Privacy

What we keep

• Your email address, used to sign you in and to check you are a Cambridge student.
• The display name you choose. It is shown next to your reviews. Your email is never shown.
• Your college, if you choose to give it.
• Your ratings and review text, and any reports you make about other reviews.
• Technical logs, which include IP addresses, to keep the site running and stop abuse. Logs are kept for 30 days or less. To limit sign-ups we keep a scrambled (hashed) copy of the IP address for 24 hours.

We do not collect your date of birth, phone number or location. You must be 16 or older to make an account.

Who handles it

• Google Firebase Authentication handles sign-in and stores your email address.
• Cloudflare stores ratings, reviews and accounts (D1 database and Workers) and runs the Turnstile bot check on forms.
• Vercel hosts the website.

We do not use Google Analytics, advertising or tracking cookies. We may use Cloudflare Web Analytics, which counts page views without cookies and without identifying you. Sign-in keeps you logged in with data stored by Firebase in your browser.

We do not sell your data or share it with anyone else, unless the law requires it.

Why we can use it

Under UK GDPR (and India's DPDP Act for users there), we hold your account data to provide the account you asked for (contract). We show and score ratings because it is in the legitimate interest of students choosing where to eat, and we weight and moderate them to keep the ranking fair.

Your choices

• Edit or delete any of your reviews at My reviews.
• Download everything we hold about you as a JSON file at your account page.
• Delete your account at your account page. You choose whether your ratings are deleted too or kept without your name.

For anything else, including a complaint, email business@thatched.ai. In the UK you can also complain to the Information Commissioner's Office (ico.org.uk).