Privacy

Plain-language draft. Not reviewed by a lawyer — see the note on the legal overview.

What is collected

• Account. Email address, display name, handle, and optionally a city and a short bio.
• Orders. What you ordered, from whom, the amount, the pickup code, and the times the order changed state.
• Reviews. Your rating, review text, any photo you attach, and your answer to the sourcing question.
• Consent records. Each time you accept the three order acknowledgments, Dishd stores which statement you accepted, the document version, the time, your IP address and your browser user-agent string. This is the evidence that the disclosure was actually made, which is the point of recording it per order rather than once at sign-up.
• Cook-side records. If you sell, this includes your kitchen address, permit status, and the sourcing receipts you upload.

What is public

Your handle, display name, city, bio, avatar, and your reviews with any photos — along with the kitchens you have eaten at, which is the point of a public meal diary. Assume anything on your profile page can be read by anyone, including people who are not signed in.

For a kitchen: its name, neighbourhood, menu, badges, credibility score and full score breakdown, and its review history. If a kitchen is removed, that fact and its reason stay public permanently.

What is deliberately not shown

• Exact kitchen addresses. Held in a separate table and released only to the kitchen’s owner and to a buyer whose order has been accepted. This is enforced in the database, so a bug in a page cannot leak one.
• Sourcing receipts. A receipt is a cook’s purchase record. Stored in a private bucket, readable by the cook who uploaded it and by a reviewer.
• Email addresses and pickup codes. Never shown on a public page.

Who else touches your data

Dishd runs on Supabase, which hosts the database, authentication and file storage. Uploaded review photos are served from a public URL, so anyone holding that link can view the image — do not upload a photo you would not put on a public page.

Dishd does not sell personal data and does not run advertising.

Keeping and deleting

Deleting your account removes your profile and, with it, your reviews and diary. Two things are kept on purpose: consent records, which exist precisely to show a disclosure was made and would be worthless if the person could erase them, and the public record of a kitchen removed for cause.

Depending on where you live you may have rights to access, correct, export or delete your data, and to object to some processing. To ask for any of these, or about anything on this page, contact the operator of this Dishd deployment.