Privacy Policy

MunchMeter is a dish-first rating community at munchmeter.app. We have not published a separate registered legal entity or postal address. Privacy questions and requests go to support@munchmeter.app.

We act as the controller of personal information we collect to operate the Service. Processors that handle data for us are listed under When we share information.

Account and profile

• Google sign-in details: email address, name, profile photo URL, and email-verification status Google provides.
• The public handle you choose or that we generate, plus optional real name, bio, and avatar URL.
• Role (member, editor, or administrator) and account timestamps.

Content you create

• Dish ratings (1–5), optional review text and price, and optional per-rating visibility.
• Review photos (JPEG bytes after we strip embedded metadata).
• Comments, helpful votes, favorites, to-try lists, and reports you file about reviews or photos.

Social and access

• Friend requests sent by email, accept/decline/cancel actions, and confirmed friendships.
• Per-field visibility settings (profile, name, avatar, bio, reviews, photos, stats, friends, favorites, to-try).
• Connected-app grants if you approve an MCP client, including client name, scopes, and token records.

Technical and support

• Authentication session cookies issued by our sign-in provider.
• A theme preference stored in your browser as local storage key __PREFERRED_THEME__, or your system light/dark setting if you have not chosen one.
• Server logs and security signals created by our host when you request pages or APIs (typically IP address, user agent, and request metadata).
• Messages you send to support, and export-job status if you request a copy of your data.

We do not run advertising pixels or a first-party analytics SDK in the application. Our hosting provider may process request logs to operate and secure the network.

We do not collect payment card numbers. The Service is free.

We use personal information to:

• Create and maintain your account and keep you signed in.
• Show ratings, profiles, maps, and search results according to each owner’s visibility settings.
• Process friend invitations, comments, votes, favorites, to-try lists, and reports.
• Store and serve review photos after an access check, and to strip location and camera metadata from uploads.
• Send transactional email, such as telling you a data export is ready or that it failed.
• Honor connected-app grants you approve, and to let you or an administrator revoke them.
• Moderate content, enforce the Terms of Service, prevent abuse, and comply with law.
• Improve reliability and fix defects in the Service.

Where a legal basis is required, we rely on performing our contract with you (providing the Service), our legitimate interests in operating and securing a community site, your consent for optional connections such as MCP, and legal obligations such as responding to a valid request or keeping a hashed deletion record.

Your handle is always public in places where a rating is attributed. Everything else on your profile uses an audience ladder: Anyone, Members, Friends, or Only me.

Unless you change them, new accounts start with:

• Profile visible to signed-in members.
• Real name, avatar, bio, stats, and friends list: friends.
• Reviews and review photos: anyone.
• Favorites and to-try lists: only you.

A photo cannot be shown more widely than its review. If someone cannot pass your profile gate, the profile is treated as not found. You can preview how your profile looks to the public, members, or friends with View As; that preview can only narrow what you see, never widen it.

Even when review text or photos are hidden, your handle and star rating can remain visible so restaurant averages stay stable.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share information in these situations:

• Other people on the Service. Members and visitors see what your visibility settings allow. People you invite by email receive a join message that names you and can become friends when they sign in from that invite link.
• Google. Sign-in uses Google OAuth. Maps, place search, and restaurant import send queries from your browser to Google using our Maps key. Place records we store (name, address, coordinates, Google place id) become shared catalog data.
• Cloudflare. We host the site on Cloudflare Pages and store application data in Cloudflare D1, review photos and export archives in R2, and export jobs on Cloudflare Queues and Workers.
• Resend. If configured, Resend delivers transactional email such as export-ready notices to the address on your account, and join invites to addresses you type on the Friends page.
• Gravatar. We may construct a Gravatar URL from a hash of your email as an avatar fallback. Loading that image, if it happens in your browser, is a request to Gravatar.
• Connected apps you authorize. See Connected apps below.
• Law and safety. We may disclose information if we believe it is required by law, to protect members or the Service, or to defend legal claims.
• Business transfer. If the Service is transferred, personal information may move with it under this policy or a successor policy we notify you about.

When administrators enable it, you can connect hosted assistants such as Claude or ChatGPT through our MCP interface. After you approve a consent screen, that client can read restaurants, ratings, and profiles you are already allowed to see. User connectors cannot post reviews or change your friends. You can revoke a grant; tokens stop working immediately. Administrators can disable MCP for everyone or for a single user.

A connected app is an independent controller for data after it leaves our Service. Review that app’s privacy policy before you approve access.

We use cookies that are required to keep you signed in (session cookies from our authentication library). We do not use advertising cookies.

Appearance (light or dark) is stored in your browser’s local storage, not in our database. Clearing site data signs you out and forgets that preference.

Review photos are stored as JPEGs in private object storage and served only through our application after we check that the viewer is allowed to see them. We strip EXIF, XMP, and similar metadata on upload so camera and GPS tags are not kept.

Photos follow the review’s audience and cannot outrank it. Deleting a photo or your account removes the stored image files we still control. Deleting a rating removes the review record; leftover photo files may remain until you delete those photos, delete the account, or we clean them up.

We keep account and content data until you delete it or delete your account, unless we must keep a record longer for security, moderation, or law.

• Data-export zip files are deleted about 7 days after they are ready.
• MCP access tokens expire (access tokens in about an hour; refresh tokens in about 30 days) and can be revoked sooner.
• After account deletion we keep a hashed ledger row (hashes of user id and email, actor, and time). It cannot restore the account.
• Shared restaurant and dish catalog records stay; they are not your personal account.
• Banned accounts remain stored, with content hidden from public views, until an administrator lifts the ban or the account is deleted.

Signed-in members can request a machine-readable copy of their data from Settings → Privacy → Your data. We queue a job, build a zip archive, and email a link to Settings when it is ready. The download requires your signed-in session. The file is removed after 7 days.

The archive includes your profile, privacy settings, connected sign-in accounts, ratings and photo records, likes, comments, votes, reports, favorites, to-try lists, friends, and friend requests. Other people appear as an id and handle only.

You have the right to delete your personal information. To delete your account and the personal data attached to it, sign in and open Settings → Account, then type your email to confirm. This immediately erases your profile, reviews, photos, comments, likes, friends, favorites, to-try lists, sessions, and connected apps. Shared restaurant listings stay. We keep a hashed record that the deletion happened so we can show we honored the request; it cannot restore your account.

If you cannot use self-service, contact us at support@munchmeter.app and we will complete the same erasure. The last remaining administrator cannot self-delete until another administrator is appointed. Accounts with no email must use support.

Depending on where you live, you may have the right to access, correct, delete, or export personal information, to object to or restrict certain processing, and to withdraw consent for optional features such as connected apps. You can do much of this yourself:

• Correct profile fields in Settings or profile editing.
• Change visibility on Settings → Privacy.
• Download a copy from Settings → Privacy → Your data.
• Delete ratings, photos, favorites, and to-try items you created, or delete the account. Comments are removed with the rating they sit on or with the account; there is no separate self-service comment delete.
• Revoke connected apps from Settings → MCP.

If you cannot use those tools, email support@munchmeter.app. We may need to verify that the request comes from the account holder. If we refuse a request where the law lets us, we will say why.

If you are a California resident, we do not sell or share personal information as those words are used in the CCPA/CPRA. You may ask us what categories we collected and for a copy, deletion, or correction. We will not deny the Service for exercising those rights. We do not use sensitive personal information to infer characteristics. We do not currently process information in a way that we treat as automated decision-making with legal effects.

If European or United Kingdom data-protection law applies to you, you may also lodge a complaint with your supervisory authority. We have not appointed a separate EU or UK representative. Contact us at support@munchmeter.app.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 created an account, contact support@munchmeter.app and we will delete it. If a higher age of digital consent applies where you live, we do not knowingly collect information from anyone under that age either.

We host the Service on Cloudflare’s global network. Personal information may be processed in the United States and in other countries where Cloudflare or our other processors operate. Those places may have different data-protection laws than your home. Where a transfer mechanism is required, we rely on the processors’ published terms and standard contractual clauses or equivalent safeguards they offer.

We use signed-in sessions, access checks on photos and exports, hashed tokens for connected apps, and our host’s network controls. No method of transmission or storage is completely secure. You can reduce risk by using a locked Google account and by revoking apps you no longer use.

We may update this Privacy Policy by posting a new version on this page and changing the “Last updated” date. For material changes we will try to give reasonable notice in the Service or by email. The updated policy applies to information we already have and to information we collect after the effective date, unless the law requires otherwise.

Privacy questions, access requests, and deletion requests: support@munchmeter.app.