Privacy policy

Last updated: 5 October 2026. FoodELO is run as a hobby by [name], who is responsible for your data (the “controller”). This policy explains what we collect, why, and for how long. Questions or requests: [contact email].

What we collect

Votes

Voting is anonymous unless you're logged in. To stop abuse we store each vote with a time and a one-way hashed identifier derived from your connection, which we cannot turn back into your IP address. Hashed identifiers are deleted after 30 days; the votes themselves stay in the ranking. Tournament votes work the same way, so that everyone votes once per match.

Accounts (optional)

If you create an account we store your email address, your display name, how you log in (email link or Google) and which votes you cast while logged in or chose to add to your account, so we can show your taste profile on any device. Logging in sets cookies that keep you logged in; they are strictly necessary for the account to work. You can download your data or delete your account at any time from your account page. Deleting removes your details; your votes stay in the world ranking but are no longer linked to you.

Bot check

To keep automated votes out, voting and our forms use Cloudflare Turnstile, which checks your browser without puzzles in most cases. Once you pass, we set one strictly necessary cookie that remembers this for two hours (a day when you're logged in). It contains no personal data.

Dish submissions, photos and tips

Submitting a dish needs an account. We store what you send us, linked to your account, and list it with its review status on your account page. Photos are resized and stripped of camera and location details before an editor sees them; approved photos are published with the dish. Logged-in visitors can also send a photo for an existing dish; if you ask to be credited, your display name is shown with the photo. Published dishes and photos stay when you delete your account, without your name.

Contact messages

Your name, email address and message, kept for as long as needed to answer you.

Visit statistics

We count visits with Vercel Web Analytics, which uses no cookies and doesn't follow you across sites or days. It records the page, where you came from, your country, browser and type of device, never your IP address, and only as totals that can't be traced back to you.

Error reports

When something breaks, an error report goes to Sentry: what went wrong, on which page, and your browser and operating system. We remove IP addresses, cookies and account details before it's sent. Reports are deleted after 30 days.

Stored in your browser

Without an account, your votes for your taste profile are kept in your browser's local storage. You can clear them at any time from the Your taste page or your browser settings.

Why we may use it

• Votes, the bot check, abuse prevention, error reports and statistics: our legitimate interest in a fair ranking and a working, secure site.
• Accounts, submissions, tips and contact messages: to provide what you asked for.

What we don't do

• We don't sell personal data.
• We don't use advertising or tracking cookies, so there's no cookie banner.

Backups

The database is backed up every night. Backups are encrypted and kept for 30 days, so anything you delete is gone from them after a month at the latest.

Your rights

Under the GDPR you can ask to see, correct or delete personal data we hold about you, and object to how we use it. Most of this you can do yourself on your account page; otherwise email [contact email] and we'll respond within one month. You can also complain to your national data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).

Service providers

These companies process data for us under data processing agreements. Where they're outside the EU, transfers are covered by the EU–US Data Privacy Framework or the EU's standard contractual clauses.

• Vercel — hosts the website and counts visits (Web Analytics) (USA, servers worldwide).
• Supabase — database, logins and photo storage (database in Frankfurt, Germany).
• Cloudflare — the Turnstile bot check on voting and forms (USA, servers worldwide).
• Resend — sends login links and emails about your submissions (USA).
• Sentry — reports errors on the site so we can fix them (USA).
• Unsplash — most dish photos are loaded directly from Unsplash (USA).
• Google — only if you choose “Continue with Google” to log in (USA).
• GitHub — stores our encrypted nightly database backups (USA).