Privacy Policy

Last updated: April 25, 2026

1. Data Controller

DishRank SAS is responsible for processing your personal data.

DPO contact: contact@dishrank.fr

2. Data Collected

Sign-up: email, username, display name, password (encrypted), profile picture.
Content: reviews, ratings, dish photos, restaurant names, comments, reactions.
Social data: friendship graph, friend requests, group memberships, private messages exchanged in groups, message reactions, polls, votes and RSVPs for outings, history of restaurants chosen by the group.
Location: geolocation (only with your explicit consent), used to show nearby dishes and compute a group centroid.
Technical: device type, OS, unique identifier, push token, app version, language.
Usage: in-app interactions and preferences (only if you enabled usage statistics).

3. Purposes

Account creation and management
Publishing and displaying your reviews and photos
Providing the social features: friends, groups, chat, polls, outings
Recommending restaurants near a group's centroid
Sending notifications (likes, comments, friend requests, messages, outings, popular dishes)
Content moderation and enforcement of the community guidelines
Service improvement and anonymized statistical analysis

4. Legal bases

Performance of contract: account, reviews, friendships, groups, chat, outings
Consent: location, push, marketing, usage statistics
Legitimate interest: security, abuse prevention, moderation, reports
Legal obligation: log retention required by law

5. Retention period

Account and profile: deleted within 30 days of the request
Reviews, photos, reactions, group messages, polls: kept while published, deleted with the account
Friendships: deleted with the account of either party
Groups: auto-deleted when only one member remains; history preserved for remaining members
Resolved reports: 12 months
Location data: not stored permanently, used in real time
Push tokens: cleared on logout or account deletion
Technical logs: 12 months maximum

6. Data sharing

Your data is hosted and processed by:

Supabase (hosting, auth, photo storage) — servers in Europe
Expo Application Services (build, push relay)
Apple Push Notification Service and Firebase Cloud Messaging — only push token and message payload
OpenStreetMap Overpass (nearby restaurant search) — only approximate coordinates
Google Maps (opening directions) — only on your explicit request

We never sell your data. No data is shared with other users without your explicit action.

7. International transfers

Data is primarily stored in Europe. Some sub-processors (Apple, Google for push) may process data in the US under standard contractual clauses approved by the European Commission.

8. Your rights (GDPR)

Access, rectification, erasure, portability (JSON export including reviews, friendships, group memberships, sent messages)
Objection, restriction, withdrawal of consent
Block a user from their profile
Report content from any review, comment, message or profile

Exercisable from Settings → Personal data, or by email to contact@dishrank.fr.

9. Security

Password hashing (bcrypt)
HTTPS/TLS encryption in transit
At-rest encryption on Supabase (AES-256)
Row Level Security: access limited to your own data or content explicitly shared
JWT tokens with automatic renewal

10. Minors

The app is intended for users aged 16 and over.

11. Complaint

CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr

12. Contact

contact@dishrank.fr — DishRank SAS, Paris