This is an honest summary of current behaviour — not a law-firm policy. If anything here is unclear, see Contact.
Account
If you register, we store your email, optional display name, and a hashed password. We also store the places you save, mark as been, or pass, plus any reviews or dish notes you submit.
Cookies & similar storage
When you first visit, we ask for your consent before setting anything non-essential. You can change your choice anytime via Cookie settings in the footer. We do not use advertising or marketing trackers.
- Strictly necessary: the sign-in session cookie
localbite_token(HTTP-only, Secure in production, SameSite=Lax, 14 days) and a record of your cookie choice in local storage. These are required for accounts and to remember what you consented to. - Analytics (optional): Vercel Web Analytics plus anonymous page-view counts on our servers. If you accept analytics, we may store a random anonymous ID and how you arrived (e.g. a newsletter link) in local storage so repeat visits are counted consistently. Legal basis: consent.
- Functional preferences (optional): your browse start area, post-signup return path, and recent surprise picks on this device. Legal basis: consent.
If you reject non-essential storage, the site still works — you can browse the catalogue and sign in. We simply skip analytics and do not persist those optional preferences on your device.
Session cookie
After you sign in, the site sets an HTTP-only cookie named localbite_token so you stay signed in. It is marked Secure in production, SameSite=Lax, and lasts 14 days. It is not used for advertising.
Contact form
If you write in via the contact form, we collect your name, email, and message so we can reply. That inquiry is emailed to the founder and is not used for marketing or shared with advertisers. Delivery currently goes through FormSubmit from your browser (or Resend, if we have configured it). Those providers see the same name, email, and message you send.
Weekly email
If you tick the box when you register, or later on Your places, we send a short weekly email with three places. That is optional. We do not add you automatically. Every email includes an unsubscribe link, and you can turn it off anytime. Delivery goes through Resend, who sees your email address in order to send the issue.
Location
Browse can ask the browser for your location so we can sort by nearest and estimate walk times. Coordinates are sent to our API only for that request — we do not track you in the background or store a location history.
Site analytics
With your consent, we use Vercel Web Analytics and first-party page-view events stored in our database to see which pages are useful. Vercel processes their analytics as our host; we do not use either for advertising. You can withdraw consent via Cookie settings in the footer.
Where it runs
The website is hosted on Vercel. The API and Postgres database are hosted on Railway. Venue maps use OpenStreetMap tiles.
What we don't do
We don't sell your data, show sponsored listings, or share accounts with advertisers. Reviews and saved places stay inside LocalBite.