Built to know less about you.
What Munchl collects, what it deliberately doesn't, and how the protections work, written for people who want the technical answer. For the legal version, read the privacy policy.
Chats between people are end-to-end encrypted.
Messages are encrypted on the sender's phone and can only be decrypted on the recipients' phones. Munchl's servers store and relay ciphertext they cannot read.
| Key agreement | Each device creates an X25519 key pair. The private key stays in the phone's secure storage; only the public key is published. |
|---|---|
| Message encryption | Every message gets a fresh AES-256-GCM key. That key is wrapped for each member (including the sender) with a shared secret derived through X25519 and HKDF. |
| Photos, videos, voice | Encrypted with their own key before upload; storage holds opaque binary blobs. |
| Notifications | Chat pushes name the sender only ("New message", or "Sent a message in <group>"). The message text is never in a notification. |
| Replies | A quoted reply is rebuilt on your phone from the decrypted original; the quote is never stored on the server. |
| Disappearing messages | Per chat: off, 1 hour, 1 day or 1 week. |
Location is used for specific jobs, each with its own limits.
Your location makes the feed and map useful. Beyond that, each use is narrow and kept to the minimum it needs.
Nearby places
Your live position sorts the feed and the map. Your last position is cached on your phone so the app opens instantly.
Your usual places
Learning where you're usually local (to time bucketlist nudges) needs two separate consents: location and personalisation. Without both, nothing is collected.
Confirming visits
While the app is open, your position is checked against nearby places so posts and reviews can be marked as real visits. Fake or low-accuracy positions are ignored.
Orders
Pickup arrival sharing is optional, only runs for an active order, and stops when you tap Stop or the order ends. For delivery, the location shared is the delivery person's, and it's cleared once the order is delivered.
Crawls
No one can read another participant's coordinates, not even other members of the crawl. The server only answers yes or no questions ("is anyone live?", "is the group spread out?").
Photo location
When you post a photo from your gallery, its embedded GPS is only used to check whether it was taken at the tagged place.
Real visits and real reviews.
A food app is only as good as its honesty. Visits are confirmed by the server, never by the app's own claim.
| Content | Counts as verified when any of these is true | If not verified |
|---|---|---|
| Post tagging a place | You spent 3+ minutes within 100 m in the last 30 days · the photo's own GPS is within 200 m · you posted within 150 m · you completed a dine-in or pickup order there | Still on your profile, but left out of other people's Discover |
| Review | A confirmed visit in the last 90 days · written within 150 m · a completed dine-in or pickup order · a deal redeemed there | Shown without the verified mark |
Posts go live immediately, then get checked.
There's no waiting room for posts. Instead, every upload runs through an automatic safety sweep right after it's published, and anyone can report anything.
Automatic sweep
Rate limiting, duplicate detection, and an automatic image check for nudity and harmful content. A post that fails is taken down.
Reports
Any post can be reported. Reports land in a moderation queue in the admin console.
Place photos
Photos people add to a place's Media tab are moderated before they appear there.
Blocking
Blocking hides posts, comments and profiles in both directions and hides your personal chat.
Every audience setting, in one table.
All of these are in Settings in the app. They're enforced by the database, not just hidden in the interface.
| Setting | Options | Effect |
|---|---|---|
| Private account | On / Off | On: follows need your approval and non-followers see only your profile header. Your posts never appear in Discover. |
| Who can see my bucket list | Everyone · Close friends · Only me | "Everyone" means whoever can see your profile. Close friends aren't told they're on the list. |
| Who can see my view counts | Everyone · Only me | Hides the play counts on your posts from others. |
| Hide follower counts | On / Off | Hides the numbers and the lists themselves, even if someone opens the list's address directly. |
| Blocked accounts | List | Mutual invisibility of posts, comments, profiles and personal chats. |
| Notifications | Per category, per chat | Muted notifications aren't stored at all. |
| Dietary restrictions | Allergens, diets, your own words | Filters menus and is added to your orders. You can switch it off per order. |
Establishments see totals, not people.
Places get what they need to serve you and to understand what's working. Nothing more.
| Data | Visible to the place? |
|---|---|
| Your order, display name, table or pickup time, note and allergies | Yes, to prepare it |
| Delivery address | Yes, for delivery orders only |
| Your arrival estimate | Yes, only if you share it for a pickup order |
| Which post an order came from | Yes, as attribution |
| Page views, menu taps, saves | Yes, as daily totals |
| That you saved it and haven't visited | Yes, to send a deal; no other detail |
| Your email or phone number | No, never, including through the Partner API |
| Your location or movement patterns | No |
| Your chats | No |
Rules live in the database, not just the app.
Munchl runs on Postgres (Supabase). Access is decided where the data lives, so a modified app can't read or change what it shouldn't.
Row-level security
Database policies decide who can read and write each row. Checks that involve another person's settings run in narrowly scoped server functions that answer yes or no.
Protected fields
Things like the verified badge, points, Pro status, review verification and order driver fields can only be set by the server or the right party, enforced by database triggers.
Partner API keys
Shown once, stored only as a hash, scoped to one establishment, revocable instantly. Webhooks are signed with HMAC-SHA256 and a timestamp.
Crash reports
When the app crashes, the error and the recent app steps are reported so we can fix it. Only Munchl admins can read them.
Leave whenever you want.
In the app: Settings → Privacy → Delete account, then type DELETE to confirm. Can't get into the app? Use the account deletion request form.