Privacy Policy

What is stored

An account identifier and the email address you signed in with, and no name unless a sign-in provider hands one over. Your password is never stored by us in readable form: it goes to our authentication provider, which keeps only a salted hash of it, and we do not log it.

The entries you log: dish, restaurant, rating, whether you would order it again, your note, what you paid, the date, and a photo if you add one. Nothing else about you is collected.

While you are offline, entries wait on your own device until they can be sent.

The account, and why there is one

You need an account to log a dish, to edit or delete an entry, to attach a photo, and to use the palate chat. Reading needs none: the map, the search and every dish and restaurant page are open, and nothing is created for a visitor who is only reading.

You sign up with an email address and a password. That address is how the account is identified, and it is stored. The password is passed through our server to the authentication provider and kept there only as a salted hash; if you forget it, we cannot read it back to you.

Your entries hang off that account, which is the whole reason it exists — they reach any device you sign in on and they survive a cleared browser. A diary that dies with a cookie is not a diary.

Entries written with no signal wait in your browser’s storage until it comes back, signed in or not. One written before you signed in is adopted by the first account that signs in on that device, so signing in costs you nothing you typed.

An account created before sign-in was required may have no address attached. It still works, it is still yours, and it is reachable only from the browser that made it — adding an address at any time fixes that, and no entry moves when you do.

Private by default

Every entry is private when you create it. A private entry is not shown to anyone else, is not part of any public average, and is not visible on the dish or restaurant page. Making one public is an explicit choice you make per entry.

Photos

Photos are kept in object storage. The address of a photo attached to a public entry is public — treat it as published. Deleting the entry deletes the photo with it.

What the assistant sends to the model provider

The palate chat needs an account with an address attached; it is not offered to a visitor looking around, nor on an old account that never got one. It reads your whole log and each answer costs real money, which is the honest reason for the limit.

When you use the palate chat, a condensed version of your own log — dish names, restaurants, ratings and your notes — together with a list of candidate dishes from the catalog and the message you typed, is sent to the model provider so it can produce an answer.

Under that provider’s API terms, what is sent is not used to train their models. If you would rather nothing about your log left the service, do not use the chat; everything else works without it.

Cookies

Functional only. Supabase Auth, the provider that handles sign-in, sets the cookies that carry your session once you have signed in — that is what keeps you signed in between visits. Read the site without signing in and no session cookie is set at all. A language cookie (morsel_lang) remembers whether you read this in English or Spanish.

Your light or dark preference is kept in your browser’s local storage rather than in a cookie, and so are the entries still waiting to sync.

There are no advertising cookies and no third-party tracking.

Who else handles it

The provider that hosts the database and sign-in, the object storage that holds photos, and the model provider that answers in the palate chat. They process data to run the service and nothing more. Nothing is sold, and nothing is shared for advertising.

Deleting

You can delete an entry at any time. A marker is kept in its place so a device that was offline cannot resurrect it on the next sync; that marker holds no content.

Deleting the whole account is a button on the account page in the app. It removes your entries, your photos and your palate profile, and it does not ask us first.

What it does not remove is the catalog: the fact that a dish exists at a restaurant, and the public averages other people’s entries feed. Those are shared and are not about you — after the deletion, nothing in them is attached to you, and your own entries stop counting toward them. The button is the fast path; [email protected] is the fallback if it fails or you would rather ask.

Contact

Questions about any of this: [email protected].