STARVY PRIVACY POLICY

Account data. When you create your account, we collect your email address or phone number, name, and username. Starvy has no passwords: you sign in with a one-time code sent to your email or phone, or with Sign in with Apple or Google. If you use Apple or Google, we receive the account information that provider releases to us. If you request an invitation, we collect the email address and any Instagram handle you provide.

Profile data. Anything you choose to add to your profile, such as a photo, bio, or city.

Your content. The spots you add to guides, guides, notes, comments, photos you upload, bookmarks, and the curators or friends you follow. Guides and their content are visible according to your privacy settings. Bookmarks are private. Your name may appear on guides you curate and content you share.

Location data. The Service is built around places. We process the locations of the spots you save and view. In addition, with your permission, we collect your device's location to show you spots near you and to center the map on where you are. You can grant or withdraw this permission at any time in your device settings; the Service remains usable without it.

Optional Visit Suggestions. If you enable Visit Suggestions and grant Always and Precise Location access, Starvy uses your iPhone's visit detection to recognise longer stops while the app is closed. Visit Suggestions includes visits after you leave by default when you opt in; you can turn that option off separately. When you open Starvy, your current location or a qualifying recent stop's location may be sent to Supabase and Google Places to suggest nearby restaurants. Your route and visit times are not uploaded. You always choose what to add to your guide, and iOS may delay visit updates. See Section 5 for local storage and expiry.

Contacts. If you use Find friends and grant contacts access, Starvy sends your contacts' phone numbers to our server to check which belong to Starvy accounts. Those numbers are used for that check and are not stored. Contact names remain on your device. You can decline or revoke contacts access and continue using Starvy.

Usage and device data. Basic technical data generated when you use the app: device type, operating system version, app version, language, timestamps, account identifiers, and interaction events (such as opening the app, switching tabs, or adding spots). We process this information and handled technical errors with PostHog to operate, secure, and improve the Service.

Notifications. If you enable notifications, we store the push token issued for your device and associate it with your account to deliver notifications.

Reports and support requests. We keep reports and feedback you submit, linked to your account so we can respond. A bug report can include a screenshot and technical context, such as your device model and app version. Uploaded screenshots are stored with Cloudinary.

Communications. If you contact us, we keep the correspondence.

We do not collect special categories of data (such as health or religious data) and ask that you do not include such information in your content.

Under the GDPR and UK GDPR, we rely on the following legal bases:

To provide the Service — creating and operating your account, displaying your content according to your settings, syncing across devices, and sending transactional messages such as one-time sign-in codes and confirmations. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

To secure and maintain the Service — authentication, abuse and fraud prevention, debugging, enforcing our Terms. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in keeping the Service safe and functional.

To improve the Service — understanding usage patterns and technical errors so we can improve Starvy. We use PostHog for product analytics associated with your account identifier. Session replay and automatic crash capture are disabled. We do not use advertising SDKs or track you across other companies' apps and websites. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).

To communicate with you about the Service — product updates via the Dispatch or email. You can opt out of non-essential communications at any time. Legal basis: legitimate interests; consent where required by local law.

To comply with legal obligations — responding to lawful requests, tax and accounting duties. Legal basis: legal obligation (Art. 6(1)(c) GDPR).

We do not sell your personal data, and we do not use it for third-party advertising.

We share personal data only with service providers who process it on our behalf under data processing agreements, and only as needed to run Starvy:

• Supabase — database, authentication, storage infrastructure, nearby-search requests, and delivery of transactional emails such as one-time sign-in codes. Your database data is hosted in the European Union (Frankfurt, Germany).
• Cloudinary — storage and delivery of photos you upload, including bug-report screenshots.
• PostHog — product analytics and handled technical errors, as described in Section 2, using its European Union service.
• Google — Sign in with Google, if you choose it, and Google Places for restaurant search and nearby results. Search text and relevant coordinates are sent to Google to return results.
• Twilio — delivery of one-time sign-in codes by SMS, if you sign in with a phone number.
• Apple — app distribution, Sign in with Apple, and push notification delivery via APNs.

Text messages. If you sign in with a phone number, we send you a one-time sign-in code by SMS. We send these messages only when you request a code — we do not send recurring, promotional, or marketing text messages. Message and data rates may apply.

No mobile information is sold or shared with third parties or affiliates for marketing or promotional purposes. Your phone number is shared only with our SMS delivery provider, Twilio, for the sole purpose of delivering your sign-in code.

We do not use advertising providers. If you choose to share a spot or guide through another app, such as Instagram or TikTok, the content you share is handled by that service under its own privacy policy.

We may also disclose data if required by law, to protect our rights or the safety of users, or in connection with a merger, acquisition, or sale of assets (in which case this policy continues to apply to your data until amended).

Other users of the Service see the content you make visible to them under your settings. That sharing is governed by your choices in the app, not by this section.

Your data is primarily stored in the European Union (Frankfurt, Germany). However, Starvy, Inc. is a US company, and our team may access data from the United States or other locations to operate, secure, and support the Service; certain providers (such as Apple) may also process data in the US. For users in the EU, UK, and Switzerland, these transfers are protected by safeguards recognized under applicable law: the EU Standard Contractual Clauses (with the UK Addendum or IDTA), and, where a provider is certified, the EU-U.S. Data Privacy Framework. You may request a copy of the relevant safeguards via privacy@starvy.com.

Local visit information. Visit Suggestions stores only your current visit and latest eligible completed stop on your phone, in protected files excluded from backups. Current visit information expires within 12 hours of arrival; a completed stop can be suggested for up to two hours after departure, subject to the same 12-hour limit. One local prompt-area record remembers dismissals and also expires within 12 hours. Expired records are removed the next time Starvy checks them; deletion is not guaranteed while the app is closed. When Starvy detects revoked location access, or you sign out, it clears these records. Disabling Visit Suggestions clears visit records. Visit times and routes are not uploaded.

We keep your data for as long as your Vault exists. If you delete your Vault, we delete or irreversibly anonymize your personal data within 30 days, except where we must retain it longer to comply with legal obligations, resolve disputes, or enforce our agreements, and except for residual copies in encrypted backups, which are purged on a rolling basis within 90 days. Waitlist emails that never convert to an account are deleted within 12 months of collection.

If you are in the EU or UK, you have the right to:

• Access the personal data we hold about you and receive a copy;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to processing based on legitimate interests;
• Port your data to another service in a machine-readable format;
• Withdraw consent at any time, where processing is based on consent, without affecting prior processing.

You can exercise most of these directly in the app (edit your profile, delete content, delete your Vault) or by emailing privacy@starvy.com. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority — for users in Berlin, the Berliner Beauftragte für Datenschutz und Informationsfreiheit; in the UK, the Information Commissioner's Office (ICO); or the authority of your place of residence.

Users in California and other US states with applicable privacy laws have rights of access, deletion, and correction, and the right not to be discriminated against for exercising them. We do not sell or "share" personal data as defined under the CCPA/CPRA. Requests: privacy@starvy.com.

Starvy is not directed at children. You must be at least 16 to use the Service. We do not knowingly collect personal data from anyone under 16; if we learn that we have, we will delete it. Parents or guardians who believe a child has provided us data can contact privacy@starvy.com.

We use appropriate technical and organizational measures to protect your data, including encryption in transit, hashed credentials, access controls, and row-level security on our database. No system is perfectly secure, and you use the Service at your own risk to the extent permitted by law. If a breach affects your data in a way that triggers legal notification duties, we will notify you and the competent authorities as required.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you. Editorial curation decisions (such as which guides are featured) are made by humans.

We may update this policy as the Service evolves. Material changes will be announced via the Dispatch, email, or an in-app notice before they take effect. The current version is always available in the app and at starvy.com/privacy.

Starvy, Inc.
169 Madison Avenue, STE 38404
New York, NY 10016, USA
privacy@starvy.com