Privacy Policy

Information you give us

• Account data. When you sign in with Apple, Google, an email magic link, or another supported identity provider, we receive your provider-issued user identifier, your email address, and (for Apple) optionally your name. We do not receive or store passwords.
• Signup platform. On the website, we record that the account was first created on the web. Native app versions that support signup-platform attribution record iOS or Android only when creating a new account; older versions may not provide a native value. We use this one account-linked value in aggregate to understand how many new accounts originate on web, iOS, or Android. It is not a device identifier or an ongoing activity log.
• Profile data. Display name, username, home city, the avatar you pick, an optional bio, an optional location line, and privacy preferences you set inside the app.
• Ranked content. The ranked lists (your Top 5s) you create: the places you rank, the order you rank them in, and any notes, dishes, and tags you add to them. We also keep a log of when you change a list and what kind of change it was (the picks, their order, or a note), and when you last confirmed a list as it stands.
• What you do with places and people. Places you save to try, what you add to a seasonal Slate, the “Good to know” tags you vote on for places, lists you Love, like, or save, people you follow and people who follow you, picks you vouch for, lists you work on with others, people you block, reports you file, the cities or categories you ask for or upvote, and places you mark as been, with the date, a private loved / fine / not again and any private note; these are not shown to anyone and never count in a ranking. When you dismiss the card at the top of Home, we keep the time so it shows only what is new to you, and whether we have asked you why, so we ask only once. These are product settings, not analytics.
• What we work out from your lists. Taste matches with other people, expertise scores, and badges and recognition tiers. Your data export includes all of these.
• Support communications. If you contact us, we keep a copy of the message so we can follow up.
• Feedback form. If you use the feedback form on the website, we keep your message, the email address you give us (if any), your account if you are signed in, your anonymous identifier, the page you sent it from, your browser’s user-agent string, your country and region, and a keyed, one-way token made from your IP address (not the address itself), so we can tell when several messages come from one place. We email ourselves a copy with the message, the page, the email address you gave, the IP token, and either your username and account email (if you are signed in) or your region (if you are not). Deleting your account deletes the feedback you sent from it from our database. It does not delete a copy already emailed to us: that stays in our inbox until we delete it, and Resend, the service that sends it, keeps its own copy for as long as its terms set.

Information collected automatically

• Diagnostics. If you turn crash reports on, we get a crash report or error trace when something breaks, a timing trace for about one in ten page loads, screens, and requests, and a short record of each session that says whether it ended in a crash. Each one includes details of your device and software, such as the app or browser version, the operating-system version, and the device model, so we can find the cause. Crash reports are off until you turn them on. Our own servers send their errors, and timing traces for about one in ten requests, to Sentry no matter how this switch is set.
• Usage signals. Basic counters (for example: number of lists you have created) used to power aggregate features like City Consensus and to award badges. These are computed from your ranked content, not from the product events below, and they run for every account because core features depend on them.
• Page views. On the website, each page you open records the page’s address (without anything after a question mark), the website that sent you there (its domain only), any campaign tag in the link you arrived on, your country and region, which of our cities the page is about or the nearest one to you, a broad device class, and the time. A page view carries no identifier: not the anonymous identifier, not your account, and not your IP address.
• Product events. We record that certain actions happened so we can see which parts of the product work: for example viewing a page, opening a city or a place, how long you stayed on a page, starting a list, publishing one, searching, signing in, sharing, and adding a place to a seasonal Slate. Each record carries the name of the action, the anonymous identifier described below, a session identifier, the city and category the action was about, a coarse page pattern, and, if you allow it, your account (see section 6). On the website a record also carries the tag of the link you first arrived on, if it had one, a broad device class, whether the browser was a regular one or an app’s built-in browser (such as the Reddit or Instagram app), and your approximate region, and a page-view record carries the page’s address. A search on the website records the words you searched for, including a search for a place while you make a list. Beyond that, a record does not carry your name, your email address, your IP address, or anything else you typed. These records are ours alone: they go to our own database, they are never sold, and they are never shared with anyone for advertising.
• Page speed. On the website, how long it took your browser to receive the first byte of the page, how long the page took to first show something and to show its main content, how much the layout jumped while it loaded, and how quickly it responded when you tapped or clicked. Each measurement also records its rating (good, needs improvement, or poor), the page’s pattern (for example, a city’s category page), whether the browser window is phone-sized, and how you got to the page (a new visit, a reload, or the back button, for example). These measurements carry no identifier of any kind: not the anonymous identifier, not a session, not your IP address, and not the page’s address, so they cannot be connected to you or to anything else you did.
• Anonymous identifier. So product events read as one visit instead of a series of strangers, the website keeps a random identifier in your browser’s local storage and each app creates a random identifier the first time it needs one. It is a random value with no meaning outside our own counts. It is not an advertising identifier, and it is not derived from anything about you, your account, or your hardware. Clearing site data in your browser clears the web one; deleting the app clears the app one, and reinstalling creates a different one.
• Bots and our own visits. A page view or product event from a known crawler, or from a browser that reports it is being driven by software, is marked as a bot. Visits from our own devices, or from the few IP addresses we list as ours, are marked as ours. Both are left out of our counts, and we don’t record page speed for either. To tell test devices and automated installs of the apps from people, we keep a short record for each app’s anonymous identifier: when it was first seen, which kind of network client it used, and whether it was marked as a test device or arrived in a burst of new installs. It holds no account and is deleted after 180 days without activity.
• IP address. Our servers see your IP address when your browser or app connects, as with any website. We use it to limit how often one connection can call us and to check whether a visit comes from one of our own addresses. Our website host also works out your country, region, and a city-level location from it. We keep the country and region, and use the city-level location only to find the nearest city we cover. Page views, product events, page speed, and feedback never store your IP address. The rate limits we save and the feedback form keep a keyed, one-way token made from it instead, not the address itself.
• Location (optional). When you open a City Consensus page, the iPhone app asks for your location so we can show how far each ranked place is from you. On the website, it first asks when you tap “Show distances.” Once you allow it, the website reads your location again without asking on later visits to those pages, for as long as your browser keeps that permission. The Android app does not ask. The app and the website ask for a rough reading, but your device may give an exact one. Either way, the coordinate is used on your device only: we compute the distance there and never send your location to our servers. If you say no, the distances are left off and every other feature works the same.

What we do not collect

• We do not upload the location your device gives the app or the website; it stays on your device. We do not track your movement over time.
• We do not track you across apps or websites owned by other companies.
• We do not buy data about you from third-party data brokers.
• We do not serve third-party advertising, and we do not share your data with ad networks.

• Provide core features: sign-in, profiles, rankings, and City Consensus.
• Combine everyone’s rankings into a community consensus for a city or category. The combined rankings are stored without the names of the people who ranked. When only a few people have ranked a category, or when their public lists are shown next to it, you can sometimes tell who contributed.
• Keep the service secure, prevent abuse, and enforce our Terms of Service.
• Respond to support requests and operational emails.
• Understand, in aggregate, which platform new accounts were first created on.
• Measure how the product is used, in aggregate, so we can tell which features help and which do not. We do this with our own records; no third-party analytics service is used.
• Comply with legal obligations.

We do not use your data to train machine-learning models for anyone else.

We share personal data only with the services below, which run parts of Top Tier for us. Supabase, Railway, Vercel, Sentry, and Resend each include data-protection terms in their standard customer agreements. OpenFreeMap and DiceBear are free public services we have no agreement with. The website, the apps, and our servers send your data to these services, or have your device contact them:

• Supabase (database and authentication)
• Railway (application hosting)
• Vercel (website hosting)
• Sentry (crash reports, timing traces, and session records from your device if you turn them on, and error reports and timing traces from our own servers)
• Resend (emails us a copy of each feedback form message)
• Apple / Google (authentication providers you choose to sign in with)
• Apple Maps / Google Maps (the maps in the iPhone app come from Apple and the maps in the Android app come from Google, so your device asks them for the map of the area on screen)
• OpenFreeMap (the maps on the website; your browser loads them straight from OpenFreeMap, which sees your IP address and the area shown)
• DiceBear (profile pictures. A profile picture is either none or a drawn picture from DiceBear, and we refuse any other picture address. Your browser or app loads the pictures straight from DiceBear, which sees your IP address and which picture was shown.)
• Google Places (finding and filling in restaurant details. When a place search needs Google, we send it the words typed into the search and the city the search is limited to. We also send the name of a city someone asks us to add, and Google’s own place identifiers to look up details. We do not send your account or your IP address, but the words go to Google as they were typed.)

We may disclose information if required by law, to respond to lawful requests, to protect the rights and safety of users and third parties, or in connection with a business transaction such as a merger or acquisition.

Your profile, username, and ranked lists are public by default so that the community can see and learn from them. Your email address is never shown publicly. You can change your profile visibility in Settings. City Consensus rankings are always public. The combined ranking does not name who ranked what, but the public lists of people who contributed are shown next to it, and when only a few people have ranked a category, the ranking can point to them.

You can choose to show your handle in other contributors’ publish receipts. If you turn it on, your handle and your rank for a place can be shown to other contributors in the same city and category when they publish.

We keep your account data for as long as you have an account. If you delete your account, we remove your profile and your ranked content from the live service within 30 days, and we delete the product events and feedback linked to your account from our database along with them. Copies of feedback already emailed to us are not deleted this way (see “Feedback form” above). We keep a placeholder where the account was, with the name, username, email, and profile removed, so links to it do not break, and we keep the record of your deletion request. Neither has an end date.

Page views, product events, and page-speed measurements are deleted after 180 days, whether or not they are linked to an account. The daily totals we compute from them are kept. They hold counts, not account or anonymous identifiers. The daily list of the most common searches keeps the words people searched for, and those words can hold anything a person typed, personal details included.

• Access and export. Request a copy of your data from Settings.
• Delete your account. Delete your account from Settings. Deletion is permanent.
• Correct your profile. Edit your name, username, and other profile details in Settings.
• Analytics setting. Settings has a switch for this: “Anonymous analytics” under Privacy in the apps, and “Product analytics” under Privacy & consent on the website. It controls whether product events are linked to your account. While it is on, your account identifier is stamped on them, and signing in also attaches your account to the events this browser or app recorded anonymously beforehand. While it is off, the events are still recorded, without your account identifier. Turning it off in a browser also starts a fresh anonymous identifier and a fresh session in every open tab of that browser, so the browsing that follows is not joined to the browsing that came before.
• Browser privacy signal. If your browser sends Global Privacy Control or Do Not Track, the website records no page views, no product events, and no page speed at all, and both consent switches stay off.
• Crash reports. Turn them on or off in Settings, under Privacy in the apps and Privacy & consent on the website.
• California residents have the rights described in the CCPA / CPRA, including the right to know, delete, correct, and opt out of “sale” or “sharing” of personal information. We do not sell or share personal information in that sense.
• EU / UK residents have the rights described in the GDPR / UK GDPR, including access, rectification, erasure, restriction, portability, and objection. Our lawful bases are performance of a contract, legitimate interest, and consent (for crash reports and for linking product events to your account).

To exercise any right, email us at support@toptiereats.app or use the in-app tools.

Top Tier is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, contact us at support@toptiereats.app and we will delete it.

The website and the apps connect to our servers over HTTPS. Supabase, which holds our database, encrypts stored data by default. Access to your data is limited to the people and services that need it. No way of sending or storing data is 100% secure, so we cannot promise absolute security.

Top Tier is operated in the United States. If you access the service from outside the United States, your information will be transferred to, processed, and stored in the United States and other countries where our service providers operate, which may have different data-protection laws than your country.

We may update this Privacy Policy from time to time. We will post the new policy here and update the “Last updated” date. For material changes, we will provide additional notice (for example, an in-app notice or email).

Top Tier · support@toptiereats.app