Privacy policy

Last updated: 22 August 2026

flatwhitebread ("we") is operated by Kay Huang, based in New Zealand. This policy explains what personal information we collect and what we do with it. We handle personal information in accordance with the Privacy Act 2020.

What we collect

Your email address and password — to create and secure your account. Passwords are stored hashed by our authentication provider; we never see them.
Your display name — shown publicly beside your reviews.
Your location, when you check in — we record the coordinates your device reports and how far that was from the restaurant. This is the only way to verify you were actually there.
Your reviews and ratings — published publicly, with your display name.
Details you add to a review — how long you waited for a table, how long the food took, how long you were there, how busy it was, who you were with, roughly what you spent per person, and what you ate. All optional. All published with your review, except that spending and party details are only ever shown combined with other people's — never attributed to you individually.
Photos you upload — published publicly with your display name once we've checked them. Photos are re-saved by your browser before upload, which removes the location and camera information cameras normally embed in them.
What you tap — which food filters you choose and which kinds of restaurant you check in to. We use this to put the filters you actually use first and to make recommendations less generic. It is private to you: you can see it, and deleting your account deletes it.
Who you follow, and what you like — following someone, and following a list, are public in both directions, as they are on any social site. The number of likes on a review is public.
Your favourites and your "want to go" list — private by default. A favourites list becomes public only if you choose to share it. Your want-to-go list and its notes are always private.
Your profile — your picture, your description, the part of town you eat in and the cuisines you pick as favourites are all shown publicly on your profile page.
Suggestions you send us — the message, and your email address if you give one so we can reply.
Decisions we make about your content — when we approve or remove a review or photo we record that decision and the circumstances around it, so moderation can eventually be consistent and partly automatic. It is never published.
Basic technical information — standard server logs kept by our hosting provider.

What is public, in one place

Public: your display name and profile, the part of town you say you eat in and the cuisines you pick as favourites, your published reviews and the details attached to them, your photos, who you follow and who follows you, lists you have chosen to share, and the number of likes on a review.

Public in one further way, which is worth stating plainly: your profile shows a map of the places you have published a review about. It is drawn only from reviews you chose to publish — never from check-ins on their own — the points are rounded to roughly a hundred metres before they leave our server, and it does not show how often you went anywhere.

Private: your email address, your check-ins themselves, your bookings, your want-to-go list, favourites lists you haven't shared, the filters you tap, and anything you send us through the suggestions box.

What we don't collect

We don't track your location in the background. Location is read at two moments and no others: when you press the check-in button, and when you ask Near me to find restaurants around you. Both are things you press, and your browser asks your permission before either. We don't collect payment details — if and when we take payments, our payment provider handles card data and we never see it.

Why we collect it

To run the service: to let you sign in, to verify that reviews come from people who actually visited, to display reviews, and to investigate misuse.

And to make the site useful: the optional details on reviews are combined across everyone who has been somewhere to work out how long a meal there usually takes and what people order, so the site can answer questions like "I have 45 minutes, where can I eat near me?". Those answers are built from many people's reviews together, not from any one person's.

We don't sell your information, we don't share it with advertisers, and we don't use it to build a profile of you for anyone other than you.

Who else sees it

Supabase — our database and login provider. Your data is stored in their Sydney, Australia region.
Vercel — hosts the website.
Google — supplies restaurant information and maps. When a map or a search runs, Google receives the area being looked at and may collect information under its own privacy policy. We do not send Google your name, your email address or your account.
Resend — sends our emails. Booking confirmations contain your name, phone number and booking details, and are processed in the United States.
Stripe — processes subscription payments from restaurants. Card details go directly to Stripe and are never seen or stored by us.

Sharing with restaurants

When you request a table, the restaurant is sent the name, phone number and any notes you provided, so they can confirm the booking and contact you. Only restaurants that have claimed and verified their listing receive this.

Because our providers store data outside New Zealand, your information may be held overseas. We rely on providers who offer comparable privacy safeguards.

How long we keep it

Account information for as long as you have an account. Check-in records for 12 months, since after that they no longer verify anything. Reviews stay published until you delete them or we remove them under our review policy.

There is no self-serve delete button, and that is a deliberate choice rather than an omission: a review is evidence about a restaurant, and one account disappearing shouldn't quietly change what everybody else sees.

Instead, ask and we'll do it. Use the Report link under any review or photo — including your own — to have that one thing taken down. To close your account entirely, email k.y.huang1013@gmail.com from the address you signed up with; we remove your account and everything that identifies you, and reply within 20 working days.

This is your right under the Privacy Act 2020 and we will not make it difficult. It is a slower path than a button, and the only reason it's a person rather than a button is that removing published reviews deserves a moment's thought.

Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you, and ask us to correct it. You can also ask us to delete your account and reviews.

Email k.y.huang1013@gmail.com and we'll respond within 20 working days.

Complaints

If you're unhappy with how we've handled your information, tell us first. If we don't resolve it, you can complain to the Office of the Privacy Commissioner.