Privacy Policy

Tastellar is made by UEI Intelligent Labs LLC (“we”, “us”). This policy covers the Tastellar mobile app and this website, tastellar.com.

Most privacy policies describe settings you can change. The four rules below are not settings. They are enforced in our code and database schema, which is a stronger promise than a toggle: we cannot quietly reverse them without changing how the product is built.

• Private by default, forever. Every star you save starts visible to you alone.
• Journals never travel to other people. Your written memory lives in its own table that no share, no link and no public surface can reach. The exclusion is structural, not a setting. It leaves your device in one situation only: when you ask for a writing assist, described under AI features below.
• A 24-hour delay on public. Nothing you make public appears in real time.
• Photo GPS is used once, then dropped. The location data inside a photo file is read on your device to suggest a place, then destroyed. The coordinates you keep on a star are a different thing, and they stay. See Location below.

What we collect

In the app

• Account: email address, handle, display name, and an optional avatar. An account is optional: capture, imports and the world sky all work without one.
• Stars: photos you add, the dish and place you tag, the date the meal happened, and any journal text you write.
• When a photo actually leaves your device. Not whenever you save a star. The bytes go to our storage only when something needs them there: when you share a star at Links or Public, because the people you shared it with have to be able to load the image; and for Pro subscribers at any visibility, because a cloud backup that skipped most of what it was asked to protect would not be one. That leaves a case where the photograph never leaves your phone at all: a free account’s private star. It then exists in exactly one copy, which is worth knowing before you change phones.
• Location:a star remembers where it was. When you add one, your phone’s location is used once to suggest which restaurant you are in, and the coordinates you keep are stored with that star and synced to your sky, which is what puts it on the globe, so we hold them for as long as you keep the star. Separately, the location data embedded in a photo file is destroyed when we convert the image: the conversion writes a new file from decoded pixels, so no such block survives it.
• What that does not mean. We do not track where you go, we keep no history of your movements, and we never collect location in the background. A star with no location is still a star; it simply has no place on the globe yet. One deliberate exception: if you host a Table Mode QR, the link you generate carries the coordinates of that table so scanners can save the same place. That is your own table, and you choose when to show it.
• Your photo library, if you allow it. Tastellar can scan your camera roll to find meals you have already photographed, so years of history can become a sky. The scanning and classification happen on your device. We do not upload your library, and nothing is saved until you choose which photos to keep. You can decline and every other feature still works.
• The map, and what it no longer sends. The world sky used to draw its basemap from a third-party tile service, which meant the area you were looking at left your device. It does not any more: the globe now renders from map data shipped inside the app, so panning and zooming send no request to anyone, and opening the globe makes no network call at all.
• Reports: if you report a star, we record who reported it, which star it was, whose star it was, the reason you picked from a fixed list of six, and an optional note of up to 500 characters. The person you reported never sees any of it, and neither do you afterwards.
• Blocks: who blocked whom. Visible only to the person who created the block; the blocked person is never told.
• Notifications. If you turn notifications on, we store a push token for each device you use, along with whether it is an iPhone or an Android phone and when we last saw it. A push token identifies a device rather than a person, but we hold it next to your account so we can reach you, so we treat it as your data. We also keep a short record of which kinds of notification we sent you and on what day, so we do not send you the same thing twice.
• Turning notifications off, and signing out.You can turn them off at any time. Signing out marks this device’s token inactive, and nothing is sent to an inactive token. The record itself goes when you delete your account, which removes every token and the send history with it.
• Operational data: sync state, error logs, and a count of AI assists used, which is how the free daily allowance is metered.

On this website

• Waitlist: if you ask to be notified at launch, we store your email address and, only if you offer them, your city and how you describe yourself. We use these once, to tell you Tastellar is live.
• Table links: a tastellar.com/t/… link carries, in the link itself, the host’s handle and the dish, place and coordinates of a shared meal. Those pages are never indexed and never cached.
• Subscriptions: see Payments below.
• Server logs: our hosting and network providers keep short-lived request logs, including IP addresses, to serve the site and defend it from abuse.

What we never do

• We never sell your data, and we never share it with data brokers.
• There are no ads, no advertising identifiers, and no third-party tracking anywhere in the app or on this site.
• This website sets no cookies and loads no analytics. tastellar.com requests nothing from any third-party host: no fonts, no scripts, no pixels; fonts are served from our own domain.
• Photo EXIF metadata is stripped from stored images. Dates are kept for your timeline; GPS is discarded after a place is suggested.
• We never scrape or hotlink other people’s photos. Media is either yours or hosted by us.

Who can see your stars

• Every star is private by default, forever.
• Per star, you may widen visibility: Private → Links (your mutual connections) → Public.
• Links are mutual and severable. Severing one removes it in both directions and immediately deletes any crossings between your skies.
• A star you set to Public stays hidden for 24 hours before it appears anywhere public.
• After that delay, a Public star appears in exactly one place: the Explore screen, to signed-in people who deliberately switch to that scope. It is not on your home globe, there is no feed, and nothing pushes it at anyone. Somebody has to go looking.
• An optional home shield caps stars near your home at Links visibility, whatever else you set.
• A private star never produces a crossing, a suggestion, or any signal to another person.

AI features

Tastellar uses a large language model, provided by Anthropic, in two distinct places. They are worth separating, because one you ask for and the other happens as part of saving a star.

Writing assists: when you ask

Polishing your own fragments, asking a couple of questions to draw out a memory, or composing a three-line dish haiku. When you tap one of these, the text you are working on, including your journal text for that star, is sent to Anthropic to generate the response. Every draft comes back editable, nothing is saved until you accept it, and the model is instructed never to invent details you did not supply.

This is the single way journal text leaves your device. It goes to Anthropic to answer your request and to no one else. Never to another Tastellar user, never to a share surface.

Photo enrichment: part of saving a star

To suggest what a dish is, Tastellar can send the photo itself to Anthropic for captioning. Because our media bucket is private, this works by generating a temporary signed link that Anthropic’s service fetches the image from; the bucket is not public and the link is not durable.

Unlike a writing assist, this runs as part of the enrichment that follows a capture rather than from a button you press, so we call it out plainly here.

Three things bound it, and they are the honest ones:

• It happens only for Pro subscribers. On the free tier no image is sent for captioning at all.
• What goes is a resized 1024-pixel copy made for the captioner, never the full-size original you took.
• Only a photo already in our storage can be captioned, so the rule above decides the rest. A free account’s private photo is never captioned, because it is never uploaded in the first place. The other side of the same rule is worth saying plainly: for a Pro subscriber, a private star’s photo does sync, and can be captioned.

In both cases, your content is used to answer your request and is not used to train Anthropic’s models. Assists are metered, and the count of how many you have used is operational data.

Payments

Tastellar Pro is bought inside the app, from the App Store or Google Play. The store takes the payment and holds the payment method. We never see or store your card number. No card detail reaches us at any point, and your Apple Account and Google Account are not shared with us.

What we store is the minimum needed to know you are entitled to Pro: which store the subscription came from, which product you bought, the store’s own transaction identifier, whether the purchase was a live one or a test, and when the current period ends. That last date is not bookkeeping. It is what the app counts sixty days from before removing the cloud copy of your journals, so we keep it accurate.

Apple and Google send us a notification when a subscription renews, lapses, is refunded or enters a grace period. We ask them what is true rather than trusting the message, so those notifications add nothing to what is listed above.

The two stores are the only way to buy Pro. This website takes no payments at all and holds no payment processor of its own.

Who processes your data

We keep this list short deliberately. Every provider here is a processor acting on our instructions, and all of them are located in the United States.

How long we keep things

• Your stars and account stay until you delete them or close your account.
• Waitlist entries are kept until launch, and removed within a reasonable period after we have contacted you, or immediately, if you ask.
• Billing records are kept as long as tax and accounting law requires, typically seven years.
• Reports are kept for two years. They deliberately outlive the star they are about: a pattern across accounts is only visible if the record survives the content, and that pattern is often the whole evidence for acting.
• Blocks last until you lift them. Closing your account removes the ones you created.
• Push tokens last while notifications are on. Signing out on a device makes its token inactive, and deleting your account removes it outright.
• Notification send records are kept so we can avoid repeating ourselves, and are deleted with your account. We would rather say that plainly than name a period we do not yet sweep to.
• Server logs are short-lived and retained by our providers on their own schedules, generally measured in days.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or export it in a portable form. If you are in the European Economic Area or the United Kingdom you also have the right to object to or restrict processing, and to complain to your data protection authority.

If you are a California resident, you have the rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, and we never have, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

One thing worth being plain about: if someone accepted a Starpass from you, that star was copied into their sky by design. Deleting yours does not reach their copy, and theirs does not reach yours.

Children

Tastellar is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email us and we will delete it.

Security

Data is encrypted in transit and at rest by our providers. Access to production data is limited to those who need it. The rules at the top of this policy are enforced by database row-level security rather than by application code alone, so a bug in the app cannot quietly expose a private star.

No system is perfectly secure. If you find a vulnerability, please tell us at [email protected] before disclosing it publicly.

Changes

If we change this policy we will update the effective date above. If a change materially affects how we handle your data, we will tell you in the app or by email rather than relying on you to re-read this page.

Contact

UEI Intelligent Labs LLC: [email protected]