Privacy Policy

Last updated: 2026-10-15

NomBot ("we" or "us") is built by Zamaylo LLC, a one-person studio in Texas. We take your privacy seriously and try to collect as little data as possible while still giving you great food recommendations. This policy explains what information we collect, why we collect it, and what choices you have.

1. Information We Collect

Provided by you

• Account details from Apple Sign-In or Google Sign-In: typically your email address, display name, and a Firebase user ID assigned to your account.
• Food preferences you configure inside the app, including favorite cuisines, dietary restrictions, and similar taste settings.
• Spin history and feedback you give on restaurants NomBot recommends (thumbs up/down, saves, skips).
• If you invite a friend or join with a friend's invite code: the invite code, which account it belongs to, and which account used it.
• Any messages you send us when you contact support via the contact form on this website.
• Your email address if you sign up for our newsletter through the website. Signing up is entirely voluntary.

Collected automatically

• Your device location, when you ask NomBot to find restaurants near you or start a Group Spin near you. The app asks for precise location, and you can change or turn off location access at any time in your device settings. We use your location to run that search and do not keep a history of where you have been. If you use "Spin somewhere else" to choose a city, that spin searches around the city you chose and does not use your device location. While you type a city name, the text you type is sent to Google to suggest matching places, together with your last known location if you have shared it, so nearby matches show first. We do not store or log what you type. We keep short-lived counts and times of these searches, linked to your account, to enforce usage limits; they are deleted automatically.
• Basic device information (device model, operating system version, app version) needed to keep the app working and compatible.
• Crash diagnostics via Firebase Crashlytics when the app crashes or throws an unexpected error. Crash and diagnostic reports are associated with your account identifier so we can investigate issues linked to specific accounts.
• In-app interaction signals linked to your account, such as which restaurant cards you tap into, which action buttons (for example directions, phone, website) you use, places you save, cards you skip past, places you mark as visited, and general session activity patterns. Once you have enough history, we use the restaurants you open, the actions you take (directions, calls, website visits), the places you save, the places you mark as visited, and your spin history to rank the restaurants we recommend to you and to build your Flavor Map. This is free for every signed-in account. You can delete this data at any time by deleting your account via Profile > Account.
• When you choose to share a restaurant recommendation, we record that you shared it (the restaurant and a randomly generated share identifier, linked to your account) so we can create the share link and understand how the sharing feature is used.
• NomBot Coins and the NomBot Week Pass. For each account we keep a wallet: how many coins you have, which coins you bought and which you got for free, when each free coin expires, and when your Week Pass ends and how many of its extra spins you have used today. We also keep a record of every coin movement (coins added, spent, given back after a failed spin, expired, refunded or forfeited) and a record of each purchase: the product, the price and currency, the store country, the store's transaction ID, the time and whether it was later refunded. We also keep a record of any refunded purchase whose coins were already spent, and any hold this places on free coin rewards. We do not receive your card or payment details; Apple or Google handles payment.
• Invite (referral) checks. When you open your invite code or use a friend's code, the app sends a hashed value made from information your device provides (on iPhone, an identifier Apple gives each app maker for that device; on Android, information about the device). It is not used for advertising or tracking. We store it with the invite code (up to five per code) and with the claim, and use it only to stop a device from claiming its own invite and to prevent other invite and free-coin abuse. It is deleted when the account that owns that record is deleted.
• Group Spin. When you start a Group Spin, we store the table's search location, the name each guest types to join, and the votes and food filters at the table. Guests join from a web page without an account. Group Spin data is deleted automatically, usually within two days after the table is created.
• When you visit our website (nombot.app), basic website usage information: pages viewed, links and buttons clicked, referring page, technical error reports, device and browser details, and an approximate location derived from your IP address. This is anonymous website analytics; it is not linked to your NomBot app account.

2. How We Use Your Information

• To operate core app functionality, letting you sign in, sync preferences across devices, and see your spin history.
• To generate restaurant recommendations based on your preferences, your location or the city you choose, the places you hide or have seen recently, and, once you have enough history, the activity signals described above. This applies to every signed-in account.
• To manage your account, including your NomBot Coins balance, Week Pass, Founders access, and account deletion, and to apply purchases and store refunds to the right account.
• To detect and prevent fraud, abuse, and violations of our Terms of Service, including refunded purchases of coins that were already spent and attempts to collect free coins or invite rewards more than once.
• To improve the app by reviewing aggregate, non-identifying usage and crash data.
• To create the public link when you share a restaurant recommendation, and to measure how sharing performs using anonymous, aggregate view and tap counts.
• To send you occasional product emails. When you create a NomBot account, we may send you product emails (new features, important updates, and the NomBot newsletter). Every such email includes a one-click unsubscribe link, and you can opt out at any time, including via our contact page. If you subscribe via our website, we use your email solely for the newsletter.

About shared links: When you tap Share on a restaurant, NomBot creates a public web page via a NomBot share link that shows the restaurant and NomBot's note about it. Anyone you send the link to can open it, and the page is not indexed by search engines. A shared page never includes your name, email, or any other personal information; only the restaurant and NomBot's take. We count anonymous views and tap-throughs on shared pages to measure the feature; we do not identify the people who open a shared link.

3. Service Providers

NomBot relies on a small number of trusted service providers to run. We only share the minimum information each provider needs to do its job:

• Firebase (Google): authentication, Firestore database for your preferences, Crashlytics for crash diagnostics, and App Check, which uses Apple and Google device checks to confirm that requests come from the real NomBot app. These services process technical data such as your IP address and device verification tokens to keep sign-in and our servers secure.
• Google Firebase Analytics (GA4): collects usage and interaction analytics (e.g., features used, screen views, session activity) to help us understand how the app is used and where to improve it. Analytics data is pseudonymous and governed by Google's privacy policy.
• RevenueCat: processes in-app purchase receipts for NomBot Coins, the Week Pass and Founders, and tells us when a purchase is completed or refunded. RevenueCat stores purchase history and a pseudonymous identifier tied to your account. Payment itself is handled by Apple or Google.
• Google Places / Google Maps: powers restaurant search, city search for "Spin somewhere else", and map views. Location and city search queries run against Google's APIs in real time.
• OpenRouter: we use OpenRouter to generate recommendation and personality text from language models. We do not send your email, name, or other personally identifying information to OpenRouter.
• PostHog: product analytics used both on this website and inside the NomBot app. On the website, PostHog collects anonymous usage data only (pages viewed, clicks, technical error reports, device and browser information, and an approximate IP-based location) that isn't linked to your NomBot account. In the app, PostHog collects the same class of in-app usage and interaction analytics as GA4 above (e.g., features used, which restaurants you interact with, identified by a restaurant ID rather than its name or reviews, and purchase events such as which product you bought and whether the purchase went through), tied to your account.
• Cloudflare: manages our website's domain settings and forwards the website's analytics requests to PostHog through go.nombot.app. To route and secure that traffic, Cloudflare handles technical request data such as your IP address. We do not use Cloudflare for advertising or to build profiles of visitors.

We do not sell your personal information. We do not share it with third parties beyond the service providers above. NomBot does not run cross-app or cross-site tracking, does not present an App Tracking Transparency prompt, and does not integrate with advertising networks. Our website honors your browser's Do Not Track (DNT) setting: if DNT is enabled, we skip website analytics collection entirely. You can turn app usage analytics off anytime in the app under Settings > Privacy.

4. Data Retention

We retain your account information and preferences for as long as your account is active. When you delete your account, we start deleting your personal data as soon as you confirm. If a step cannot finish right away, it finishes automatically afterward. Deleting your account also permanently removes any NomBot Coins (bought or free) and any Week Pass time left on it. They cannot be restored or moved to another account, and deleting your account does not by itself issue a refund. Some records are kept after deletion: billing history required by Apple or Google; purchase records held by RevenueCat; purchase event records we receive from RevenueCat, kept for a limited period for billing audit; our own coin purchase and coin movement records, kept for refunds, tax and accounting, with your account ID replaced by a one-way pseudonym; a one-way pseudonym of your account ID and the deletion date, kept so that late purchase or reward events cannot recreate a deleted wallet; if you bought Founders, the Founders purchase record with its store transaction ID, no longer linked to your NomBot account, so the purchase can still be restored from your store account; and security and audit log entries, kept for a limited period. If a friend joined with your invite code, their invite record stays on their account with your account ID replaced by a pseudonym.

5. Your Rights

You can access or update most of your information directly inside the app. To permanently delete your account and associated data, use the in-app "Delete Account" button under Profile > Account. Deletion is final. A few records are kept after deletion, as described in Data Retention.

If you are located in the European Economic Area, the United Kingdom, or California, you may have additional rights under laws such as the GDPR or CCPA, including the right to access, correct, export, or restrict processing of your data. We honor those rights on request; please contact us using the link below.

We use your in-app activity to personalize the restaurants we recommend. To limit this, or to exercise a right to object where the law gives you one, you can clear your spin history in the app under Settings > Manage History, delete your account under Profile > Account (this also deletes the other activity signals described above), or email us at hello@nombot.app. Clearing your spin history does not remove those other signals. There is no setting that turns personalization off while you keep using your account, so new activity is used for your recommendations again.

Newsletter and marketing emails: Every newsletter or marketing email we send includes a one-click unsubscribe link. You may also unsubscribe at any time via our contact page. We will process unsubscribe requests promptly and will not send further marketing emails once you have opted out.

6. Children's Privacy

NomBot is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it.

7. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes, we will also notify you by email or with an in-app notice before the changes take effect.

8. Contact

Questions about this policy? Reach out via our contact page.

This policy is provided for informational purposes and is not legal advice. Please consult your own counsel for definitive interpretation.