Privacy Policy

1. Who we are

NoshWay (the "app") is operated by LocafyLab Ltd, registered in England & Wales. For any privacy question or data request, email james@locafylab.com.

2. What data we collect

Account information

When you sign in with Apple or Google, we receive a unique user ID, an email address, and (if you permit it) your name. We use this only to identify your account across devices and to email you about account matters. We never sell or rent it. If you sign in with Apple's "Hide My Email" option, we only ever see Apple's relay address.

Content you create

• Reviews and photos you post are stored on our servers (database hosted on Supabase, photos hosted on Cloudflare Images). They are visible inside the app to other users.
• Saved places and trip itineraries are stored on your device and, if you're signed in, synced to our servers so they follow you across devices.
• Preferences (dietary restrictions, cuisines, budget, vibe tags) are stored on your device and used to personalise recommendations. They are not shared.

Location

If you grant location permission, we use your current coordinates to show nearby restaurants and compute walking distances. Your coordinates are processed in-app and sent to our server only when you make a request that needs them (e.g. "near me" search). We do not log your location history.

AI search prompts

When you use the AI advisor (e.g. "quiet cafe near Soho"), the text of your prompt is sent to our server and forwarded to a third-party large-language-model provider (currently MiniMax) to generate the recommendation. We log prompts in aggregate to monitor quality and debug failures. We do not associate prompts with your account beyond the duration of the request.

Technical data

Our servers automatically log standard request metadata (timestamp, request path, IP address, user-agent) for security and debugging. These logs are retained for up to 30 days.

What we do NOT collect

• We do not use third-party analytics SDKs (no Google Analytics, no Facebook SDK, no Mixpanel, etc.) inside the app.
• We do not use advertising trackers.
• We do not access your contacts, photos library, microphone, or calendar.
• We do not collect health, financial, or payment information (the app is free).

3. How we use your data

• To run the app: sign you in, show personalised restaurant recommendations, sync your saved places and trips across your devices.
• To respond to support emails you send us.
• To investigate bugs and improve the app's quality.
• To comply with legal obligations if we ever receive a valid request.

We do not use your data to build advertising profiles, and we do not sell it.

4. Who we share data with

We share data only with the service providers we depend on to run the app:

• Supabase (Postgres database, EU region) — stores accounts, reviews, trips.
• Cloudflare — image CDN for review photos and place covers.
• Vercel — hosts our API and website.
• Apple and Google — sign-in providers; they see only what their SDKs require.
• MiniMax — large-language-model provider for AI search prompts.
• Apple Maps — opened externally when you tap "Directions" (we don't share data; iOS handles the handoff).

We do not share data with restaurants, advertisers, or data brokers.

5. Data retention

Account data and content (reviews, photos, trips) are retained as long as your account exists. Server request logs are kept for up to 30 days. If you delete your account, all of the above is removed within 7 days, except where we are legally required to keep it.

6. Your rights

Under UK GDPR you have the right to access a copy of your data, correct it, delete it, or object to its processing. To exercise any of these, email james@locafylab.com from the address tied to your account. We respond within 30 days.

Deleting your account

Email james@locafylab.com with the subject "Account deletion" from the email tied to your account. We permanently remove your account, reviews, photos, saved places, and trips within 7 days, and confirm by email. (An in-app one-tap delete is on the roadmap.)

7. Children

NoshWay is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has created an account, email us and we'll delete it.

8. International transfers

Our servers and primary database are in the EU. Some service providers (Cloudflare, MiniMax) operate globally and may process data outside the UK/EU. Where that happens, we rely on those providers' standard contractual clauses or equivalent safeguards.

9. Changes to this policy

If we materially change how we collect or use data, we'll update this page and bump the "Last updated" date. For substantial changes, we'll also notify you in the app.

10. Contact

Questions, complaints, or data requests: james@locafylab.com.

You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.