Privacy policy

Lik, a California corporation ("Lik", "we"), runs the Lik app and lik.social. This policy says what we collect, why, who can see it, who helps us process it, how long we keep it, and your choices, including your rights under the California Consumer Privacy Act as amended by the CPRA (CCPA). Contact: founder@lik.app.

The short version: we collect what Lik needs to work. We do not sell your personal information and we do not share it for cross-context behavioral advertising. Advertisers never learn who you are. Food recognition on photos runs on your device.

1. What we collect and why

Account and sign-in

What: name, username, profile photo, and the identifier from Apple or Google sign-in, or your email address or phone number if you sign in with a code. If you used an earlier version of Lik, a one-way hash of your Apple ID or phone number is used to reconnect your old account.
Why: to create and secure your account and show your profile.
Birthdate: asked once at sign-up to confirm you are 13 or older. It is kept private, never shown on your profile, and not used for advertising.

Taste profile

What: the cuisines and foods you pick, your flavor answers, and a taste signal built from your reviews (for example your taste archetype, Taste Title and palate ranges).
Why: to personalize Explore, Lik Suggestions, Taste Match and Taste Table, and to place you on taste leaderboards.

Reviews, posts, stories, guides and comments

What: the text, dish scores, flavor ratings, restaurant ratings, dish names, captions, photos, videos, stories, comments and guides you submit, which restaurant or product they are about, and whether you ate in, took out or had it delivered.
Why: to show them, rank dishes, restaurants and products, and award XP, quests, bounties and rewards.

Photos and photo metadata

What: for a review photo or video we collect the capture time, the device location when taken, the location accuracy, a few location readings around the shot, whether the location looks simulated, a file fingerprint (SHA-256), a perceptual fingerprint used to spot repeat photos, and labels from on-device food recognition. For a photo you pick from your library we read the location and time stored in the photo itself (EXIF) if present. The app asks for permission to read photo locations on Android.
Why: to check that a review was made at the restaurant ("proof"), prevent reused photos, and set how much a review counts. The proof rules are in the Terms of Service.
Public images: photos you post are visible according to your post and account settings. We never publish the raw location data attached to them.

Precise location

When: only with your permission and only while the app is open (iOS "While Using"; Android fine and coarse location). We use it to show nearby restaurants, products in nearby stores, events and map results; to preselect the place when you start a review; to check proof for a review photo; and to place you in a city for local leaderboards.
What we keep:
- Location at review capture is saved with that review's photo proof (point, accuracy and a few readings) for as long as the review exists, and is deleted when the review or your account is deleted.
- Nearby and map lookups send your position or the map area to our servers to answer the request. We do not build a location history from them. The map shows your position only to you, never to other members, and the Trending map shows places and posts, never people.
- Our servers' request logs, which can include your IP address and the coordinates of a lookup, are kept for up to 7 days.
You can turn off location in your device settings. Lik still works with search and manual place selection; reviews without location proof earn no rewards.

On-device food recognition

Dish suggestions use food recognition that runs on your phone. The photo is not sent to a recognition service. The resulting labels (for example "ramen") may be attached to your review as part of proof.

Barcodes

When you scan a product in Shelf, the camera reads the barcode on your phone and only the barcode number is sent to look up the product.

Contacts (only if you choose)

What: if you tap Connect under "From your contacts", the app asks for permission, reads your address book on your phone, and sends only one-way SHA-256 hashes of the email addresses and phone numbers in it. Names and the rest of your contacts never leave your phone.
Why: to show which of your contacts are already on Lik. The hashes are compared with members' hashes and then discarded; we do not store them.
Being found: for the same matching, we keep one-way hashes of your own confirmed email address and phone number. "Let people who have my email or number find me" in Settings, Privacy is on by default; turn it off and you will not appear in anyone's contact matches.

Messages

What: direct and group messages, photos in messages, reactions, read status, food plans, polls and quest cards shared in chats, and reports you make.
Why: to deliver messages and keep members safe. Messages are stored on our servers and are not end-to-end encrypted. We do not read them routinely; we may review a message that is reported.

Activity, games and rewards

What: follows, likes, saves, favorites, blocks, notifications, quests and the parties you join, bounties, events you save, host or mark Going, streaks, daily goals, leagues, XP, Rank Score and Palate Score, tickets, Lik Coins, badges, stamps, Arcade runs, Season Pass progress, and the Lik Rewards you claim and use.
Why: to run those features, settle rewards and prevent abuse.

Usage data

What: when you open Lik, which screens and tabs you open, and steps such as finishing sign-up, saving a place, starting or posting a review, searching (never what you type), sharing an invite and claiming a business, with the app and system version. These events carry a random analytics ID, not your name, email or account ID.
Why: to learn which features help people find food they love, and to fix what doesn't.
Your choice: the Usage data switch. It is on by default, shown when you sign up, and in Settings, Privacy. With it off, the app sends no usage events.
Active days: to count active members, we record each day you open the app while signed in. This does not depend on the switch and is deleted with your account.

Personalized Explore

What: your saves, reviews and the places you open.
Why: to rank Explore and Lik Suggestions for you.
Your choice: the Personalized Explore switch, on by default, shown when you sign up and in Settings, Privacy. With it off, Explore is not ranked from your activity.

Notifications and device

What: a push token (from Apple, or from Google's Firebase Cloud Messaging on Android) if you allow notifications, your notification preferences and quiet hours, your sign-in sessions (device type, time), and basic crash reports.
Why: to send the notifications you chose, let you review and sign out sessions, and fix crashes. Quiet hours default to 10 PM to 8 AM in your time zone. Crash reports are limited to error type and code location, with names, messages and URLs removed.

Safety records

What: reports, automated moderation scores, staff decisions, appeals, and flags such as impossible travel, copied photos, accounts that score in lockstep, or repeated fake dish names.
Why: to keep scores honest, enforce the Community Guidelines and give you a way to appeal.

Business accounts

What: business and legal name, your role, contact phone and email, verification documents you upload (for example a business license, ownership proof or photo ID), menu and venue content, team members and roles, bounties, rewards, events and campaign activity, and, if you connect it, Google Business Profile connection details.
Why: to verify and review your application and run your business tools. See the Business Terms.

Payments

Lik sells nothing in the app during the pilot: the paid Season Pass is switched off and there are no other purchases. We do not collect card details. If paid features are turned on, Apple or Google will process the payment and we will receive a record of the transaction, not your card. We will update this policy first.

What we do not collect

We do not collect your precise location in the background, your contacts' names or details, your calendar, or advertising identifiers, and we include no third-party advertising or tracking SDKs.

2. What other people can see

Public by default: your name, username, profile photo, Taste Title, and the reviews, posts, stories, guides and comments you publish. Each dish score you give also feeds that dish's public Lik Score.
Private account: with a private account, only followers you approve see your posts. You can also choose who sees your Likes, Saved, Guides, Badges, Taste and Passport.
Leaderboards and leagues: your weekly league rank and league XP are shown to the others in your league. If your account is private, they see "Lik member" with no name, photo or profile link. Private accounts are left off the Likers boards.
Parties and group chats: members of a Duo or Group Quest party see each other and each other's progress on that quest. Others in a group chat see how many people joined, not who.
Events: friends may see that you marked an event Going.
Taste sharing: comparing taste with another member or joining a Taste Table uses your taste only with your consent, and you can withdraw it.
Lik Rewards: when you use a reward, the venue's staff see your name, username and profile photo, and when you claimed and used it.
Businesses and advertisers: venues see your public reviews and any messages you send them. Advertisers see only totals, such as impressions and taps, never who you are.
Blocking: when you block someone, they cannot see your profile or posts, and each of you is left out of what the other sees on boards, counts and parties.

3. Where it comes from

From you, from your device (location, camera, photos, push token and, if you choose, contact hashes), from Apple and Google when you sign in, from restaurants and brands, from public restaurant and product catalog data, and from other members who interact with you.

4. How we use it

To run Lik; to verify reviews and prevent fraud; to calculate scores, ranks and rewards; to moderate content; to personalize your feeds; to show sponsored cards for your city; to send notifications; to review business applications; to secure the service; to answer you; and to comply with law. We do not use your content to train our own AI models.

5. Who processes it for us

We use these service providers. They process data for us under their terms and only to provide their service.

Supabase: database, sign-in, file storage and server functions.
Cloudflare: hosting, the lik.social website, network edge, and media storage and delivery.
OpenAI: automated moderation of text, images and video thumbnails, and, for businesses, reading menu photos, PDFs and web pages to draft a menu. Content is sent for that purpose only.
Mux: upload, processing and streaming of video.
Twilio: sends sign-in codes by text message to your phone number, through Supabase.
Apple and Google: sign-in, push notifications, app stores, maps (Apple Maps on iPhone) and, for businesses, Google Business Profile.
Map tiles on Android: the map loads tiles from OpenFreeMap, which sees your IP address and the map area requested.
Sentry: crash reports with personal data removed.
PostHog: product analytics: the usage events above, under a random analytics ID, stored in the United States. PostHog is set to discard the IP address of every event it receives. Events received before November 12, 2026 may still include one; Lik does not use it, and those events are deleted on the schedule in section 8.

We also disclose information when the law requires, to protect someone's safety, and in a merger or sale of the business.

In the last 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 16. Sponsored cards are chosen by campaign and city, never by giving your identity to an advertiser.

7. California categories (last 12 months)

Identifiers (name, username, email, phone, sign-in IDs, push token): collected; disclosed to processors above.
Customer records and commercial information (rewards, quests, coins): collected; disclosed to processors.
Internet or app activity (follows, likes, saves, views of sponsored cards, usage events and the days you use the app): collected; usage events disclosed to PostHog as a processor.
Geolocation (precise): collected as described in section 1.
Audio, electronic, visual information (photos, videos, voice in video): collected.
Inferences (taste profile): created.
Sensitive personal information: precise geolocation, account log-in, and the contents of your messages. We use these only to provide the service you asked for, to keep it secure, and to prevent fraud, so there is no separate "limit the use" setting to turn on.

8. How long we keep it

Your account data: until you delete your account.
Deleted account: deleting starts a 14-day grace period in which you can cancel. After it, your data is purged and cannot be recovered. We keep only a one-way digest receipt that a deletion happened.
Review photo proof and location: with the review, until the review or account is deleted.
Captures saved on your phone and never posted: up to 14 days.
Contact hashes from your address book: not stored; discarded after matching.
Menu photos and PDFs a business uploads for import: deleted after the menu is extracted.
Google Business Profile permission: the connection token is used once and revoked right after.
Verification documents: kept after the application or verification ends, so we can settle disputes about who may manage a venue, until you ask us to delete them. Deleting your account does not delete them automatically; email founder@lik.app and we will delete them within 45 days.
Moderation decisions and appeals: kept with your account; appeals can be filed within 30 days of a decision.
Active days and your data choices: until you delete your account.
Usage events: 12 months, then deleted. Deleting your account deletes the link between your analytics ID and you.
Server logs: up to 7 days.
Crash reports: up to 90 days.
Backups: we do not currently keep database backups. If we start, they will roll over within 30 days, so deleted data leaves them within 30 days.
Content classified as sexual content involving minors is isolated and may be kept as required by law.

9. Your choices and rights

You can, in the app: edit your profile, make your account private, choose who sees your Likes, Saved, Guides, Badges, Taste and Passport, turn Usage data, Personalized Explore and contact discovery on or off, block and mute, manage notifications and quiet hours, see and sign out sessions, export your data, and delete your account (Settings, Account security and data).

California residents also have the right to:

Know what we collect, use and disclose, and get a copy;
Delete personal information (we may need to keep some data for safety or law);
Correct inaccurate information;
Opt out of sale or sharing. We do not sell or share, so there is nothing to opt out of. If that changes we will add a "Do Not Sell or Share My Personal Information" control and honor Global Privacy Control signals;
Limit use of sensitive personal information (we use it only as described above);
Not be treated worse for using these rights.

To use a right that the app does not cover, email founder@lik.app from the address on your account, or have an authorized agent do so. We may ask you to confirm your identity. We reply within 45 days (extendable once by another 45 days).

10. Children

Lik is not for children under 13. The sign-up birthdate gate refuses anyone under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, email founder@lik.app and we will delete it. Members 13 to 17 can use Lik; we do not sell or share their data.

11. Security

We use encryption in transit, keep sign-in credentials in the iOS Keychain and Android Keystore, restrict who can read data, and check permissions on the server. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

12. Where data is stored

Our providers may store and process data in the United States and other countries.

13. Changes

If we make material changes, we will tell you in the app before they take effect and update the date at the top.

14. Contact

Lik, 723 Brookcliff Circle, San Ramon, CA 94583. Email: founder@lik.app.