Privacy
This is a product about where you are and what you are drinking, which is about as personal as ordinary data gets. The design decisions below are structural: they are properties of how the data is stored, not promises about how we intend to behave.
What happens to your location
The browser is only ever asked for a position after you tap. Nothing is requested silently, and refusing is a first-class path: searching by postcode, town, area or landmark works exactly as well.
They are held in a first-party cookie so that server-rendered results are right on the first paint. They are truncated to about a metre, because storing more precision than a distance calculation needs would be storing it for no reason.
Before a search is recorded for demand analysis it is coarsened to a geohash cell roughly a kilometre across, and the event carries no user identifier at all. It can answer "what does M1 want". It is structurally incapable of answering "where has this person been".
Identity
Searching, browsing and reading every price needs no account and no email. Contributing creates a pseudonymous id in a cookie on your device, so that points can accrue somewhere; it carries no name, no email and no device fingerprint. The only feature that will ever require a way to contact you is an alert, because a notification needs somewhere to go.
Evidence
Check-in photos and receipts are stored under opaque keys and are never public URLs. A receipt is used as evidence of a price; the personal parts of it are not published, and extraction drops card numbers, names and loyalty identifiers rather than storing them.
Your rights
Clearing the cookie ends the association between this device and its contributions. A full export and deletion route belongs here and is on the roadmap rather than built; until it is, this page says so instead of implying otherwise.