Privacy Policy
Last updated: August 12, 2026
This Privacy Notice for Nomby (“we,” “us,” or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:
- Visit our website at https://www.nomby.app or any website of ours that links to this Privacy Notice
- Download and use our mobile application (Nomby), or any other application of ours that links to this Privacy Notice
- Use Nomby — a mobile application that provides restaurant recommendations based on food preferences and helps you find places with friends
- Engage with us in other related ways, including waitlist signup or support
Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. Questions or concerns? Contact us at nomby.app@gmail.com.
Summary of key points
This summary highlights key points from our Privacy Notice. Use the table of contents below for full details.
- What personal information do we process? Information you provide (account, preferences, reviews, photos) and information collected automatically or with permission (location, contacts, device data, analytics).
- Do we process sensitive personal information? We do not intentionally collect special-category sensitive data. Dietary preference tags you choose may reflect food restrictions you decide to share.
- Do we collect information from third parties? Primarily from identity providers (Apple, Google) when you sign in, and from mapping/geocoding providers when you use location features. We do not buy marketing lists for targeted advertising.
- How do we process your information? To provide and improve Nomby, personalize recommendations, enable social features, communicate with you, secure the Services, and comply with law.
- How do we keep your information safe? We use reasonable organizational and technical measures, but no system is 100% secure.
- What are your rights? Depending on where you live (including Canada), you may have rights to access, correct, or delete personal information. See sections 11 and 15.
Table of contents
- 1. What information do we collect?
- 2. How do we process your information?
- 3. What legal bases do we rely on?
- 4. When and with whom do we share information?
- 5. Do we use cookies and other tracking technologies?
- 6. Do we offer recommendation features?
- 7. How do we handle social logins?
- 8. How long do we keep your information?
- 9. How do we keep your information safe?
- 10. Do we collect information from minors?
- 11. What are your privacy rights?
- 12. Controls for Do-Not-Track features
- 13. Do we make updates to this notice?
- 14. How can you contact us about this notice?
- 15. How can you review, update, or delete your data?
1. What information do we collect?
Personal information you disclose to us
In short: We collect personal information that you provide to us.
We collect personal information you voluntarily provide when you register, join the waitlist, participate in features on the Services, or contact us.
Personal information provided by you may include:
- Email address (including email OTP sign-in)
- Apple Sign-In identity (email and/or name; may use Apple private relay email)
- Google Sign-In identity (name/email as provided by Google)
- Display name / username
- Profile avatar photo (optional)
- Account timestamps (created, last login)
- Cuisine, dish, and dietary preference tags
- Saved restaurants and saved locations (name, address, coordinates)
- Friend relationships and friend requests
- Guest / mock diner profiles you create for group recommendations
- Reviews: star ratings, text, photos, and timestamps
- Recommendation session inputs (who is dining, vibe, effort, price, radius, open-now)
- Waitlist email if you join on nomby.app
- Support messages you send us
Sensitive information. We do not intentionally process special-category sensitive information. If you voluntarily add dietary or allergy preference tags, you choose what to share and grant explicit consent for Nomby to process those tags solely to filter and personalize restaurant recommendations.
Application data and permissions
If you use our application(s), we may collect the following if you choose to provide access or permission:
- Geolocation. We may request access to location-based information from your device while you use location features (such as nearby search and recommendations). You can change this in your device settings. Denying location may limit those features.
- Photo library. We may request access to your photo library so you can set a profile avatar or attach photos to reviews.
Information automatically collected
In short: Some information — such as IP address and device/browser characteristics — is collected automatically when you visit our Services.
We automatically collect certain technical information when you visit, use, or navigate the Services. This is primarily needed to maintain security and operation, and for analytics and troubleshooting. On the website, this includes analytics via PostHog and Vercel Analytics (page views, approximate session length, device/browser type, referrer/UTM info, general click/scroll patterns such as heatmaps, and anonymous identifiers). In the mobile app, PostHog collects app lifecycle events, manual screen names, limited touch metadata from marked controls, diagnostic exceptions, and a Supabase user UUID after sign-in. We do not send raw email or OTP values, location, dietary preferences, friend IDs, review text, or recommendation payloads to app analytics. We do not use session recordings on the website or in the app.
The information we collect may include:
- Log and usage data — IP address, device information, browser type, timestamps, pages/features used, and diagnostic information
- Device data — device model, operating system, app or browser identifiers, and similar technical details
- Location data — precise or approximate location when you grant permission, or approximate location inferred from IP for website analytics. Location used for app recommendations is not included in PostHog app analytics.
Information from other sources
In short: We may receive limited information from service providers needed to run Nomby.
- Apple and Google — profile/identity details when you use Sign in with Apple or Google
- Maps and geocoding providers — address and coordinate results when you search or reverse-geocode (for example OpenStreetMap/Nominatim, Photon, and related map tile providers)
- Restaurant catalog data — our restaurant database may include fields derived from third-party sources (including Google-derived place metadata such as names, ratings, or maps URLs stored in our catalog). That is restaurant information, not a live feed of your personal Google account data.
We do not purchase marketing lists from data brokers for targeted advertising, and we do not run third-party advertising networks on Nomby today.
2. How do we process your information?
In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We may process your personal information to:
- Facilitate account creation, authentication, and account management
- Deliver restaurant recommendations and related product features
- Enable friends, reviews, photos, saved places, and group dining features
- Respond to inquiries and provide support
- Operate the waitlist and send launch or service-related communications
- Evaluate and improve the Services (including website and app analytics)
- Protect security, prevent abuse, and comply with legal obligations
3. What legal bases do we rely on to process your personal information?
In short: We only process personal information when we believe it is necessary and we have a valid reason under applicable law (for example consent, to provide the Services, or legitimate interests consistent with Canadian privacy expectations).
We may process your information if you have given permission (express or, where allowed, implied consent). You can withdraw consent by contacting us (see section 14), subject to legal limits. In some cases, applicable Canadian law may permit processing without consent (for example fraud prevention, legal requirements, or other enumerated exceptions).
6. Do we offer recommendation features?
In short: Nomby provides restaurant recommendation features based on preferences, group inputs, and available restaurant data.
We process preference tags, dining-session inputs, and (when permitted) location to score and suggest restaurants. These features are product recommendation tools. We do not currently send your personal preference data to a third-party large language model as part of the live recommendation path. If that changes, we will update this Privacy Notice.
8. How long do we keep your information?
In short: We keep personal information while your account is active and as needed to provide the Services, unless a longer period is required or permitted by law.
When you delete your account, we delete or anonymize associated personal data from our active systems as described in our deletion process, subject to short-lived backups and any information we must retain for security, fraud prevention, troubleshooting, or legal compliance. Automated encrypted database backups rotate out and clear within 30 days.
9. How do we keep your information safe?
In short: We aim to protect personal information with reasonable organizational and technical measures.
No electronic transmission or storage system can be guaranteed 100% secure. Transmission of personal information to and from the Services is at your own risk. Use the Services in a secure environment when possible.
10. Do we collect information from minors?
In short: We do not knowingly collect personal information from children under 13.
Nomby is intended for users who are at least 13 years old. By using the Services, you represent that you are at least 13. We do not knowingly collect, solicit, or market to children under 13. If we learn that we have collected personal information from a child under 13, we will deactivate the account and take reasonable steps to delete the data. If you believe we may have collected information from a child under 13, contact nomby.app@gmail.com.
11. What are your privacy rights?
In short: In regions such as Canada, you may have rights to access and control your personal information.
Depending on applicable law, these may include rights to request access to or a copy of your personal information, request correction or deletion, and withdraw consent where consent is the basis for processing. We will consider requests in accordance with applicable law.
Account information. You can review or update certain profile information in the Nomby app. To terminate your account, use Profile → Delete account in the app, or follow nomby.app/delete-account.
Permissions. You can revoke location and photo permissions in your device settings.
12. Controls for Do-Not-Track features
Most browsers include a Do-Not-Track (“DNT”) setting. There is no uniform standard for recognizing DNT signals. We do not currently respond to DNT browser signals. If a standard that we must follow is adopted, we will update this Privacy Notice.
13. Do we make updates to this notice?
In short: Yes, we will update this notice as needed.
The updated version will be indicated by an updated “Last updated” date. If we make material changes, we may post a notice or notify you. Review this Privacy Notice periodically.
14. How can you contact us about this notice?
Questions or comments about this notice: email nomby.app@gmail.com.
15. How can you review, update, or delete the data we collect from you?
Based on the laws that apply to you, you may have the right to request access to, correction of, or deletion of personal information we hold about you. To make a request, email nomby.app@gmail.com, or delete your Nomby account via the app or nomby.app/delete-account.
7. How do we handle your social logins?
In short: If you register or log in with Apple or Google, we may receive certain profile information from that provider.
Nomby offers Sign in with Apple and Google Sign-In (not Facebook or X). The profile information we receive depends on the provider and your choices (often name and email, and for Apple, possibly a private relay email). We use this information to create and manage your account as described in this Privacy Notice. We do not control how Apple or Google process your information — review their privacy notices as well.