Privacy Policy

Last updated October 10, 2026

Safebite helps people with food allergies find restaurants and menu items that are safe for them. To do that we need to know some sensitive things about you, like your allergies and where you are. This policy explains what we collect, why, who else sees it, how long we keep it, and the choices and rights you have.

1. Who we are

This policy covers the Safebite apps for iPhone and Android, the Safebite web app at app.suppersquad.app, the restaurant portal at restaurants.suppersquad.app, this website, and the emails we send (together, "Safebite", "we", "us" or "our"). Safebite decides how and why your personal information is used, which makes us the "controller" or "business" responsible for it under privacy laws.

If you have questions, email support@suppersquad.app. If you don't agree with this policy, please don't use Safebite.

Safebite is a planning tool, not a medical service. Our allergen information comes from restaurants and can be wrong, so always confirm with the restaurant before you order. See our Terms of Service.

2. What we collect

Information you give us

Information created when you subscribe

When you start a free trial or subscription, we keep a record of your plan, its status, when the trial started and ends, when it renews, whether you've cancelled, whether your account has already used its one free trial, and which store sold it (web, App Store or Google Play), with the reference numbers that store gives us. We never receive or store your full card number, security code or bank details. Stripe handles web payments, and Apple and Google handle in-app purchases. See Subscriptions and free trials.

Information collected automatically

• Restaurant searches. To find nearby restaurants, the app sends coordinates to our servers. We round them to about 100 meters and don't keep a history of your searches.
• Server logs. Our servers record which feature was used, whether the request worked, how long it took and error details, so we can keep Safebite running. They don't record your email, allergies, location or other personal details.
• Network and device data. Like any website or app, the companies that host Safebite process your IP address, browser or app version and device type to deliver pages and stop abuse. For example, we limit how often someone can try to sign in.
• Device storage. The app keeps a small amount of data on your device so you stay signed in and the app loads faster. See Cookies, device storage and tracking.

Device permissions

Safebite asks before it uses location and before it sends notifications (when we offer them). You can say no and still use Safebite: type an address instead of sharing your location. You can change either permission at any time in your phone's or browser's settings. Safebite doesn't access your contacts, photos, camera, microphone, calendar or health app data.

What we don't collect

• We don't collect your phone number, home address (unless you type it as your search location), government ID, or photos of you.
• We don't use advertising identifiers, advertising cookies, cross-app tracking or third-party analytics.
• We don't buy information about you from data brokers or other companies.
• We don't collect biometric information.

3. Allergy and health information

Your allergy profiles describe a health condition, so many laws treat them as sensitive or "consumer health" information, and so do we.

• Why we collect it. Only so Safebite can show which menu items are free of the allergens you avoid. That is the core of the service, and it can't work without it.
• Your consent. We collect allergy information only when you choose to enter it, and you can change or remove it at any time in the app. By adding allergens to a profile, you agree to our using them to filter menus for you. You can withdraw that consent by removing the allergens or deleting the profile or your account.
• How it's protected. Profiles are stored in a database table encrypted with a dedicated encryption key that we control, and only the Safebite service can read them.
• What we never do. We never sell allergy information, share it with restaurants, use it for advertising, or use it to make decisions about you such as pricing, eligibility or insurance. We don't combine it with information from other companies.
• "May contain" warnings. When a restaurant marks an item as "may contain" one of your allergens, Safebite treats it as unsafe for you. This is a filter on menu data, not a medical assessment.

Washington, Nevada and some other states give you specific rights over this kind of information. See the Consumer health data notice.

4. Children and child profiles

Accounts are for people 13 and older. Safebite isn't directed at children under 13, and we don't knowingly let them create accounts. If you are 13 to 17, a parent or guardian must agree to our Terms for you.

Child profiles

Many of our users are parents of children with food allergies. A parent or legal guardian can add an allergy profile for a child to their own account. The child doesn't use Safebite or give us information. The parent does.

• What a child profile holds: the child's allergens and, only if the parent adds them, a name and a birthday. We recommend a first name, initials or a nickname rather than a full name. A birthday is optional.
• Parental consent and control. By adding a child profile, you confirm that you are the child's parent or legal guardian, or have their permission, and you agree to our using the profile to filter menus for that child. You can review, edit or delete the profile at any time in the app, and deleting your account deletes every profile in it.
• No marketing or profiling. We never use child profile information for marketing, advertising or profiling, never sell or share it, and never contact the child.
• Requests about a child profile come from the parent or guardian whose account holds it. We verify that account holder and answer them.

If you believe a child under 13 has created their own account or given us information without a parent, email support@suppersquad.app and we'll delete it.

We don't sell or share the personal information of anyone we know to be under 18, and we don't show anyone targeted advertising.

5. Location

• When. Only while you're using Safebite, and only if you allow it. Safebite doesn't track your location in the background.
• What we keep. The address you choose as your search location, and its coordinates, so the app opens near you. You can change or remove it at any time.
• Searches. When the app looks for restaurants, it sends coordinates rounded to about 100 meters. We don't store a history of searches or places you've been.
• Address lookups and maps. To turn a typed address into a map location, and to draw the map, your device contacts the mapping services listed in Who we share it with. They receive the address text or map area and your IP address.

Some laws treat precise location as sensitive information. We use it only to show restaurants near you.

6. Subscriptions and free trials

Using Safebite requires a Safebite Premium subscription. This section explains what happens to your information when you subscribe. The full subscription terms, including prices, the free week, renewal and cancellation, are in section 4 of our Terms of Service.

What we record, and why

• Proof of your agreement to the renewal terms. When you start a web subscription or free trial, we record the date and time, the plan, the price, the trial length and which version of our pricing you saw. Automatic renewal laws (for example in California and New York) require us to keep this. We keep it even after your account is deleted, without your email, allergies or other personal details. See How long we keep it.
• One free trial per account. We record that your account has used its free week or referral month so it can't be used again.
• Subscription status. We keep your plan, status, trial end and renewal dates up to date from Stripe, Apple or Google so we know what you have access to.

Emails about your subscription

These are service emails, not marketing, so you'll get them even if you've turned marketing emails off:

• a confirmation when your free week or subscription starts, with the date it ends or renews, what you'll be charged, and how to cancel;
• a reminder before your free week ends and before each annual renewal;
• receipts, failed-payment notices and, if a price ever changes, notice before the new price applies.

For web subscriptions, Stripe sends these emails for us using your email address.

App Store and Google Play subscriptions

If you subscribe in the iPhone or Android app, Apple or Google sells the subscription, processes the payment, sends its own receipts and reminders, and handles cancellation and refunds under its own terms. We receive only your subscription status, product, dates and the store's reference numbers.

Referral month

A valid referral code gives a new web account one free month without a payment method. Nothing is charged automatically when it ends. You choose whether to subscribe.

7. How we use information

We don't sell or rent personal information. We don't use it for targeted advertising, and we don't make automated decisions about you that have legal or similarly significant effects. If we want to use your information for a new purpose that isn't compatible with these, we'll ask you first.

8. Who we share it with

We share information only with the service providers that run Safebite for us. Each one may use it only to provide its service to us, under a contract that requires confidentiality and security.

We share information with others only in these situations:

• Restaurants never receive your allergy information, location or contact details.
• No other users can see your profiles, allergies, location or saved restaurants.
• Legal reasons. If the law requires it, for example a valid court order, or to protect someone's safety, prevent fraud, or enforce our Terms. Where we're allowed to, we'll tell you first.
• Business transfers. If Safebite is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. This policy, or one at least as protective, would continue to apply to your information, and we'd tell you before it becomes subject to a different policy.
• With your permission, when you ask us to.

Apple, Google, Stripe and the mapping services use information they receive under their own privacy policies too.

9. Cookies, device storage and tracking

We use only what Safebite needs to work. There are no advertising or analytics cookies, pixels or tracking SDKs.

• Sign-in cookie. A secure cookie set by our API (api.suppersquad.app) keeps you signed in. It can't be read by scripts or other websites.
• Device storage. The web app and phone apps store small things on your device: your onboarding answers until your account is created, display hints, and cached data so the app loads faster.
• Third-party services. Stripe's checkout and subscription pages, and Apple's and Google's sign-in and purchase screens, may use their own cookies under their own policies.

Do Not Track and Global Privacy Control. Because we don't track you across websites or sell or share information for advertising, there's nothing for these signals to switch off. We still treat a Global Privacy Control signal as a request to opt out of any sale or sharing, as California and other states require.

10. How long we keep it

Deleting your account. When you delete your account, you're signed out on every device and the account is locked straight away. Web and Google Play subscriptions stop renewing. Apple doesn't let us cancel App Store subscriptions, so cancel those in your iPhone's Settings. You have 30 days to sign in and restore the account. After that, your sign-in, email address, profiles, allergies, birthdays, location, saved restaurants, settings and subscription record are permanently erased. See how to delete your account.

11. Your choices and rights

Things you can do yourself, any time

• See and edit your profiles, allergies, location and preferences in the app.
• Turn off location in your device settings and type an address instead.
• Stop marketing emails with the unsubscribe link in any marketing email, or by emailing us. You'll still get service emails about your account and subscription.
• Cancel a subscription in Profile → Manage subscription (web) or in the App Store or Google Play subscription settings.
• Delete your account in Profile → Delete account. See how to delete your account.

Requests you can make

Depending on where you live, you may have the right to:

• know whether we process your personal information, and access it;
• get a copy of it in a portable format;
• correct it;
• delete it;
• withdraw consent you've given, for example for allergy information or marketing;
• object to or restrict certain uses;
• limit the use of sensitive information (we already use it only to provide Safebite);
• opt out of sale, sharing for targeted advertising, or profiling (we don't do any of these);
• get a list of the categories of third parties, or the specific third parties, we've disclosed information to.

How to make a request. Email support@suppersquad.app from the email address on your account and tell us what you'd like. To protect you, we'll confirm the request comes from the account holder before acting on it, and we use what you give us only for that check. You can also ask someone to act for you (an "authorized agent"). We'll ask for proof that you authorized them and may still need to confirm your identity with you.

Timing. We'll respond within 45 days, or within one month for requests under UK or EU law. If we need more time, we'll tell you why, as the law allows.

Appeals. If we decline your request, you can appeal by replying to our answer or emailing support@suppersquad.app with "Privacy appeal" in the subject. We'll answer in writing within the time your state's law sets (usually 45 or 60 days) and explain our decision. If you're still unhappy, you can contact your state attorney general.

No discrimination. We won't charge you more, give you a worse service or deny you service because you used your privacy rights.

12. US state privacy rights

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with consumer privacy laws have the rights described in Your choices and rights. This section gives the extra details those laws require.

Categories of personal information we collect

In the last 12 months we've collected the following categories, from the sources and for the purposes described above. We have not sold any of them, and have not shared any for cross-context behavioral advertising. We disclose them only to the service providers in Who we share it with, for the business purposes in How we use information.

We use sensitive personal information only to provide Safebite and for the other purposes these laws allow, such as security. We don't use it to infer characteristics about you. How long we keep each category is in How long we keep it.

California "Shine the Light". We don't share personal information with third parties for their own direct marketing.

Nevada. We don't sell covered information as Nevada law defines it.

13. Consumer health data notice

This notice is for residents of Washington (My Health My Data Act), Nevada, Connecticut and other places with laws about consumer health data. It applies to the allergy information in your and your child's profiles.

• What we collect: the allergens you or your child avoid, and the profile type (you, a child or a friend).
• Where it comes from: only you, the account holder, when you enter it in the app.
• Why: only to show which menu items are free of those allergens, and to keep your account working. We collect it only with your consent, given when you add the allergens.
• Who receives it: only Amazon Web Services, which stores it encrypted for us. We don't share it with any other company, and we never sell it.
• No geofencing. We don't use location to identify or track people visiting health care services.
• Your rights: to confirm whether we have your consumer health data and see it, to see a list of everyone we've shared it with, to delete it, and to withdraw your consent. You can do most of this in the app: edit or remove allergens, delete a profile, or delete your account. Or email support@suppersquad.app. If we decline a request, you can appeal as described in Your choices and rights.

14. Users outside the US

Safebite is run from the United States, and your information is stored and processed in the US. If you use Safebite from the United Kingdom, the European Economic Area or elsewhere, your information is transferred to the US, which may not have the same data protection laws as your country. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses with our service providers.

If you're in the UK or EEA, you have the rights listed in Your choices and rights, our legal bases are listed in How we use information, and you can complain to your local data protection authority (in the UK, the Information Commissioner's Office). We'd appreciate the chance to help first.

15. Security

• All data travels over encrypted connections (HTTPS/TLS).
• Everything is encrypted when stored. The tables that hold your account and allergy profiles use a dedicated encryption key that we control.
• Passwords are handled by Amazon Cognito and stored only as salted hashes.
• The web app keeps your short-lived sign-in token in memory rather than in browser storage, and renews it with a secure cookie that scripts can't read.
• Only the Safebite service can read your data, with the minimum permissions it needs. Our staff access personal data only when needed to support you or run the service.

No system is perfectly secure, so we can't guarantee that information will never be accessed without permission. If a breach affects your information, we'll tell you and the authorities as the law requires.

16. Restaurant accounts

If you use the restaurant portal or ask us to list your restaurant, we collect your name, email address, role and business details, along with the menus, photos, files and allergen information you provide. We use this to create and maintain your listing and to contact you about it. We publish restaurant names, addresses, hours, photos and menus so diners can find them. We don't publish your personal contact details. Restaurant accounts never see diners' personal information.

17. Changes to this policy

We'll update this policy when Safebite changes. The date at the top shows when it last changed. If a change is material, for example a new use of allergy information, we'll tell you in the app or by email before it takes effect, and where the law requires it, we'll ask for your consent.

18. Contact us

Questions, requests or complaints about privacy: support@suppersquad.app. Please put "Privacy" in the subject so it reaches the right person quickly.