Privacy

1. Data used for comments and replies

When you submit a comment or reply, your nickname, rating, text, relevant menu and submission time are stored. Published nicknames, ratings and text can be seen by other visitors.

A device identifier, IP address, browser, operating system, screen resolution, pixel ratio and viewport size information, language and page address may also be processed to prevent abuse, investigate technical problems and handle valid legal requests. Your review device identifier helps retrieve and update your own rating.

Technical audit metadata is stored separately from comments, encrypted and with restricted access. Access requires administrator authentication, a separate passphrase and a reason, and is logged. Technical audit records have a retention period of 180 days. Comments and replies can be managed or removed separately.

The accepted privacy version and acceptance time are also recorded. Comments and replies may be sent to authorized administrators for moderation. Data is not sold for advertising; necessary records may be disclosed to competent authorities when legally required.

You must accept the current privacy notice before posting a comment or reply. Acceptance is remembered on this device so you are not asked each time; a substantial change to the notice may require renewed acceptance.

2. Preferences stored only on your device

Theme, language, dining display, sharing format and the offline menu cache are stored in your browser. These preference records are not synchronized to our servers. We do not access other files or browser data on your device. Clearing browser data may reset these settings.

Your nickname and comment acceptance can also be remembered for convenience. When you submit a comment, the nickname, device identifier and acceptance information sent with it are part of the processing described in section one. If you enable notifications, the subscription information needed to deliver them is also used.

3. Anonymous Umami visitor statistics

To assess page experience, only the good, needs-improvement or poor rating buckets for LCP, INP and CLS are counted as anonymous events. No identity, form contents, DOM attribution or metric session IDs are attached to performance events. The browser's tracking preference is respected.

Umami automatically collects anonymized usage statistics during visits. These include visit counts, viewed pages, referring sites, browser and operating system, device type, country-level location and counts of basic interactions such as sharing or refreshing a menu.

Statistics are reviewed in aggregate to understand usage, assess performance and improve the service. Analytics are not linked to your comments or nickname. Comment text, form contents, subscription identifiers and locally stored preference values are not added to analytics events.

Umami tracking does not use tracking cookies. Short UTM source, medium, campaign, content, term and campaign ID fields are included. Other URL query fields, fragments, session screens and form input are not recorded.

For AI-referred visits we also measure entry and viewed pages, source, approximate active time, scroll depth and limited button/link click counts. A random session code is held only in the browser tab and starts afresh after 30 minutes of inactivity. This measurement does not store IP addresses, raw User-Agents, account details or private AI conversations.

4. Request deletion of my data

No account is required. “Delete my data” opens the Data deletion request option in Feedback. Use the app or browser that submitted your comment. The server matches the existing device identifier to ratings, comments and replies. On a shared device, describe only your own records.

Try to submit from the same device, browser and network. Explain which comment/message you want deleted and why. Providing the browser, operating system and screen resolution used for the original comment can speed up review.

The current review device identifier, IP, browser, operating system, language, screen resolution, pixel ratio, viewport size and page address are collected and compared on the server with earlier records. Sensitive verification information is encrypted and can only be opened by the app owner using the existing extra access password and an access reason. Password attempts are logged. Older records may lack screen information. IP, browser or screen similarity alone does not prove ownership. Verification information is excluded from analytics events.

If browser data was cleared or another device is used, matching may fail. Describe the date, nickname, meal and remembered text for further verification. Do not send identity documents or passwords. Contact details are optional: use the private tracking key stored in this browser to check request status. All correspondence takes place on Telegram. Clearing browser data can remove this access.

Your request, description and messages are saved in the admin panel and sent to the app owner through Telegram. After saving, you can open a private Telegram link and start the bot to associate your chat ID with this request. Admin replies arrive in the linked Telegram chat. User messages from Telegram reach the panel and owner. Links expire after 30 minutes and must be kept private. Notifications do not include technical IP/device identifiers. Failed delivery is retried.

The owner can see ratings, comments and replies linked to this device ID and delete only selected records. On shared devices, describe only your own records. Unselected replies are preserved; the parent comment may be anonymized and unpublished. Technical records of selected content and nickname/comment copies in earlier admin logs are removed. Changed records require reloading before deletion. Submitting or closing a request never implicitly deletes all records. Other-device records, older feedback and notification subscriptions require separate review; describe them in the request.

Open requests are kept during review. On closure, encrypted proof, device/IP matching fields and separate contact details are removed. The description, correspondence, linked Telegram chat ID and processing/tracking information are retained for 180 days after closure, then deleted. Copies in Telegram are managed separately there. Clear local preferences and offline cache in device settings. Anonymous aggregate statistics cannot be linked to a person.