in use yet | Sends the emails described in section 18: your subscription confirmation, trial reminders and, if you opted in, the newsletter. It receives your email address, your first name and the email itself. |
| No advertising network — none is chosen and none is switched on. | See section 8. |
7.2 Companies you choose to use
Google and Apple, when you sign in with them, and Stripe and Link, as the seller of web subscriptions and for their own legal and anti-fraud duties, also act under their own privacy policies; Link’s policy, linked at checkout, covers your payment and any Link account. So do Apple when you buy through the App Store, and map or restaurant sites you follow a link to.
7.3 Other cases
- Legal and safety: when we believe in good faith that the law requires it, or to protect the rights, property or safety of Veg Eats, our users or others.
- Business changes: if Veg Eats is sold, merged or reorganised, personal information may transfer to the new owner, who must honour this policy or tell you before changing it.
- With your consent or at your direction.
- Aggregate or de-identified information that cannot reasonably identify you, such as “how many readers avoid gluten in Seattle”. We will not try to re-identify it. We never publish allergy information about a person.
8. Ads
Today: free readers may see a labelled “Sponsored” placement in search results. Right now it only ever shows our own promotion for Veg Eats Pro. No ad network’s code runs on Veg Eats, no ad cookies are set, and nothing about you goes to an advertiser. Pro subscribers see no ads.
If we add an ad network, we will update this policy and the notice at collection before it goes live, and:
- ads will never use your allergy, celiac or other health information, or your dietary profile;
- either we will show only contextual ads, chosen from the page, search and city you are looking at, without cookies that track you across other sites, in which case there is no “sale” or “sharing” to opt out of; or, if the network uses cookies or device identifiers for personalised ads (which California law calls “sharing” for cross-context behavioural advertising), you will be able to opt out with the Your privacy choices link on every page, we will honour Global Privacy Control signals as an opt-out automatically, we will not do it at all for anyone we know is under 16, and in the EEA, UK and Switzerland we will ask for consent first.
9. Cookies and local storage
We keep this short list because we use very little. We do not use advertising or analytics cookies today.
| Name | What it is for |
|---|---|
sd_sess (cookie, ours) | Keeps you signed in. Strictly necessary. HttpOnly, secure, lasts up to 30 days or until you log out. |
| Firebase sign-in state (browser storage, set by Google’s Firebase code) | Completes a sign-in with Google, Apple or an email link. Strictly necessary for signing in. |
Google sign-in cookies, such as g_state | Set by Google’s sign-in button when it appears, to show “Continue as” and remember if you closed it. Governed by Google’s privacy policy. |
Cloudflare security cookies, such as __cf_bm and cf_clearance | Set by Cloudflare only if its bot protection checks a request. Strictly necessary for security. |
sd_where, sd_geo_denied (browser storage) | Remember the city or nearby area you last searched, which may include rounded coordinates, and that you declined location. |
sidedish.fryer, sidedish.thin, sd_closed (browser storage) | Remember display settings such as whether shared fryers count, and places you hid. |
sd_votes, sd_notes (browser storage) | Remember the feedback you gave on this device so the buttons show it. |
sd_onb, sd_me_hint, sd_email_for_link (browser storage) | Keep your onboarding answers as a draft until you sign up, your first name and email for the account button, and the email a sign-in link was sent to. |
Browser storage stays on your device and we do not read it from our servers. You can clear it in your browser settings; the site keeps working, but will forget your settings.
10. How long we keep it
- Active account data: kept as long as your account is open.
- Deleted accounts: when you choose Delete account, we cancel any web subscription, sign you out everywhere and hide the account for a 30-day grace period, during which it is recoverable by signing in again. After 30 days everything is purged within 24 hours, including your Stripe customer record and your Firebase sign-in record. Link keeps its own record of a web purchase as the seller; you can ask Link to delete it through Link support.
- Deletion log: after a purge we keep a minimal record (your account ID, your email, when you asked, when we purged, and which service providers we told) as proof that the deletion happened, as the GDPR (articles 5(2) and 30) and US privacy laws expect.
- Backups: our database provider’s point-in-time recovery may hold a copy for up to 30 days after a deletion. Backups are used only for disaster recovery and roll off on their own.
- Data exports: Download your data builds the file on request and sends it straight to your browser. We do not store export files.
| Data | In your browser | On our servers |
|---|---|---|
| Account (email, name, sign-in method, account ID) | A name and email hint for the account button, until you log out | Until account deletion (30-day grace, then purge) |
| Preferences (diet, city, goals, dish you picked, newsletter choice) | An onboarding draft until you sign up | Until you change them or delete your account |
| Allergy and celiac answers | As above | Until you remove them (which withdraws consent) or delete your account |
| Consent and withdrawal records for those answers | None | Until account deletion |
| Sign-in sessions | The sd_sess cookie, up to 30 days | A hash of it, deleted when it expires (checked hourly and at every sign-in) or when you log out or delete your account |
| Subscription status and Stripe customer reference | None | Until account deletion. Stripe keeps payment records under its own legal duties |
| Record of the emails we sent you (type and date, plus a fingerprint of the content) | None | Until account deletion |
| Stripe event IDs (no personal details) | None | 90 days |
| Deletion log | None | Kept, as proof of deletion |
| Email-list address | None | Until you unsubscribe or ask us to delete it |
| Feedback (votes, notes, closure reports) | What you voted, so the buttons show it | While the listing is published; not linked to your account |
| Display settings and last place searched | Until you clear site data | Never stored |
| Precise location | Rounded, with your last search | Never stored |
| Request logs | None | We keep none; Cloudflare processes them under its own retention |
| Data export files | The file you download | Never stored |
We may keep information longer where the law requires it, or to resolve a dispute or enforce our terms.
11. Security
We use reasonable safeguards for the kind of information we hold. For example: accounts sit in a separate database from everything else; we store only a hash of your session token; the session cookie cannot be read by page scripts; sign-in is handled by Google Firebase; card data goes only to Stripe; and everything is encrypted in transit with HTTPS. No system is perfectly secure, so we cannot guarantee security. If a breach affects your personal information, we will tell you and the authorities as the law requires.
12. Your rights and how to use them
Depending on where you live, you may have the right to:
- Know and access the personal information we hold about you and how we use it;
- Correct information that is wrong;
- Delete your information;
- Portability: get a copy in a common, machine-readable format;
- Opt out of the sale or sharing of personal information, targeted advertising and profiling (we do none of these today);
- Limit or withdraw consent for sensitive information, such as allergy answers;
- Object to or restrict some processing (EEA and UK);
- Appeal our decision on your request.
How: most of these you can do yourself in the account menu (your name at the top of any page): Download your data gives you everything we hold about your account as a JSON file; Delete account deletes it (section 10); Edit your filters corrects or removes your preferences and allergy answers. Unsubscribe with the link in any email. For anything else, email [email protected] from the address on your account, with what you would like us to do.
Verification: to protect you, we confirm the request comes from you, usually by asking you to reply from, or sign in with, the email on the account. We may ask for more if needed, and will use it only to verify you.
Authorised agents: someone you authorise can make a request for you. We will ask for proof of their authority (such as your signed permission or a power of attorney) and may ask you to confirm your identity with us directly.
Timing: we respond within 45 days (one month in the EEA and UK), and will tell you if we need an extension the law allows.
Appeals: if we decline your request, you can appeal by replying to our decision or emailing [email protected] with “Appeal” in the subject. We will answer within the time your state’s law requires (usually 45 or 60 days). If you are not satisfied, you can contact your state Attorney General.
No discrimination: we will not deny you service, charge you a different price or give you a worse service because you used a privacy right.
13. Your privacy choices
- Do Not Sell or Share My Personal Information. We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to switch off today. If that changes when ads arrive (section 8), the opt-out will be here, linked from the footer of every page.
- Limit the Use of My Sensitive Personal Information. We use sensitive information (allergy and celiac answers) only to provide the filtering you asked for, which is a use the CCPA regulations permit without offering this right. You can still remove it at any time with Edit your filters, or ask us to delete it.
- Global Privacy Control. If your browser sends a GPC signal, we treat it as a request to opt out of sale and sharing for that browser and any account signed in on it.
- Marketing email: unsubscribe with the link in any email, or email us.
- Location: turn it off in your browser; Veg Eats still works by city.
14. California
This section adds to the rest of this policy for California residents, under the CCPA as amended by the CPRA. In the last 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 3 and 5:
| Category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, email, account ID, IP address, hashed device key, session cookie ID | Cloudflare, Google Firebase, Stripe, Adobe Fonts (IP only) |
| Customer records (Cal. Civ. Code 1798.80(e)) | Name, email; payment details and billing address are collected by Link (Stripe), not us | Cloudflare, Google Firebase, Stripe |
| Commercial information | Pro subscription status, plan, trial and renewal dates | Cloudflare, Stripe |
| Internet or network activity | Pages and searches requested, feedback on dishes | Cloudflare |
| Geolocation | The city you choose; approximate coordinates in a page address if you use “use my location” | Cloudflare |
| Inferences and preferences | Diet, goals, the kind of food you want to find | Cloudflare |
| Sensitive personal information | Health-related: allergy or celiac information you give us | Cloudflare (hosting only) |
- Sale and sharing: we have not sold or shared (for cross-context behavioural advertising) any category of personal information in the last 12 months, and we have no actual knowledge of selling or sharing information of anyone under 16.
- Sensitive personal information is used only to provide the service you requested and not to infer characteristics about you.
- Retention: see section 10.
- Your rights to know, delete, correct, opt out and limit, and how to use them, are in sections 12 and 13. We do not discriminate against you for using them.
- Financial incentives: a free trial of Veg Eats Pro is a product offer, not an incentive for personal information. We do not offer incentives for personal information.
- Shine the Light: we do not share personal information with third parties for their own direct marketing.
15. Other US states
Residents of states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) have rights similar to those in section 12, which we honour for everyone in the US regardless of state: to confirm whether we process your information and access it, correct it, delete it, get a portable copy, and opt out of targeted advertising, sale and profiling, and to appeal a refusal. Where those laws require your consent to process sensitive data, such as a health condition, we ask for it before collecting it. Washington and Nevada residents: see our Consumer Health Data Privacy Notice. Nevada residents may also ask us not to sell covered information; we do not sell it.
16. EEA, UK and Switzerland
Veg Eats covers US restaurants, but if you use it from the European Economic Area, the United Kingdom or Switzerland: the controller is named in section 2; our legal bases are in section 6; and your rights are in section 12, including the right to object to processing based on legitimate interests and to withdraw consent. You also have the right to complain to your local data protection authority.
International transfers. We and our providers store and process information in the United States and other countries whose laws may differ from yours. Where we transfer personal information from the EEA, UK or Switzerland, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or on the European Commission’s Standard Contractual Clauses (with the UK Addendum) in our providers’ data processing terms.
17. Children
Veg Eats is not directed to children under 13, and we do not knowingly collect personal information from them. You must be 13 or older to create an account. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it. If you believe a child has given us personal information, email [email protected]. We do not sell or share personal information of anyone we know is under 16.
18. Emails from us
- Service emails (sign-in links, the confirmation of your subscription terms when a trial or subscription starts, receipts, the reminder before your trial ends, price change notices, and changes to our terms) are part of the service and you cannot opt out of them while you have an account or subscription.
- Newsletter and product news go only to people who opted in, either on our email list or in onboarding. Every one has an unsubscribe link, and we act on it promptly (within 10 business days). You can also ask us to stop by emailing us.
19. Do Not Track and Global Privacy Control
We do not track you across other websites, so a browser’s Do Not Track setting has nothing to turn off here. We honour Global Privacy Control as described in section 13.
20. Changes to this policy
We will update this policy when what we collect or how we use it changes, and before any new use takes effect. The date and version at the top will change. If a change is material, for example adding an ad network, launching the iPhone app, or using information in a new way, we will tell you by email or on the site before it applies and, where the law requires, ask for your consent. Earlier versions are available on request.
21. Contact us
Veg Eats
653 Coppertree Ct, Simi Valley, CA 93065
[email protected] (privacy requests and everything else)
Back to top · Terms of Service · Consumer Health Data Privacy Notice