Privacy Policy
Effective October 27, 2026
1. Overview
This policy explains what Foodio (Matthew Lee, "we") collects, why, and your choices. We don't sell your personal information, and we don't show ads or use tracking today.
2. What we collect
- Account details you give us: email address, password (stored only as a one-way encrypted hash; we can't see it), username, first and last name, birthday and country, and optionally your sex.
- Profile: profile picture, bio and link. These are public.
- What you post and do: meals (photo, title, description, Foodio Score, meal, price, date, the restaurant name and address you type in, items, ingredients and recipes), comments and replies, likes on meals and comments, follows and follow requests, blocks, reports, and your settings (notification choices, private account, feed preference).
- Contacts, only if you use Find Friends and allow access: we send the email addresses in your phone's contacts to our server to find matching Foodio accounts. We don't store those email addresses; we only keep a count of lookups to prevent abuse.
- Technical data: like most online services, our hosting provider records technical logs (such as IP address, device and request times) for security and to keep the service running.
- We don't collect your precise location, phone number, payment details, or anything from other apps.
3. How we use it
- To run Foodio: your account, showing your meals to the right people, notifications and finding friends.
- To keep Foodio safe: enforcing age limits, reviewing reports, and handling suspensions and blocks.
- To respond when you contact us, and to tell you about important changes.
4. Who can see what
- Your username, name, profile picture, bio, link, follower counts and lists, and your meals and comments are visible on Foodio according to your settings. If your account is public, anyone on Foodio can see them. If it's private, only your approved followers can see your meals and follower lists, but your username, name, picture, bio and counts are still visible.
- Your email, birthday, sex and country are never shown to other users.
- Meal photos are only shown to people allowed to see the meal, through links that expire.
5. Who we share it with
We use service providers that process data on our behalf: Supabase (database, login and photo storage, hosted on Amazon Web Services), Resend (sends account emails such as sign-up and password reset codes, so it receives your email address), Cloudflare (hosts our website) and Apple (app distribution). We share information if the law requires it, to protect people's safety, or as part of a sale or merger of Foodio (with this policy continuing to apply). We'll update this policy before adding new providers, such as ads.
6. How long we keep it
We keep your information while your account exists. When you delete your account, it's deleted straight away from our live systems, and any backup copies are removed within 30 days. Deleted meals and comments are removed straight away. Reports you made are deleted with your account; reports about meals, comments or accounts are kept for up to 1 year so we can spot repeated abuse, then deleted.
7. Your choices and rights
- Edit your profile and private details in Edit profile.
- Make your account private, block people, and choose your notifications in Settings.
- Delete your account in Settings > Account.
- Ask us for a copy of your data, or ask any question, at foodioapp.support@gmail.com.
Depending on where you live (for example California, or the EU and UK), you may have rights to access, correct, delete or port your data, and to object to or limit some uses. You can use them by emailing us, and we won't treat you differently for doing so. If you're in the EU or UK, we process your data to provide the service you signed up for (contract), to keep Foodio safe (legitimate interests), and with your consent for contacts access. You can complain to your local data protection authority.
8. Children
Foodio isn't for anyone under 16, and sign-up requires a birthday showing you're at least 16. If we learn an account belongs to someone younger, we'll delete it.
9. Security
Data is encrypted in transit, and access is restricted by database rules so people only see what they're allowed to. No system is perfectly secure.
10. International users
Your data may be stored and processed in the United States or other countries where our providers operate.
11. Changes
We'll post updates here and tell you in the app about significant changes.