Privacy Policy
foodstrava is a personal food journal for street food: you drop a pin where you ate, add a photo of the dish, and tag how it felt. It is made and operated by Kamaljeet Sahoo, Bengaluru, India (“we”, “us”). This page says exactly what data the app touches and what happens to it. There is no fine print beyond what you see here.
What we collect
Your account. Email address, display name, a handle, and a password. The password is stored only as a salted hash — we cannot read it. Sign-in is email and password only; there is no Google, Apple, or other third-party login.
What you create. Photos of food, dish names, optional notes, three “feeling” tags per dish, and the location of the spot you pin. Notes are visible only to you, always.
Location. Used only while the app is open, with your permission: to start the pin where you stand, to centre the map, and to show distances. The location that gets stored is the spot's — the place you pinned, which you can move before saving. We never track location in the background.
Reports and blocks. If you report a dish, spot, or person, we store the reason you chose and any detail you typed. If you block someone, we store that block. Both exist to run moderation and to enforce blocks — they are not shown to anyone but us and, where relevant, whoever you blocked never sees that you did.
Diagnostics. If the app crashes, we receive the error message and stack trace, where in the app it happened, the app version, the build or update identifier, your OS name and version, and your account id if you were signed in — to us, not to any analytics company.
What is public
foodstrava is a shared map. A dish is visible on the public map, in Explore, and in search as soon as it's saved — there is no separate publish step. You control this three ways:
- Keep this one private on any dish hides that dish from everyone but you.
- Public profile off (in Settings) hides your name and handle on everything you've dropped — you show up as “Someone” instead.
- Blocking someone hides their content and activity from you everywhere in the app, including notifications.
Spots are shared places: pins from different people within 50 m merge onto one spot, so a spot's feelings are the consensus of everyone who ate there.
Who processes data for us
- Convex (convex.dev, USA) — hosts the database, photo storage, and sign-in. Everything the app stores lives here.
- Resend (resend.com, USA) — sends password-reset and moderation emails on our behalf. It sees your email address only when one of those is sent.
- Expo EAS Update (expo.dev, USA) — delivers app updates. It receives a random per-install identifier (not linked to your account) and, if the app crashes right after launch, a short error description — used only to tell a safe update from a broken one.
- OpenFreeMap (openfreemap.org) — serves the map tiles. Your device requests tiles directly, which — like any web request — carries your IP address and the map area you're viewing. We send them nothing about you beyond that.
- GitHub Pages (github.com, USA) — hosts this website, including this page and the app's terms of use.
- Cloudflare (cloudflare.com, USA) — provides DNS for foodstrava.com and forwards mail sent to hello@foodstrava.com to us.
That is the whole list. If it changes, this page changes.
Deleting your data
Settings → Delete account permanently removes your account, your dishes, photos, visits, saved spots, notifications, reports you filed, blocks in both directions (yours on others, and others' on you), and your sign-in credentials — immediately and irreversibly, from inside the app, no email required. A photo you upload but never attach to a dish (an interrupted upload, for example) is removed automatically within 24 hours regardless of whether you delete your account. A spot survives only if other people have also pinned it, because it is theirs too; your contribution to it is gone.
Security
Traffic is encrypted in transit. Passwords are salted and hashed. Session tokens are kept in your device's keychain. Password-reset codes are stored hashed and expire after 15 minutes.
Children
foodstrava is not directed at children under 13. If you believe a child has created an account, contact us and we will delete it.
Your rights
Your name and handle can be changed any time in Settings. Everything you've posted — every dish, note, and photo — can be edited or deleted from inside the app. To change the email address on your account, write to us and we'll take care of it. Depending on where you live you may have additional statutory rights (for example under India's DPDP Act or the GDPR); write to us and we will honour any reasonable request regardless of where you are.
Changes & contact
If this policy changes materially we will say so in the app. Questions, requests, or anything else: hello@foodstrava.com.