Privacy Policy

1. Information we collect

We collect the following when you use Lunchboxed (the website, the business dashboard and our mobile app):

• Account details: your name, email address, and sign-in method (email and password, or Google). We never see your Google password.
• Profile details you choose to add: handle, bio, location, and profile photo.
• Content you post: dish ratings, reviews, comments, photos, dish tags, suggested edits, reports, and places or dishes you add.
• Activity: places you save, people you follow, likes, notifications, and people you block.
• Location: if you allow it, your device’s approximate location to show restaurants near you. You can decline, and you can search by city instead.
• Business owners: claim details such as a phone number, work email, and any verification document you upload, plus listing content you manage.
• Technical data: basic logs such as IP address, browser type, and pages viewed, used to keep the service running and secure.

2. How we use it

• Provide the service: show ratings, rankings, your profile and your feed.
• Keep it accurate: review suggested edits, photos and reports, and award contribution points.
• Keep it safe: prevent spam and abuse, enforce our Terms, and act on reports.
• Notify you about activity such as likes, comments, follows and replies from restaurants.
• Give business owners aggregate insights, such as page views and button taps on their listing. We don’t tell owners who viewed their page.
• Improve Lunchboxed and fix problems.

We do not sell your personal information.

3. What is public

Your name (shown as first name and last initial), handle, profile photo, bio, ratings, reviews, photos, contribution level and points, and the people you follow are visible to other people, and may appear on public web pages that search engines index. Your email address is never shown publicly.

Please don’t post anything you wouldn’t want others to see.

4. Who we share it with

We use service providers to run Lunchboxed. They process data only on our behalf:

• Supabase: database, authentication and file storage.
• Google: if you choose Google sign-in.
• Mapbox: map display and map images. Map requests include the area being viewed.
• Our hosting provider, for serving the website.

We may also disclose information if required by law, to protect people’s safety or our rights, or as part of a merger or sale of the business. Restaurant listing data comes in part from Overture Maps Foundation and its contributors.

5. Cookies and local storage

We use cookies and similar storage to keep you signed in and remember simple preferences. We don’t use them for advertising.

6. Your choices and rights

• Edit your profile and settings at any time.
• Delete your account from Settings. This removes your profile and the content tied to it, though some content that others have already built on, such as an approved edit to a place, may remain without your name.
• Block or report other users.
• Turn off location access in your browser or device settings.
• Ask us for a copy of your data, or for it to be corrected or deleted, by emailing us.

Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR. Contact us and we’ll respond within a reasonable time.

7. Retention and security

We keep your information while your account is active and delete it after you delete your account, except where we must keep it for legal or security reasons. We use industry-standard protections, but no system is perfectly secure.

8. Children

Lunchboxed is not for children under 13, and we don’t knowingly collect their information. If you believe a child has given us information, contact us and we’ll delete it.

9. Changes to this policy

If we make material changes we’ll update the date above and, where appropriate, notify you in the app or by email.

10. Contact

Questions or requests: support@lunchboxed.io.