Privacy Policy

NextBite ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our dining recommendation service (the "Service").

This policy is designed to comply with the General Data Protection Regulation (GDPR) for users in the European Union and the California Consumer Privacy Act (CCPA) for California residents.

By using the Service, you agree to the collection and use of information in accordance with this policy.

2.1 Information You Provide

• Account information: When you sign up via Clerk, we receive your name, email address, and profile picture (if using social login such as Google).
• Meal logs: Cuisine type, meal type (lunch/dinner), and optionally the restaurant name when you log meals or accept recommendations.
• Preferences: Cuisine vetoes, unit preferences (miles/km), and search radius settings.
• Location data: Zip code or geographic coordinates you provide for restaurant searches. We do not use background location tracking.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, timestamps, and interaction patterns (e.g., swipe accept/reject actions).
• Device information: Browser type, operating system, screen resolution, and device identifiers (collected via standard HTTP headers).
• Error data: If Sentry error tracking is enabled, we collect crash reports, stack traces, and browser context to diagnose and fix bugs. This data is anonymized where possible.

2.3 Information from Third Parties

• Clerk: Authentication provider that manages your login credentials and session tokens. Clerk may provide us with your email and profile data from your social login provider.
• Google Maps: Restaurant data including names, addresses, ratings, photos, opening hours, and place types. This data is fetched client-side and is not permanently stored on our servers.

We use the information we collect to:

• Provide recommendations: Your meal history and vetoes feed our scoring algorithm to suggest restaurants you are more likely to enjoy.
• Personalize your experience: Remember your preferences, location, and unit settings across sessions.
• Improve the Service: Analyze usage patterns to enhance our recommendation algorithm and user experience.
• Maintain security: Detect and prevent fraud, abuse, and unauthorized access.
• Diagnose issues: Use error tracking data to identify and fix bugs.
• Communicate with you: Send service-related notifications (e.g., account verification, security alerts). We do not send marketing emails.

We do not sell your personal data to third parties. We do not use your data for advertising or ad targeting.

For users in the European Economic Area, we process your data under the following legal bases:

• Contract performance: Processing necessary to provide the Service you signed up for (meal logging, recommendations).
• Legitimate interests: Improving our Service, ensuring security, and diagnosing technical issues.
• Consent: Where required (e.g., optional error tracking via Sentry), we rely on your explicit consent.

We retain your data for as long as your account is active. Specifically:

• Account data: Retained until you delete your account.
• Meal history: Retained for the lifetime of your account to power recommendations. You can delete individual entries or all history at any time.
• Cuisine vetoes: Retained until you remove them or delete your account.
• Error logs (Sentry): Automatically purged after 90 days.
• Server logs (Cloudflare): Retained per Cloudflare's standard retention policy (typically 72 hours for access logs).

When you delete your account, we delete all associated personal data within 30 days, except where retention is required by law.

NextBite uses the following storage mechanisms:

• Authentication cookies: Set by Clerk to maintain your login session. These are strictly necessary for the Service to function.
• Local storage: Used to save your unit preference (miles/km) and last-used zip code for convenience. This data stays on your device and is not sent to our servers.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies.

We use the following third-party services that may process your data:

You have the following rights regarding your personal data. These rights apply under both GDPR (EU residents) and CCPA (California residents):

To exercise any of these rights, contact us at privacy@nextbite.app. We will respond within 30 days (or sooner where required by law).

We take reasonable measures to protect your personal data, including:

• All data in transit is encrypted via HTTPS/TLS
• Authentication is handled by Clerk with industry-standard security practices
• Database access is restricted to authenticated API routes
• API routes validate user identity via Clerk JWT tokens
• No plaintext passwords are stored (authentication is delegated to Clerk)

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

The Service is not directed to children under 13 (or 16 in the EU). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us at privacy@nextbite.app and we will promptly delete it.

Your data may be processed in countries other than your country of residence, including the United States, where Cloudflare and other service providers operate. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), when transferring data outside the European Economic Area.

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

If we make material changes that affect how we process your personal data, we will provide additional notice (such as an in-app notification).

If you have any questions about this Privacy Policy, your data, or wish to exercise your rights, please contact us:

If you are a California resident, the following additional disclosures apply under the California Consumer Privacy Act:

• Categories of personal information collected: Identifiers (name, email), geolocation data (zip code, coordinates), internet activity (usage data), and inferences (cuisine preferences).
• Business purpose: All data is collected solely to provide and improve the Service.
• Sale of data: We do not sell your personal information.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.