QuickBite Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account details (organizers): phone number (required), email and name (optional), your contact list (names and phone numbers you add), your session history, and your voting preferences.
• Participants: phone number (required to join and receive SMS), name (optional), voting preferences, opt-in/opt-out status, and consent records (timestamp, IP address, method).
• Communications: messages you send to us (e.g., support requests).

1.2 Automatically Collected

• Technical data: IP address, device/browser type, operating system, and interaction logs for security, debugging, and analytics.
• Cookies: essential session cookies (including CSRF protection). Optional analytics cookies as described below.

1.3 Information from Third Parties

• Restaurant data from Google Places and Yelp when you search or view options.
• SMS delivery metadata from our provider (e.g., delivery status, error codes) to operate the messaging program.

1.4 Information We Do Not Collect

We do not collect payment card data, government IDs, precise GPS location (only city-level for search), biometric data, health data, or financial account data.

2. How We Use Information

We use information to:

• Provide, secure, and maintain the Service;
• Send transactional SMS about sessions you join (invites, reminders, results);
• Record and honor consent, opt-outs, and requests;
• Diagnose and fix bugs, enforce Terms, and prevent abuse;
• Analyze usage in aggregate to improve the Service;
• Comply with legal obligations and carrier requirements.

Where required, we rely on your consent (e.g., to receive SMS), our legitimate interests in operating and improving the Service, and performance of a contract with you.

3. SMS Privacy & Choices

4. Cookies & Analytics

• Essential cookies keep you signed in and protect against CSRF.
• Analytics (optional): We use Amplitude to measure product usage in a way that does not include names or phone numbers. You can limit analytics by enabling browser Do Not Track, using content blockers, or disabling cookies in your browser. We honor Do Not Track by not loading analytics when it is enabled.

5. How We Share Information

We do not sell or rent your personal information. We share information only with:

• Twilio (SMS) — phone numbers and message content necessary to deliver SMS; we also receive delivery metadata.
• Google Places API — city-level location and search queries to find restaurants.
• Yelp Fusion API — search queries to fetch restaurant details.
• Render (hosting/database) — stores application data and logs.
• Amplitude (analytics) — event-level usage data without names or phone numbers.

We require service providers to use information only to perform services for us and to protect it appropriately. We do not share data with advertisers, data brokers, or social networks for advertising.

6. Data Retention

• Active accounts: We retain account and session data while your account remains active.
• Deleted accounts: When you request deletion, we delete profile and session data within 30 days; encrypted backups are purged after an additional 30 days.
• Consent records: Retained for at least 3 years.
• Logs: Server/application logs are retained as needed for security and operations.

7. Data Security

We use technical and organizational measures such as TLS encryption in transit, encryption at rest, access controls, password hashing, input validation, rate limiting, monitoring, and audit logs. No method of transmission or storage is 100% secure.

Incident response. If we discover a breach of security that affects your information, we will take steps to contain it, assess impact, and notify affected users and/or authorities as required. Where applicable, we aim to notify within 72 hours of confirmation of a qualifying incident.

8. Your Rights and Choices

Depending on your location, you may have rights to:

• Access a copy of your information;
• Correct inaccurate information;
• Delete your information;
• Request portability of certain information;
• Object to or restrict processing in certain circumstances;
• Opt out of analytics cookies and SMS as described above.

To exercise rights, email hello@skylarkcreations.com. We will respond within the timeframe required by law (typically 45 days) and may need to verify your identity.

State Privacy Disclosures (U.S.)

For residents of states with comprehensive privacy laws (e.g., California, Colorado, Connecticut, Utah, Virginia): we disclose the categories of personal information described in Section 1; we use and share them for the purposes described in Sections 2 and 5. We do not "sell" or "share" personal information as defined under state laws, and we do not process sensitive personal information. We will not discriminate against you for exercising your privacy rights.

Authorized agents may submit requests by emailing us with proof of authorization. We may require you to verify your identity directly.

9. Children's Privacy

QuickBite is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided information, we will delete it. Parents or guardians who believe their child has used the Service may contact us to request deletion.

10. International Users

The Service is operated in the United States and intended primarily for U.S. users. If you access the Service from outside the U.S., you understand and consent to the transfer, storage, and processing of your information in the U.S., where laws may differ from those in your country.

11. Changes to This Policy

We may update this Policy from time to time. For material changes, we will provide at least 30 days' notice via email, SMS, or in-product notice. Your continued use of the Service after the effective date constitutes acceptance of the changes.

12. Contact Us

Appendix: Subprocessors and Links to Their Policies

• Twilio (SMS): https://www.twilio.com/legal/privacy
• Google (Places API): https://policies.google.com/privacy
• Yelp (Fusion API): https://www.yelp.com/tos/privacy_policy
• Render (hosting): https://render.com/privacy
• Amplitude (analytics): https://amplitude.com/privacy