Privacy Policy
Last updated: July 18, 2026
This page explains what DishTap collects and what we do with it. It's maintained by the DishTap team to answer common privacy questions during our early-testing phase.
What we collect
- Account: email address, an auto-generated username, optional display name and profile photo.
- Receipts: the receipt photo you upload and the structured line items extracted from it.
- Reviews: the dish rating, optional review text, and optional dish photo you submit.
- Location: only when you tap "Use my location", and only in your browser to sort nearby results. We don't store it.
- Biometric login: Face ID / Touch ID uses your device's secure enclave. DishTap never receives biometric data.
How we use it
- To power your account and show your reviews.
- To compute public averages per dish and per restaurant.
- To recommend other dishes you might like.
Who sees what
- Public: your username, display name, avatar, and any reviews or dish photos you post.
- Only you: your receipt photos and email address.
Third parties
- Lovable Cloud hosts our database, auth, and file storage.
- Lovable AI Gateway reads your receipt photos to extract items. Images aren't kept by the AI provider beyond the request.
- Google Sign-In (optional): if you use it, Google shares your name and email with us.
Security
Passwords are checked against the "Have I Been Pwned" database on signup so you can't reuse a leaked one. All API traffic runs over HTTPS. Receipts are stored in a private bucket only your account can read.
Your rights
You can edit your profile and delete your account any time from the "Me" tab. Deletion removes your receipts, ratings, photos, and account. For any other request, email privacy@dishtap.app.
Children
DishTap is not intended for anyone under 13.