Privacy Policy
Last updated 15 October 2026
Tasted is a restaurant diary and recommendation app. You log places you've eaten, and you see what people you follow thought of theirs. This policy explains exactly what we collect, why, and what you can do about it. It describes what the app actually does today, not what it might do later.
Tasted is operated from Australia and is subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
| What | Why |
|---|---|
| Your email address | It's how you sign in. We email you a one-time code. Accounts don't need a password; if one is ever set on an account, it's stored only as a one-way hash by our sign-in provider and nobody at Tasted can read it. |
| Your profile: username, display name, bio, profile photo | So other people know whose recommendation they're reading. |
| What you log: the restaurant, your rating, review, dishes, flavour tags, photos, the date you went, and optionally what you paid and how many of you there were | This is the product. It's what your diary holds and what the people you choose to share with can see. If you @mention someone you follow in a review, they get a notification and the mention is shown as a link on the review. |
| Your lists and who you follow or block | To build your feed, your map, and your recommendations. |
| Your device's location, only while you're using the app and only if you allow it | To show restaurants near you, centre the map, and sort places by distance. We do not store your location. It's used to answer the request you just made and then discarded. It is never attached to a review. |
| Reports you file about other people's content, or about a restaurant's details (for example that it has closed or is in the wrong place), including a map pin if you choose to drop one | So we can review them and fix the listing. A pin you drop is the restaurant's location as you see it, not your own. The person you report is not told who reported them. |
| Lists you import, if you choose to: a file you export from Google Maps, a spreadsheet, or text you paste | The file is read on your phone. Only the place names, addresses and any coordinates in it are sent to us, to match them to restaurants and build your list. We don't keep the file itself. |
| Usage analytics: which screens you open, which actions you take, and a device identifier | To understand what works and what's broken. You can turn this off. See below. |
| Your date of birth, once, when you first sign in | To check you are 16 or over. We don't store it. We keep only that you confirmed your age, and when. If someone under 16 tries to join, we close the account and keep a one-way scrambled version (a hash) of their email address, and nothing else, so the same address can't try again with a different date. |
| Your chats: direct and group messages, the reviews and lists you send, reactions and comments, and plans you make with people (the restaurant, suggested times, votes and notes) | To deliver them to the people in the chat. You can only start a chat with someone you follow who follows you back, and only people in a chat can read it. We don't read chats, except where we need to look into a report or a serious safety problem. |
| Notification token and settings: a code from Apple or Google that lets us send notifications to your phone, and which kinds you want | To send the notifications you ask for, such as a message, a reaction or a plan. Turn them off in your phone's settings or in Tasted. |
| Your calendar, only if you allow it | Read on your phone to show which suggested times you're free, and to add a plan to it. Nothing from your calendar is sent to us. |
| Crash and error reports: what went wrong, your phone model, system and app version, and your account ID. Never your email address or IP address | To find and fix bugs. These are separate from the analytics switch below. |
We do not collect your contacts, your photo library beyond the images you deliberately attach, your precise location history, payment details, or anything from other apps. Tasted has no advertising and we do not sell or share your personal information with anyone for advertising or marketing.
Who can see what you log
Every review you write has a visibility setting that you choose, and it's enforced on our servers, not just hidden in the app:
- Public: any signed-in Tasted user can see it.
- Followers: only people who follow you.
- Private: only you. A private review never appears in anyone else's feed, profile view, search, or lists, and is never counted in anyone else's taste match.
Every rating helps a restaurant's overall score, whatever its visibility. The star rating from a Followers or Private review is added to the restaurant's average score and rating count, which everyone can see, without your name. Its text, photos, dishes, date and the people you tagged stay visible only to the people your setting allows. We collect and store private reviews like any other, so we can show them to you, keep restaurant scores accurate, and delete them when you ask.
Your profile, your username, and who you follow are visible to other signed-in users. If you block someone, you disappear from each other's app and any follow between you is removed immediately.
Who we share it with
We use a small number of service providers to run the app. They process data on our behalf, under their own security obligations, and only for these purposes:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in, and photo storage | Sydney, Australia |
| PostHog | Usage analytics (only if you leave it on) | United States |
| Geoapify | Restaurant search. Your search text and approximate area are sent to find matches | European Union |
| Google Maps | Drawing the map. Google receives the map area being shown so it can send the map; it isn't sent your reviews or account | United States |
| Expo (EAS) | Delivering the app and its updates, and passing notifications to Apple and Google | United States |
| Sentry | Crash and error reports | European Union (Germany) |
| Apple Push Notification service and Google Firebase Cloud Messaging | Delivering notifications to your phone | United States |
| Apple and Google Play | Distributing the app. Their own privacy policies cover what their stores collect | United States |
| Resend | Sending your sign-in emails | United States |
Some of these are outside Australia, which means your information may be stored or processed overseas. We'd also disclose information if we were legally required to, or where it's genuinely necessary to protect someone's safety.
Your photos
Photos you attach to a review are stored in private storage. They are not publicly browsable and cannot be reached by guessing a URL. The app requests a short-lived signed link each time it needs to display one, and only for people your visibility setting allows.
If you choose to share a review as a picture to Instagram or another app, Tasted saves that picture to your photo library so the other app can post it. It stays on your phone; we don't receive it.
Turning analytics off
Open Settings in the app and switch analytics off. It takes effect immediately and stays off. The app works exactly the same with it off; we simply see less about how it's being used. Crash and error reports are separate: they contain no email address or IP address, and they stay on because they are how we find bugs.
Deleting your account
Open Settings → Delete account. This is permanent and immediate. It removes your profile, every review and list you made, your photos (the actual image files, not just the records of them), your follows, and your sign-in. It cannot be undone and we cannot restore it for you.
Messages you sent in a chat stay for the other people in that chat, but they are no longer linked to you and show as sent by a deleted account. Plans you created are deleted.
One thing survives: if you added a restaurant that wasn't in our database, the restaurant itself stays, because other people's reviews may point at it. It is no longer attributed to you.
How long we keep things
Your content stays until you delete it or delete your account. Reports are kept after they're resolved so there's a record of what was decided. Analytics are retained by PostHog under their standard retention.
Your rights
You can see and correct most of your information directly in the app: your profile, your reviews, your lists. Under Australian privacy law you can also ask us for a copy of the personal information we hold about you, ask us to correct it, or complain about how we've handled it. Email us and we'll respond within a reasonable time.
If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Children
Tasted is for people 16 and over, and we don't knowingly collect information from them. If you believe a child has an account, email us and we'll remove it.
Security, honestly stated
Access to your data is enforced at the database level, so the rules about who can read what don't depend on the app behaving correctly. Photos are in private storage behind signed links. That said, no service can promise perfect security, and we won't pretend otherwise. If a breach ever affects you we'll tell you and notify the OAIC as the law requires.
Changes
If we change this policy we'll update the date at the top. If a change materially affects how your information is used, we'll tell you in the app rather than quietly editing this page.
Contact
Questions, requests, or complaints: [email protected]