Privacy Policy

• Account info: email address, display name, phone number (optional), unit number, and profile photo (optional).
• Condo membership: the condo you join, so neighbors in the same building can find you for pickup or delivery.
• Content you create: meal listings (title, description, photo, price, available portions and times), orders, chat messages, and ratings.
• Payment information: if you sell meals, the local payment handle you choose to display (e.g. PromptPay ID, Pix key, Bizum number, IBAN) and an optional bank QR image. We do not collect, process, or store credit or debit card numbers — payments settle directly between buyer and cook using their bank apps.
• Approximate location: we derive an approximate country from your IP address to show the right local payment methods (e.g. PromptPay in Thailand, Pix in Brazil). We do not access precise GPS location and we do not track your location in the background.
• Device & push identifiers: a device identifier and, if you allow notifications, a push token used to deliver order and message alerts.
• Technical & diagnostic data: timestamps, basic device info, and error reports used to keep the service running and to diagnose crashes.

• Operate the service and show meals available in your condo.
• Match buyers and cooks within the same building.
• Process orders and enable chat between buyer and cook.
• Show the correct local payment methods based on your country.
• Send push notifications and essential service emails (order updates, account changes) — never marketing without your consent.
• Prevent fraud, abuse, and violations of our Terms of Service.
• Comply with legal obligations.

We do not use your personal information for third-party advertising, we do not sell your personal information, and we do not use it to train third-party advertising or marketing profiles.

We share only the data needed to fulfill the service.

• Other members of your condo: your display name, avatar, unit number, meal listings, and payment handle (when you choose to sell) are visible to fellow members of the same condo so they can place orders.
• Service providers: hosting, database, storage and authentication (Lovable Cloud, powered by Supabase and Cloudflare); Google Maps for condo search and map previews; OneSignal for push notification delivery; Resend for transactional email; and, for cooks who subscribe, RevenueCat and Apple for subscription processing. These providers act as our processors and only handle data on our behalf.
• Legal: we may disclose data if required by law or to protect the rights, property, or safety of our users.

We keep your data while your account is active. You can delete your account at any time from Profile → Delete account inside the app. Deletion removes your profile, meal listings, orders, and messages from our active systems. A limited amount of data may be retained briefly for fraud prevention, dispute resolution, and legal compliance, then permanently deleted.

We use industry-standard safeguards: encryption in transit (HTTPS/TLS), encryption at rest for our database and file storage, row-level security so members can only see data they're entitled to, and access controls on administrative functions. No system is perfectly secure — please use a strong, unique password and contact us immediately if you suspect unauthorized access.

Lobby Bites is not directed at children under 13 (or under 16 in regions where that is the minimum age of digital consent), and we do not knowingly collect personal information from them. If you believe a child has provided us information, please contact us so we can remove it.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Most of these are available directly from your profile in the app; for anything else, contact us at the email below and we will respond within the timeframe required by applicable law.

You can also turn off push notifications at any time from your device settings, and revoke camera or photo library access from your device's privacy settings.

Our service providers may process your information in countries other than your own, including the United States and the European Union. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

• Lovable Cloud (Supabase, Cloudflare): application hosting, database, authentication, file storage.
• Google Maps: building search and map previews.
• OneSignal: push notification delivery.
• Resend: transactional email delivery.
• RevenueCat & Apple: optional cook subscription processing.

We may update this Privacy Policy from time to time. We'll update the "Last updated" date above and, when changes are material, notify you in the app or by email before they take effect.

Questions or requests about this policy, or to exercise your privacy rights? info@lobbybites.com