Sitchy

Privacy Policy

Super Nova Software LLC, the company that makes Sitchy · Last updated 9 November 2026

This draft is with our lawyer. Everything below describes what Sitchy actually does today, but the wording has not yet been reviewed. Questions meanwhile: support@sitchyapp.com.

The short version

Sitchy helps you decide what to eat nearby. To do that it needs to know where you are and, if you rate a dish, that you were actually there. It does not need to know who you are to help you choose: you can browse, swipe and shortlist without an account, and you only ever have a name or an email with us if you choose to sign in, leave an email to hear when Sitchy reaches your city, or join one of the lists on our website. To keep ratings honest, you must be signed in with Apple or Google, and have stayed about ten minutes, before you can rate a dish, and a rating that trips one of a few simple checks is held until a person has looked at it.

We do not sell your data, and we do not let restaurants buy their way up your list. We make no money from advertising today; if that changes, an ad will be labeled as one and what you do with it will never teach Sitchy anything about your taste.

What we collect, and why

Your location

Sitchy asks for your location to find dishes near you and to confirm you arrived at a restaurant. Your coordinates are sent to our server, with the range — walking or further away, as you chose it, or, when you open the app outside the area Sitchy covers to plan a visit, the planning range, which our server decides — and the party size the list is for (Solo, for your own list), to work out which venues are in range, how far each is, and whether you are at one. They are used for that and then dropped: an arrival record holds the restaurant, how the arrival was confirmed, when, and whether you stayed there ten minutes — not where you were. We do not keep a history of your movements. While you are signed in, or have hidden dishes, the request for your list also carries your account, so our server can leave out dishes you hid (Dishes you hide, below) and, once Sitchy orders lists to your taste, rank the list for you; a guest's request carries your account only while the guest has hidden dishes. When a list comes back empty for any reason but your own hides, our server's log notes why, the range, which area Sitchy covers you were inside or close enough to plan a visit to, if any, and whether the list was for one of that area's named spots — never which spot, and never where you were.

Whether you stayed is checked the same way. For about ten minutes after an arrival is confirmed, the app keeps reading your location — in the background too, where your phone allows it, with its location indicator showing — and it reads it once more if you open the app, or it comes back online, within ninety minutes of arriving. It sends us only readings that could decide the stay — before the ten minutes are up, one that looks as if you have left; after them, any precise enough to settle it, until it is settled — and never more than one every thirty seconds. Each is compared with where the restaurant is and dropped, like the first, and your phone keeps none of them.

If you allow location Always, your phone also watches the area around the restaurant while a Walk There trip is under way, so your arrival can be confirmed even with Sitchy closed; the watch ends when you arrive or the trip ends — and a trip that ends while Sitchy is closed leaves the area watched until Sitchy next runs, doing nothing with it. Sitchy asks for Always only after you have rated a dish, or after you turn on the saved-dish reminder.

The saved-dish reminder is off until you turn it on, in Settings or with Remind me when Sitchy offers it after you save a dish. Turning it on asks your phone for location Always, if it has not asked before — at once if you already allow location while using Sitchy, or once you do — and once Always is allowed, for notifications. With both allowed, your phone watches for you coming into the area where Sitchy is live, using the phone's own region monitoring: Sitchy takes no reading of where you are, and nothing about it is sent to us. When you come in with Sitchy closed, your phone counts the dishes you saved inside that area and shows one notification — You're on Atlanta's Eastside, where you saved three dishes. — at most one a day, and none while the app is open or a Walk There trip is under way. The notification is made on your phone; we do not send it. Turn the reminder off in Settings, or turn off notifications or Always location for Sitchy in iPhone Settings.

The one location we do store is a place you choose yourself: if you tell Sitchy to always start further away somewhere, we keep that spot with your account, rounded to three decimal places — roughly a 110-meter square, which describes a block rather than a doorstep. You can see every one in your data export, change your mind in the app, or delete them.

You can use Sitchy with location turned off. You will not get a list of dishes nearby, and you will not be able to rate anything, because a rating only counts if we confirmed you were there.

Your account

Your phone gets an account the first time it needs one — when Sitchy confirms you arrived somewhere, when you save a place or a dish, when you hide a dish, or when you join the launch waitlist — and, once the dish filters are available, when you turn one on. By default that account is anonymous: an identifier, and nothing else. No name, no email unless you leave one for the launch waitlist (below), and no password. Sitchy stores no passwords at all. An anonymous account cannot rate a dish.

If you sign in with Apple or Google, which you must do before you can rate a dish, we receive and keep the name and email address that provider gives us, so the same account works when you change phone. Providers may also return a profile picture address and a locale, which are kept with the account. We never see your Apple or Google password. Our sign-in provider also records sign-in events, including the network address they came from, as part of running authentication securely.

We also keep the day you first signed in with Apple or Google — the date, nothing finer — with your account. It tells the overnight check below a new account from an older one, and it is in your data export.

Before anyone else sees the name on your account — the one Apple or Google gives us, or one you choose — we check it against a list of words and names we will not show, such as slurs, sexual or violent terms, hate codes and names that pose as Sitchy or a restaurant. Until it passes, other people are shown no name for you, and if they were shown one before, they keep seeing that one. A name that does not pass is never shown, and we never say which word or rule it tripped. We keep it, why it did not pass and who decided for 90 days, so a mistake can be put right; after that we keep only a count of how many names did not pass, and why, with nothing linking it to you.

Our review desk for names reads names with an AI model, to catch what a list cannot, such as words run together, another language or a name that poses as someone. It starts in a test stage, in which it reads names that are waiting and names that have already passed, and nothing the models say changes whether a name is shown. Once we switch it on, a name that passes the word list is also read this way before anyone else sees it. Either way only the name is sent, to Anthropic, which processes it for us: never your account, email or anything else about you. Once it is switched on, one model decides, a second checks, and a third looks if they differ; when a model is unsure, or a call fails, the name is not shown. We keep each decision, which model made it and a one-word reason for 90 days, and not the name itself beyond the record above.

Your handle

Once you have signed in with Apple or Google, Sitchy gives your account a handle: two food words and two digits, such as crispydumpling27, picked at random from a list we have checked, and never from your taste, your persona or your name. You can change it once in 30 days. A handle we will not use — one that is taken, held, reserved, on our list of words we will not show, or ends in a hate code — is refused with the same two words, Try another, whichever it was, and a refusal costs you nothing; you may try ten a day, and we keep only that day's count of tries, never the handles tried. A handle you give up, by changing it or by deleting your account, is held for at least 90 days, until the end of that month, so that no one else takes it; the hold is the handle and the day it frees, a month's last day, with no account and no time of the change. We also keep whether you can be found by your handle, which is on until you turn it off. Only you can see your handle unless you turn on Show my handle to my friends, which is off until you do: once friends are available and it is on, your friends and the people you ask to be friends see your handle, until you turn it off — the handle we gave you, and not one you changed it to, for now. Nothing looks anyone up by it. It is in your data export.

Scout tasks

Founding Scouts, and Street Scouts once they have had five photographs approved and voted at three different places, can open a short list of dishes nearby that need votes or a photograph. We keep, with your account, that you are a scout and the day it began: a Founding Scout because we added you, a Street Scout because you earned it, and it is in your data export. To make the list, each time a signed-in account opens My Trail the phone sends where it is, whether or not the account is a scout, and only if you have already let Sitchy use your location; we use it for that one answer and drop it, and we keep nothing about the request. Your phone holds the list in memory while the app is open and does not store it. Opening the list earns nothing, and a vote on a dish from it counts like any other vote — we do not record that it came from the list.

A scout may also photograph a restaurant's menu board, with the camera only. We check that your phone is at the restaurant when you start, and keep only whether its location reading was rough or placed you outside the restaurant — never the location itself. Before anything is sent, your phone reads the photograph itself to check that its prices can be read; nothing about that check leaves your phone or is kept. The photograph is checked to hold no location, time or device details, is never shown to diners or published, and is left out of our backups. It is read by software on our own computer; a person sees it only if it is picked to check the reading or needs a closer look. We delete it fourteen days after you send it, whether or not it was read, unless the law requires us to keep it. A board that could be read earns 75 points, kept with your account. Your data export lists the restaurant, the day and whether it was read, and counts those points.

Friends

Once friends are available, two signed-in diners become friends when one asks and the other accepts. While a request waits we keep who asked whom and the day; it is deleted when it is accepted, declined or withdrawn, or 30 days after it was made. Someone who asks you is never told that you declined, and we keep no list of the requests you have sent: this phone remembers the requests it sent, a reference and the day, for up to 30 days, so you can cancel them, and forgets them when you cancel, sign in as someone else or delete your account. For each friendship we keep the two accounts and the day it was made, until either of you ends it, and the other is not told. You can block someone from a friendship or from a request they sent you: the block ends the friendship and any requests between you, they are not told, and asking you then looks to them as though nothing happened. We keep who blocked whom and the day until you unblock them, which restores nothing. We also count how many people you asked to be friends today, for the day only. You can also invite someone with a link: we keep only a scrambled form of the link, from which the link cannot be made again, with who made it and the day it stops working, 7 days later; it is deleted when it is used or you withdraw it, or after that day. Opening a link offers to ask the person who made it to be friends; if you agree, they still decide. The link is an address on sitchyapp.com, and the part after the # is the invitation: opening it in a browser does not send that part to our site, which shows the same page for every invitation and cannot tell whose it is. The app sends it to us only if you choose to ask to be friends. We count, for the day only, how many invitations you made and how many links you tried that did not work. If you are paired in Duo, you can ask your partner to be friends: they get a request like any other, and nothing of your Duo session is kept with it. Your friends, and anyone you ask to be friends, see your name once it has passed our check, and your handle only while you have Show my handle to my friends on — which we keep, off unless you turn it on — and nothing else about you: not your taste, your ratings or where you went. Sitchy never reads your phone's contacts, and no friend is found from them. None of this is ever used to rank, choose or show dishes, and none of it reaches a restaurant.

What you rate, and where you went

You can rate a dish only at a place where your arrival was confirmed, once you have stayed about ten minutes, and while you are signed in. When you rate a dish we keep the dish, your verdict, when you said it, which of your confirmed arrivals you said it at — until that arrival record is deleted, below — and whether it counts yet and since when: a rating waits to be checked before it joins a dish's score, and until then it changes no number anyone sees. After you rate you can tap any of a few short reasons that fit the dish — Too salty, Great value and the like. That is optional, nothing is typed, and it earns nothing. So that they are ready even with no signal at the restaurant, the app asks our server which reasons a dish offers you when you start walking to it, or when you rate it if it has not asked yet; that question names the dish, and we keep no record of it. We keep your reasons with your rating, and which reasons you were offered: they change or clear if you change it, they never change a dish's score, they are never shown to another diner, and no restaurant sees yours. Once you have rated the dish you walked to, you can also rate up to two other dishes you had on that visit, picked from the restaurant's own dishes. We keep that you added each one that way: it is a rating like any other, but never counted as a dish Sitchy sent you to. As you rate, we also check the rating against a few simple limits — how many dishes you rate from one visit, how many places you rate at in a day, whether you could have got from one place to the next in the time, and whether the kitchen was open. A rating that trips one is held for a closer look: it counts toward nothing until a person has cleared it, it is never removed on its own, and how you rated is never by itself a reason to hold it. We keep which limit it tripped, and on which day, with the rating, and leave that out of your data export, so that a held rating reads like any other. When a person looks at a held rating, we keep what they decided — to let it count, or to keep it held — who decided and when, and what they were shown: which limits it had tripped and on which days, the day you rated, and how many of your ratings were held at the time. That is kept with the rating, left out of your data export too, and deleted with the rating or with your account. Each night a check also looks across the last few days of ratings for patterns that suggest a rule is being broken — someone rating the place they work, a sudden rush of new accounts rating one dish, or accounts that visit and rate as one. It works on a copy made from what we already keep: your visits from the last five days (the place, when you arrived and whether you stayed, each with its day and how far it was from your visit before), your ratings from those days, any still waiting to be checked and any the check may still hold, each with the dish, the place, its day, your verdict, whether it counts yet and any limit it has already tripped, and how many days ago your account was made and first signed in (counted in Atlanta's calendar), and whether it had rated anything before. For each dish rated in the copy it also holds how many ratings count for that dish and how many of those were made in the last four weeks, the number of all ratings that count from those four weeks, and whether your account has no other rating that counts, one, or two or more. In that copy your account and each rating are replaced by codes made afresh each night, and it holds no name, email or display name; the key to the codes stays with us and is deleted as soon as the check answers, and within three hours at most. The check can hold a rating for a person to look at, as the limits above do — one still waiting, or one that began counting in the last five days, if that month is not yet over and no person has cleared it, which then stops counting until a person clears it and keeps any points and stamps it earned — and never removes one. It runs once a night, early in the morning, on a computer we own. That computer holds the copy only in its memory while the check runs: it is never saved to a file, and it is gone when the run ends. A rating the check passes counts from then. The check may leave one waiting for a later night, and a rating it holds counts only once a person has cleared it. When your phone confirms you arrived somewhere, we keep the restaurant, how it was confirmed, when, and whether you stayed there ten minutes. Those arrival records are deleted automatically five days after they are made; they exist only so a rating can be tied to a real visit.

Once a rating counts, it adds to your progress in the app: points, a level and stamps, shown only to you. We note the day each rating counts for and when it first counted, which is how the points are added up, and we keep the highest level you have reached, since a level never goes down. Both verdicts earn the same and reasons earn nothing; a dish you add from the same visit earns no points of its own, though it counts toward stamps. Your progress is never money, nothing in it can be bought, and it never changes what Sitchy shows you or anyone else.

When you save a dish to your Trail — planning a visit from outside the corridor — we keep the dish and when you saved it with your account, so your plan survives a new phone. We do not keep where you were when you saved it, or which state you were in.

A dish that was not there

If you walk to a dish and can't get it, you can say so instead of rating it: Sold out today or Not on the menu anymore. Sold out today stays on your phone with that trip and is not sent anywhere. Not on the menu anymore is a report about the dish. You can make it only while signed in, at a place where your arrival was confirmed — once per dish, and for one dish per restaurant a day. We keep the dish and the day of your latest such arrival with your account, so that each person counts once. It is not a rating: it counts toward no score, teaches Sitchy nothing about your taste, and is never shown to anyone else. Reports from two different people on two different days take the dish out of everyone's lists until a person at Sitchy has looked; that person then puts it back or takes it off for good. A restaurant may hear from us that one of its dishes was reported as gone, never by whom. Your report is deleted when that look is done, when you delete your account, or otherwise 30 days after your latest visit at which you made it — unless the dish is out of everyone's lists by then, when it waits for that look.

If the dish is taken off for good, your report earns 15 points. We keep a record with your account that those points were earned, and our record of the decision to take the dish off lists those records, so that if the decision is ever undone, the points can be taken back. Together, these two records show that you reported that dish, for as long as you keep your account; deleting your account deletes your record of the points, and with it that link. Your export counts the points your reports earned and says that our record of the decision is left out.

If you had a dish that is missing from a restaurant's list, you can tap Not listed here and we will read its menu again. You can do this only while signed in, after a confirmed visit there. We keep which restaurant it was and the first day anyone asked — nothing about you, your phone or your visit, and not how many people asked.

Dishes you hide

When you tap Not for me on a dish, we keep the dish and the day you hid it with your account — a guest's too — so it stays out of your lists and restaurant pages wherever you use that account. It is not a rating: it teaches Sitchy nothing about your taste, earns nothing, and is never shown to anyone else, a restaurant included, not even as a total. Nor is it a safety filter: Sitchy makes no allergen or dietary claim, so ask the restaurant. A dish you saved to your Trail stays there. The list two phones share when you swipe together leaves no one's hidden dishes out, and you cannot hide a dish while paired. A Squad's list likewise leaves no one's hidden dishes out, and you cannot hide a dish while in one. While you have hidden dishes, your phone sends your account with each request for your list or for a restaurant's page, so that our server can leave them out. We keep nothing about the request: your position is dropped as it always is. A restaurant search, and the count a lookup adds to, never carry your account. When you are signed in, your phone sends your account with each request for your list or for a restaurant's page even with nothing hidden; a guest's phone does not. Your phone also keeps its own copy of the dishes you hid, so it can leave them out at once and show you the list.

Dish filters

In Settings, under Hide dishes with, four switches — Pork, Beef & red meat, All meat & fish, and Alcohol — hide dishes with those from your own lists. We keep which switches you have on with your account — a guest's too — so they follow you wherever you use that account, and your phone keeps its own copy. We never ask why, and keep no reason. Your filters are never shown to anyone else, a restaurant included, and they teach Sitchy nothing about your taste. A list you share with others, when you swipe together, applies no one's filters, so it never tells anyone what you filter. The switches hide dishes only as far as a restaurant's menu tells us: kitchens don't always list every ingredient, so if you must avoid something, ask the restaurant. Sitchy makes no allergen or dietary claim, and never marks a dish as having or not having anything. While a switch is on, your phone sends your account with each request for your list or for a restaurant's page, so that our server can leave those dishes out and tell your phone which filters it applied; it is used for that alone, and your position is dropped as it always is. When you turn a switch off, we keep a note so that restoring a backup cannot turn it back on. Once you have hidden three dishes that share one of those things, your list may ask you, once, whether to switch that filter on. We work that out from the dishes you hid alone, and keep which filters we have offered you with your account — the filter, once each, with no day and no answer — so that we never ask again. The filters are not yet available in the app; until they are, nothing is kept.

Swiping together

Two people standing together can pair their phones for one of the corridor's spots and each get the same list for it, ranked for both of you. One phone shows a code; the other scans it and waits until the first lets it in. While a pairing lasts we keep the spot, the code until it is used or lapses, when the pairing was made and last used, and which two accounts are in it and whether each is a guest. The other phone is shown your display name once it has passed our check (above), and whether you are signed in — never your email, and never either phone's position, which is not sent for this at all. A pairing ends when either of you leaves; one nobody has used for three hours, or a code nobody used within fifteen minutes, is deleted within the hour.

Up to eight people can instead form a Squad for one of the corridor's spots, and everyone in it gets the same list for that spot, ranked for the group. One phone shows a code; each person who scans it waits until that phone lets them in. While a Squad lasts we keep the spot, the code until the Squad ends or a new one replaces it, when it was made and last used, which accounts are in it and whether each is a guest, and the order they joined. While you swipe in a Squad we keep, with your account and that Squad, each dish you swipe right on; a swipe left keeps nothing, and a like you undo is deleted. The group is shown how many liked each dish, 3 of 4, and never who, though in a Squad of two or three that count can show the others how you swiped. When the phone that started it picks a dish, we keep that dish with the Squad, and the pick ends it. The dishes you liked go when you leave it, or with the Squad, within a day of its end. Someone who scans the code is kept as waiting and, if turned away, as turned away, so that the same account cannot knock at that Squad again. The phones in a Squad are shown only the first word of your display name, once it has passed our check (above), and whether you are signed in or a guest — never your email, and never any phone's position, which is not sent for this at all. Leaving removes you at once, and the phone that started a Squad leaving or ending it ends it for everyone; a code nobody used within fifteen minutes stops working, a Squad nobody has used for three hours ends, and one that has ended is deleted within a day.

Photographs of a dish

Once you are signed in and Sitchy has confirmed your visit, you can add a photograph of the dish you came for, from the camera or from your photo library. For five days after the visit you can also add one from your photo library, under Recent visits in your Trail, of the dish you came for or of another dish of the same restaurant you rated on that visit, if it has no published photograph and you have not sent one of it. Before anything is sent, your phone redraws the photograph without the hidden details a photo file usually carries — where and when it was taken, and on which device — and at no more than 2048 pixels on its longest side. With it goes which visit and dish it is for, the time it was taken and where the phone was: for a camera photograph, the moment you took it and a fresh reading of where your phone is; for one from your library, the time and place saved in it, and a library photograph that does not say both is not sent at all. We check that the time falls within your visit and the place is at the restaurant, and then discard both — they are never stored. We refuse any file that still carries hidden details. No automatic quality check runs on your phone.

We keep the photograph, the dish and visit it is for, whether it came from the camera or the library, which of three places in the app you started it from (the trip line on the way to a dish, the screen after you rate it, or Recent visits), whether its location reading was less precise than we would like, the day you sent it, and where it stands in review. Apart from the time and place your phone reports, which we never store, our storage records on the photograph's file when it was uploaded, until it is published, where no one else can read it. A photograph is published as a fresh copy of the file, usually a day or two after its review and never before the first midnight after it, in the first minutes after midnight Atlanta time together with every other photograph published that night; each time it is published again, after a hide is lifted, say, it is copied afresh. So the published file records only when that copy was made, or when it was restored from a backup; anyone who has a published photograph's address can read that time. Every photograph is held until a person has looked at it; we keep who reviewed it and when. A published photograph appears on the dish's card for everyone, never with your name. A dish keeps at most ten published photographs, the best of them judged on the photograph alone and never on how many people looked at or swiped it; the rest are removed. If a dish is taken off the menu for good, its photographs leave the app with it: its best published photograph is kept, hidden, for twelve months in case the dish comes back, and then removed, and the others are set aside at once, never shown, and their files kept out of sight for thirty days in case that decision is undone, then removed. You keep the points each earned. Anyone can report a photograph, signed in or not: we keep which account reported it, the reason and when — the latest, if you report it again. A report counts for nothing from someone not signed in, for a quarter from an account that first signed in less than a week ago or has no rating that has counted yet, and in full otherwise; to weigh it we look at the day your account first signed in and whether any of your ratings has counted, and keep nothing more. Reports that add up to five within four weeks hide a photograph until a person has looked again. A published photograph a person decides should stay down, after reports or on their own look, stays hidden for 30 days, its file kept where no one else can read it, and is then deleted. Photographs waiting for review are never in our backups. Sitchy asks for your camera only when you choose to photograph a dish; your library opens through iPhone's own picker, so Sitchy never sees your other photographs.

When a photograph of yours is kept down, you can appeal within those 30 days, signed in; its file stays while the appeal is open. A reviewer looks at it, and if the photograph stays down its file is kept 30 days more from that decision, in which you can appeal once more, which a person decides. We keep each appeal with your account — the photograph it is about, the day, and how it ended — and your export lists each appeal's day and how it ended; it is deleted with your account; what the reviewer saw and decided is kept with the photograph's review record, which is left out of your export.

A photograph that a person approves also adds to your progress: 100 points when no other photograph of its dish is published as it is approved, 25 when one or two others are, and none when three or more are — at most one earning photograph of each dish for each person, and the same however you rated the dish — and photo stamps, which count only the photographs that earned points. We keep which of those each approved photograph was, with your account; it is in your export and deleted with your account. If a published photograph is deleted after it was kept down, or a reviewer undoes its approval, its points are taken back and any stamp that no longer qualifies goes, though your level never goes down; a photograph hidden by reports keeps its points while a person looks again, and through its 30 days if it is kept down. The app lists your own photographs, where each stands and what each earned, for you alone, and tells you once when one is newly published; your phone remembers which it has told you, and sends that nowhere.

When a swipe card shows you a published photograph, your phone tells us it was seen: it sends that photograph's identifier and nothing else — no account, session, place or time — at most once a day for each photograph from each phone, not for your own photographs once the app has your list of them (so one of yours can count once on a day the list has not yet loaded), and never from a dish's page, What to order here or search. The request carries the random install identifier and reaches us from your network address, used only to stop abuse and never kept with the count, as with swipes. We keep one number for each photograph — how many times it has been seen, with the day it was last counted, so that it can run a day behind — counted only while it is published and still has its owner. Only the photograph's owner sees it, in the app's list of their own photographs and in their export, and it runs a day behind and in steps of ten — "fewer than 10", then 10, 20 and so on — so that no one day's views can be worked out from it. It is never used to choose, rank, keep or retire a photograph. It is deleted with the photograph, and cleared when its owner deletes their account.

To learn how many of the photographs people start go on to be added, we keep counts for each day and for each of those three places: how many were started, and how many of those we turned away and why (for example, that the phone was too far from the restaurant); how many were sent, how many we refused as they arrived (for example, because the file was not a JPEG), and how many a person approved or turned down. Your phone adds the steps only it sees, for the same three places: how many times the button to add a photograph was shown for a visit and dish, how many times the camera or the library was opened, how many closed with nothing chosen, and how many photographs it stopped before anything was sent, and why (for example, that the photograph did not say where it was taken). It sends these as numbers in batches, with no account, dish, restaurant or photograph; as with the seen count, the request carries the random install identifier and reaches us from your network address, used only to stop abuse and never kept with the counts. The count for a day is a number and nothing else: it is kept with no account, device, session, dish, restaurant or photograph, and nobody but us can read it. It is kept for 13 months, then deleted. It is never used to choose, rank, keep, retire or review a photograph or a restaurant, and it is not shared.

If a photograph is ever found to show the sexual abuse of a child, we report it to the National Center for Missing & Exploited Children, as U.S. law requires. We then keep that photograph — and the email address and name of the account that sent it — locked away for the one year the law requires us to preserve them, even if that account is deleted in the meantime, or longer only if the police or a court asks us to. The photograph is never shown, never backed up and never examined by an automated system. Once we have made our report, it is encrypted so that it can be opened only with a key we keep offline, and we delete it, with the email and name, when that time is up. The record of the hold, which includes that email address and name, is in our nightly backups like the rest of our records, so a copy of it remains there for up to 30 nights after we delete it.

Before launch, some dish photographs do not come through the app: originals from photographers and creators who agreed to license them to us, and photographs taken by Founding Scouts. Each reaches us as a file from someone we know, never from an account. Before anything is sent, one person at Sitchy checks it on a Mac Studio in a folder that is kept out of every backup: that it was taken at the restaurant, and for a licensed photograph that it was taken in the last twelve months. The photograph is then redrawn without the hidden details a photo file carries — where and when it was taken, and on which device — at no more than 2048 pixels on its longest side, and only that copy is sent to our servers. The original is deleted from the Mac Studio as soon as our servers have taken the copy in; we ask the sender to delete theirs, which we cannot do for them. The place and time the original held are read for that check and never stored. We keep, with each such photograph, two codes of our own making — one for the photographer or scout and, for a licensed photograph, one for the license — and nothing else about who made it: no name, email or account. A person reviews it as they review a diner's photograph, and it is published, kept and removed by the same rules as the others above; its codes are deleted with it, except under the legal hold above, which freezes them.

Looking up a restaurant by name

When you search for a restaurant by its name, your phone sends what you typed and where you are; your position decides which area's restaurants are searched. We answer and keep neither, and nothing you type is written to our logs. A search that names a diet, an allergy or an ingredient you want to avoid gets no list of restaurants - unless it is exactly a restaurant's own name: Sitchy makes no dietary claim, so it will not pick restaurants for one. Opening a restaurant's page, What to order here, sends the restaurant and where you are — and your account while you are signed in or have hidden dishes, so the page can leave them out — and records nothing about what you look at there.

When you open a restaurant you found by searching its name, or search for one we know of but do not cover yet, your phone adds one to that restaurant's count for the month - at most once a day for each restaurant, never while you are at the restaurant, and never for a food hall's own name. The request carries the restaurant and nothing else. We keep the monthly count, not your search: one number per restaurant per month, with nothing that identifies you, your account or your phone, for two years. A restaurant may learn its own count for a whole month once it reaches ten; it never learns who looked, when or from where, and never another restaurant's count.

If you run a restaurant

If you ask to manage a restaurant on Sitchy, we keep, with your account, the contact name you give us, your role there (owner, manager or other) and each restaurant you ask about, with where that request stands and the day. Only Sitchy sees this. It is never shown to a diner, another restaurant or anyone else, it changes nothing a diner sees - no dish, price, hour or ranking - and no restaurant can pay for a better place in a list. A person at Sitchy decides each request; we may check it by calling the restaurant's own published number, and keep a note of what was checked and the day, never the number or what was said. Whatever you ask, you are told only that it is under review, so the answer tells you nothing about who else has asked. We also count, for the day only, how many requests your account made. When you delete your account, your contact name, your requests and the notes about them are deleted with it, and the restaurant is free for someone else to claim. We share none of this with anyone.

A restaurant's approved owner does not vote on its dishes. If you sign in to the restaurant portal with the same account you use in the app, that is already so. If you use a different sign-in, the portal will be able to show you a short code that works once, for ten minutes; typing it in the app's Settings links that app account to the restaurant. We keep the link - which request and which app account, and the day - and, until it is used or a night has passed, a scrambled copy of the code, never the code itself. We look at the link only when a vote is cast, to turn down a vote on your own restaurant's dishes, and it is included in the copy of your data you can ask for. It is never shown to anyone, it changes no list, and it is deleted with either account.

Once a restaurant's request is approved, it sees weekly totals about its own listing: how many times its dishes were shown on a Sitchy list - including when you plan ahead, swipe with a partner or swipe together with friends - how many were saved or walked to, and how many visits Sitchy confirmed. It never sees who, when within the week, from where, or anything about a group you swiped with, and no week is shown until enough different people are behind it. We work each week out once, a little over a week after it ends, from the swipe and Walk There records described below, and keep the totals - with nothing that identifies you, your account or your phone - for two years.

You will sign in to the restaurant portal, sitchyapp.com/merchant, with Apple or Google; we keep no password. The portal's page keeps your sign-in in your browser's storage for that one tab only, which is cleared when you sign out or close the tab, and sets no cookie. Its only requests go to Sitchy's own server, to sign you in and to read the numbers, claims and menu file described here. The page is not listed by search engines, and a menu file you download is saved on your own device.

When a restaurant takes a paid plan, you pay on a page run by our payment processor, not by Sitchy: your card number, bank details and billing address go to the processor and never reach us. We keep, with your account, the plan you hold for each restaurant, whether it is active, the day its period ends, the days of the launch terms (the first ninety days at the Basic price, and a free month when a restaurant had no confirmed visits in its first full month, worked out from the weekly totals above and kept as a day, never a count) and two opaque reference numbers the processor gives us. The processor tells us when a payment plan changes, and only then does your plan change. We keep a short note of each message from the processor, an identifier and a day, for thirty days, so none is applied twice. When you delete your account, your plans and the processor's reference numbers are deleted with it, and we cancel the plan at the processor first.

If Sitchy is not in your city yet

If you open Sitchy somewhere it does not cover, you can leave the name of your city, typed as you like it, and an email address, so that we can send you one email when Sitchy opens there. Your location is checked, to confirm Sitchy does not cover where you are, and then dropped; the city we keep is only what you typed. We keep the city and the email with your account, the anonymous one if you never signed in. The email is used for that one email and nothing else, never to find your account; the cities people type also help us choose where Sitchy goes next. Nothing is sent to the address before then, not even a confirmation.

The entry is deleted once that email is sent, or two years after you joined, whichever comes first, and you can remove it sooner, on that screen or in Settings. If you remove it, we keep a note that you did: which list, your account and the day, never the address. It is what stops a restore from a backup putting you back on the list, and we delete it after thirty-five days, once no backup from before your removal can be restored.

Joining a list on our website

On sitchyapp.com you can join two lists, with no account. The City Scout Waitlist keeps the city or neighborhood you name, your name, your email address and the line you write on why, and, if you add one, the name of a place or dish and where it is. A suggestion asks us to look at a place; it is never a rating and never counts as one. We use the list to invite you to scout when Sitchy opens there, and to help choose where it goes next. The restaurant list keeps the restaurant's name, a contact name, an email address and that person's role, used only to contact the restaurant about our restaurant portal.

An entry is kept with the day it was made and nothing about your visit — no network address, browser or account — and it is never connected to how anyone uses the app. Nothing is sent to the address before we invite you, not even a confirmation. It is deleted once we have invited you, or two years after you joined, whichever comes first. To be taken off sooner, write to support@sitchyapp.com from the address you gave. We then keep a note that an entry was removed — which list, a random number that stood for the entry, and the day, never the address — so that a restore from a backup cannot put it back. The note is deleted after thirty-five days, once no backup from before the removal can be restored.

To keep bots off these two forms, their pages load Cloudflare Turnstile. It runs a check in your browser that reads things like your network address, your browser and how it connects, and we learn only whether you passed, and keep none of it. Cloudflare runs the check for us, and may also use what it sees to improve its own bot detection; for that, it decides for itself, under its own privacy policy.

Swipes, and the other records that are not tied to you

How people swipe through the stack tells us whether the ranking is any good. The records we keep carry no account, device or install identifier and no coordinates: a random session identifier, the position in the stack, the card's place in the list we sent your phone, a coarse score for the dish (our ranking's score in steps of one twentieth, worked out without your distance from the restaurant and without your taste, and left out for a list two phones or a Squad share), the dish, the gesture, how long the card was on screen, the range, and the hour of day. They are deleted after 13 months.

Tapping "Walk there" records a random per-trip identifier, the restaurant, whether it was a food hall, how the arrival was confirmed, whether you then stayed there ten minutes, and the hour — again with nothing identifying you. Those are deleted after 90 days.

To be precise about what that does and does not mean: the request that delivers these records carries a random install identifier and reaches us from your network address, both used to stop abuse. Neither is stored with the record, so nothing stored with it names a person or a phone. One thing we choose to keep, and should say: when you save a dish while planning from outside the corridor, the swipe that saved it is recorded with the same session identifier as the rest of that sitting's swipes, so that dish and the hour you saved it could be matched to that session's records from the content alone. We keep it because it shows which dishes draw people in from further away; it still carries no account, device or install identifier. Likewise, swipes made while two phones are paired are recorded like any others, labelled as Duo, with no account — and since both phones are shown the same list at the same spot in the same hour, the two sessions could be read as one pair's. Those swipes carry a session identifier of their own, new for each pairing and never the one on the rest of your swipes, so a dish you saved while planning cannot lead from you to who you swiped with. Once Sitchy orders lists to your taste, the order in which dishes were shown in a sitting is itself shaped by your taste, so someone holding both these records and your votes could work out which account's taste produced a sitting's order. The records still carry no account, device or install identifier, only we can read them, and nothing we run makes that match. The same is true of a Squad. Its swipes are labelled as a group's, with no account, and up to eight phones' sessions, each with an identifier of its own that is new for each Squad, could be read as one group's. And while the dishes you liked in a Squad are kept, they could be matched by the dishes alone to your phone's swipes in that Squad, which would tie those swipes to your account. Nothing we run makes that match.

Keeping the service up

To stop abuse we count the app's requests per install and per network address, and a sign-up on our website by its network address. We never store any of these values: they are salted, hashed, and deleted — rows older than two hours are cleared every hour.

If the app crashes, hangs or is shut down by the system, a diagnostic report goes to Sentry so we can fix it. Reports carry no account identifier and no email, error messages are scrubbed before they are sent, and we have configured our Sentry project not to retain network addresses or the locations derived from them.

What stays on your phone

Some things are kept only on your device: your shortlist, your last five searches (never one that names a diet or an allergy, and cleared with one tap), which restaurants your phone has already counted today, which photographs your phone has already counted as seen today and the counts waiting to be sent (photograph identifiers and days, naming no one), the counts of photograph steps waiting to be sent (a number for each place, step and day, naming no one) and which visits' buttons to add a photograph it has already counted as shown (the visit's and the dish's identifiers, the place and the day, kept six days and deleted when you sign into another account or delete yours), the dishes you hid (each with the day and whether our server has it yet), which reasons each dish you walk to or rate can offer you (the dish's identifier and the reasons, kept five days and deleted when you sign into another account or delete yours), your answer when you could not get the dish you walked to, until that trip ends, your ratings on that trip and which of them you added from the visit's other dishes, until the trip ends, each visit you rated in the last five days, for Recent visits in your Trail (the restaurant and its identifier, when the five days end, the visit's identifier, a one-way hash of your account, and for each dish you rated or began to rate there its identifier, name, your rating once Sitchy has saved it, whether it had a published photograph and whether you have sent one of it or been told Sitchy takes none) — no longer shown once the five days end and deleted the next time Sitchy starts or you rate a dish, and deleted at once when you sign into another account or delete yours, the one visit you left without rating (the restaurant, the dish, the moment your five days to rate it end and a one-way hash of your account), so Sitchy can ask you once more the next time you open the app — it is deleted when it has been asked, the next time you open Sitchy after the five days end, when you rate or could not get the dish, or when you sign into another account, whether the saved-dish reminder is on, whether you turned it off yourself (so Sitchy stops asking you to turn it on), the day it last reminded you and the area it watches, the range you chose this session (walking or further away; it goes back to walking three hours after you last used it), and, for each place where you chose further away, how many separate sessions you did so there (the place rounded to about 110 meters, for at most a hundred places), a note for Duo Mode and one for Swipe together saying that a pairing or a group may still be live (the area it was for, when you last used it and whether you left while offline and Sitchy still has to tell our server — never the code, a name or another member), kept until the next one replaces it or you leave and, if you left offline, until our server has answered or a week has passed, whichever is first, and sent nowhere, anything waiting to be sent while you are offline, copies of the dish photographs Sitchy has shown you (public pictures, kept so they need not be fetched again), and a record of which dishes this phone has already rated, and which it has reported as no longer on the menu — which is what stops the same phone rating or reporting one dish twice under two different accounts. Those records are kept against a one-way hash of the account, and they deliberately survive deleting your account, because otherwise deleting and starting again would be a way to vote, or report, twice.

What we never do

Who else is involved

We use a small number of companies to run Sitchy. They process data on our instructions and for no purpose of their own, with the one exception said under Cloudflare:

Walking times are worked out by your phone: it asks Apple Maps for the time between where you are and the restaurant. That request goes from your phone to Apple, not from our servers. If you tap to walk there and choose Google Maps or Apple Maps for directions, your phone hands the destination to that app, which is then governed by that company's privacy policy.

The map in your Trail shows where the dishes you rated are. Your phone asks us for your own ratings and each restaurant's place, and draws the pins itself; no one else sees your map, and it changes nothing anyone is shown. The map itself comes from Apple Maps, which your phone asks for the area on screen. Apple is sent nothing from your account: not the pins, the restaurants' names or your ratings. If you have let Sitchy use your location, your phone also marks where you are on that map; Sitchy keeps nothing new for it.

How long we keep things

Arrival records are deleted after five days, Walk There records after 90 days, swipe records after 13 months, abuse-prevention hashes within a few hours, and a restaurant's monthly count of how often it was looked up by name after two years. A restaurant's weekly totals are kept for two years. A launch waitlist entry is deleted once its email is sent, or two years after you joined; an entry on one of our website's lists once we have invited you, or two years after you joined. Your account, your ratings and the reasons you tapped after them, your progress, your saved places and your saved dishes are kept until you delete them, and a dish you hid until you show it again — we do not expire them on our own. A report that a dish is no longer on the menu is kept until a person has looked at the dish, or otherwise 30 days after your latest visit at which you made it — unless the dish is out of everyone's lists by then, when it waits for that look. If the dish is then taken off for good, the record that your report earned points is kept until you delete your account, or until that decision is undone. A photograph you began and never sent, or one we refused, is deleted about a day after you began it — a refused file at once; one waiting for review is kept until it is reviewed; a published one until it is taken down, retired from its dish's ten, or its dish is taken off the menu for good — then at once, or thirty days later for the other photographs of a dish taken off the menu for good, or twelve months later for the dish's best photograph, in case the dish comes back — and its count of how often it was seen for as long as we keep any record of the photograph, a retired or taken-down one's included; and a report on a photograph until you delete your account. A name that did not pass our check is kept 90 days, and then only counted. A handle you gave up is held at least 90 days, to a month's end, and then freed, and the count of handles you tried is kept for the day. A friend request is kept until it is answered or withdrawn, or 30 days; a friendship until either of you ends it; a block until you lift it; an invitation until it is used or withdrawn, or 7 days; whether you show your handle to your friends until you turn it off; and the counts of people you asked, invitations you made and links you tried that did not work, for the day.

We keep the 30 most recent nightly backups of our database, which include your account and sign-in records, so that a failure does not lose your data. When you remove a saved dish or a saved place, show a hidden dish again, turn a dish filter off, take back a reason you tapped after a rating, or a report you made on a dish is closed, or points a report earned are taken back, or you turn off being found by your handle, or a friend request is answered or withdrawn, or a friendship ends, or an invitation is used or withdrawn, or you turn off showing your handle to your friends, we keep a note of which record went — a random number that stood for it, and the day, nothing about you or what it held — so that restoring a backup cannot put it back. The note is deleted after thirty-five days, once no backup from before the removal can be restored.

Deleting your account, and what survives it

Deleting your account in Settings removes your account, the way you sign in, your verified arrivals, your progress, any pairing you are in — which ends it for the other phone too — any Squad you are in or have knocked at, which ends it for everyone in it if you started it, with the dishes you liked in it, your saved places, your saved dishes, the dishes you hid, your dish filters, your launch waitlist entry, any photograph not yet published, the reports you made on photographs and on dishes, the record of the points your reports on dishes earned, which dish filters we have offered you, your handle and whether you can be found by it, your friendships, the friend requests you made and were sent, the blocks you made and any made against you, your invitations and whether you show your handle to your friends, the name and email from your provider, and any name of yours that did not pass our check.

Some things deliberately remain, and you should know about them before you delete:

This website

sitchyapp.com runs no analytics and sets no cookies of our own. If you switch the site to dark mode, that preference is stored in your own browser and sent nowhere. Cloudflare, which serves the site, may set a cookie of its own to tell real visitors from bots. The two sign-up pages also load Cloudflare's check for bots, described above; every other page loads nothing from any other company. The restaurant portal loads two more scripts, both from our own site, and talks only to Sitchy's own server.

Your choices

In the app, under Settings:

To be taken off one of our website's lists, write to support@sitchyapp.com from the address you gave.

Depending on where you live you may also have the right to ask what we hold, to correct it, or to complain to a regulator. Write to support@sitchyapp.com and we will answer.

One honest limit: if you used Sitchy on a phone you no longer have and you signed in there with Apple or Google, sign in again on any phone to reach that account, or write to us and we will find it by your email. If you never signed in and never left an email for the launch waitlist, that account has no name, email or contact detail attached to it — which means nobody can identify it, including us, and we have no way to delete it on request. It holds your saved places, your saved dishes, the dishes you hid and any rating it made before rating needed a sign-in, and the arrival records in it are deleted after five days as normal. If you did leave an email for the launch waitlist and no longer have the phone, write to us from that address and we will remove it from the waitlist; we never use it to find, recover or delete the rest of the account.

Children

Sitchy is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has used Sitchy with an account that signed in with Apple or Google, write to us and we will delete it.

Where your data is held

Sitchy is operated from Atlanta, Georgia. Our database and server functions run in the United States (US East), and our crash reporting is hosted in the United States. If you use Sitchy from elsewhere, you are sending your data there.

Changes

If we change what we collect, we will change this page and update the date at the top. Material changes will be said in the app, not buried here.

Contact

Super Nova Software LLC, Atlanta, Georgia. support@sitchyapp.com