Privacy

Last updated 2 November 2026.

Eat Featured is a map of places featured on food TV and by food creators online. This page says what we collect when you use it, who else sees anything, and how to ask us to delete what we hold. It's written plainly on purpose.

The short version

Browsing the site is counted by a cookieless analytics tool — it tallies visits and which parts of the site people use, sets nothing on your device, and can't follow you across sites. What it records is aggregate: counts, not a profile of you. The times we store something you'd recognise as your own are when you send us a restaurant suggestion, when you send us feedback through the contact form, and when a creator sends us a list of places. In each case we keep what you gave us plus a few small anti-spam details described below, and we delete those on a schedule.

When you browse

We use Plausible Analytics to see whether the site is useful: how many people visit, and which parts they use — opening a venue, building a road trip, running a search. It is cookieless. It sets nothing on your device, does not fingerprint you, and cannot follow you from this site to another. Everything it records is aggregate: counts, never a profile of you. It receives the address of each page you view and, where your browser shares it, of the page you came from, so a search from the home page or a road trip link you open reaches it. What you type into the map's search box or the planner's boxes does not, and neither does what you send through the contact form. Any detail sent with an action is a public identifier from the venue's or show's web address, or a fixed label of ours, such as a size range. When you tap a link to the App Store, Plausible records the tap and the App Store address it leads to, with what every event carries: those two page addresses and, as part of the web request, your IP address. We keep these aggregate figures for as long as we run the site. Plausible's reports show totals, not people, so we have nothing of yours we could find and hand back or delete. Plausible's own privacy policy is at plausible.io/privacy.

Loading a page also means your browser talks to a few other services, and like any web request that includes your IP address:

Netlify, which hosts the site.
Supabase, which serves the restaurant data.
Cloudflare, which runs our own map server and serves the map tiles you see. The map is drawn from OpenStreetMap data, but we keep our own copy, so your browser never contacts OpenStreetMap.
Plausible, which counts the aggregate usage described above.
Google Fonts, which serves the typefaces.
YouTube's image server, for the still picture on a venue that has a video (see below).

Each of those has its own privacy policy. What they get is the web request: your IP address, your browser's details and, for all but Netlify and Plausible, normally just eatfeatured.com as the page asking. Netlify sees each full page address, search included. Cloudflare sees which part of the map you load. Plausible gets what's described above. The code that draws the map comes from our own site, so no other service is asked for it.

In Safari on an iPhone, Apple may show its own banner for our app. Apple's software draws it and we receive nothing from it. A link to the App Store takes you to Apple.

Some venue locations come from the Overture Maps Foundation's open map data. We keep a copy of it on our side, so your browser never contacts Overture.

When you press play on a video

Some venues carry the video that featured them. Pressing play loads that video from YouTube (Google) in YouTube's privacy-enhanced mode, which YouTube says does not use its cookies to personalise what you see. A link that opens the video on YouTube itself, including each picture on the road-trip planner, leaves that mode. Nothing plays until you press play: before that the page shows only a still picture of the video and a play button. That picture comes from YouTube's image server, so showing it is already a request to YouTube. Once you press play, your browser talks to YouTube directly, and that request — like any web request — includes your IP address; what YouTube does with it is governed by Google's privacy policy. We don't tell YouTube who you are, and we don't receive anything back about you from it.

The badge

A restaurant may put our badge on its own website. The badge is a picture served by our host, Netlify, and a link to that place's page here. It carries no script and no tracking. Like any picture on the web, loading it sends Netlify your IP address and, usually, the address of the page it is on; we don't count or use that. A restaurant can instead download the picture and put it on its own site, and then loading it reaches neither Netlify nor us. When someone opens a place's badge page on this site, we add 1 to a daily count of those views, which keeps no place, address or visitor.

When you save a place

Saving a place stores a short identifier for it, and the time you saved it, in your own browser. We keep no copy of your list. When you save or unsave a place, our analytics tool (Plausible) is told which place, by its public web-address name, and when you open your list it is told a size range, such as 4-10. The place itself is looked up fresh each time you open your Saved list.

When you plan a road trip

The route planner sends the start and the destinations you type (up to five) through our own server to a routing and geocoding service (openrouteservice, run by HeiGIT), which works out the route, so that service sees our server, not you. If it isn't available to us, routing uses the public OSRM server the same way, and the page says so. Your browser then sends the route line and the shows you picked to our database host (Supabase) to find places along the way; the line is not kept. We don't store your route or your towns in our database. A trip link you share carries its towns, and our host may hold its preview for about a day.

When you search by ZIP code

A ZIP typed into the map's search box is looked up in your browser, using one of ten files from our own site, so our host can tell only its first digit. The map then loads that area's tiles. In the app the file is on your phone. A ZIP typed into the home page search is part of the page address, like any search from there (see "When you browse").

In the iPhone app

The app shows the same places as the site and keeps a copy of the catalogue on your phone, which it refreshes from our site. It has no account. Near me asks for your location the first time you tap it. Once you've allowed it, the app also uses it to fill the Near you row. Your location stays on your phone, where it sorts places and moves the map. We never receive it, though moving the map loads that area's tiles from our map server, as moving it by hand does. Places you save and trips you save are kept on your phone. Planning a trip sends the start and the destinations you type (up to five) to our server, which looks them up with openrouteservice, and the route line to our database host (Supabase), the same as on the site; we don't store them. Videos, map tiles and the pages the app opens (the terms, this page, the contact page and News) load from the same services this page names for the site.

When you suggest a restaurant

The suggestion form is paused right now, so there is nothing new to send. This section still describes what we hold from suggestions sent before the pause — that data is unchanged and governed exactly as below.

If you use the suggestion form, we store what you type: the restaurant, city, state, show, dish, a link if you gave one, and your message. If you give us an email address so we can reply, we store that too.

We also store three things you didn't type:

A hashed version of your IP address. Not the address itself — a salted, one-way fingerprint of it, which we don't use to work out your address. We use it only to stop the form being flooded.
Your browser's user-agent string, for the same reason.
A second hash, of the address our database sees. For this form that is our host's address, not yours. It is deleted with the other two.

How long we keep it

The restaurant details — name, city, show, dish, link, message — we keep as part of our research record, since they may become a listing.
Your email, both hashes, and the browser string are deleted 90 days after your suggestion is reviewed, or after 12 months if it's never reviewed. This happens automatically. That is in our database. The email we received about your suggestion carries your address too, and stays in our mailbox until we delete it.

What we do with your email

Two things, and only these: an automatic note confirming we received your suggestion, and — if the place makes it onto the map — a message to tell you. We don't add you to a list. We don't give it to anyone for their own purposes (see "Who we share with").

When you send feedback

There's a contact form — reached from the footer, or from a "Something wrong here?" link on a venue's page — for telling us something's off, asking a question, or letting us know when a place closed. We store your message, and — only if you fill it in — the email address you give so we can reply. There's no name field and no subject box.

If you sent it from a specific venue's page, we also store that venue's public web-address name, so we know which place your note is about. If that link was out of date and the venue isn't one we recognise, we simply drop the reference and keep your message.

To stop the form being flooded we store the same three things as the other forms: a salted, one-way hash of your IP address (not the address itself), your browser's user-agent string, and a second hash, of the address our database sees, which for this form is our host's address, not yours. We don't use a captcha, so nothing about you is sent to a third party to prove you're human.

How long we keep it

Both hashes and the browser string are deleted 90 days after you send the message, and the same goes for the IP hash we keep if our hidden anti-spam box is filled in. This happens automatically.
Your message and email stay in our database after we've dealt with them. Nothing deletes them automatically. Ask us and we'll remove them.

What we do with your email

Only this: a reply to what you sent, if you left an address. We don't add you to any list or give your address to anyone for their own purposes (see "Who we share with").

When a creator sends us their places

Some food creators we work with send us the places from their videos through a private link we give them, with no account and no sign-in. For each place we store what they type: the video link, the restaurant's name, its town, and an optional dish and note, filed under the creator the link belongs to. We keep the video links as links: we don't download or read anything from them.

To stop the form being flooded we store the same things as the other forms: a salted, one-way hash of the IP address (not the address itself), the browser's user-agent string, and a second hash, of the address our database sees, deleted with the others after 90 days.

How long we keep it

Both hashes and the browser string are deleted 90 days after the list is sent. This happens automatically.
The places are kept: a person checks each one before anything reaches the map, the same way as every other place on the site.

Who we share with

We don't sell or rent what we hold, and we don't give it to anyone for their own purposes. A few companies handle it for us: the services named above, each receiving what this page says it receives; Resend, which delivers the suggestion form's emails; GitHub, which stores our private backups; and Google, which runs our email.

Your rights

You can ask us at any time to tell you what we hold about you, or to delete it. Email support@eatfeatured.com and say what you sent and roughly when. We'll do it and confirm.

If you're in the EU, UK, or California, you have specific rights under GDPR, UK GDPR, or the CCPA. The paragraph above is how you exercise them; the answer is the same for everyone.

Backups

Each night we save a copy of our database in case something goes wrong. The times on this page are when we delete things from the database itself. Copies made before then stay in our past backups, which are kept privately and are not used for anything else.

Children

The site isn't aimed at children under 13 and we don't knowingly collect anything from them. If you think a child has sent us a suggestion with their email, tell us at the address above and we'll delete it.

Changes

If this page changes in a way that matters — new data collected, a new service that sees your requests — we'll change the date at the top and say what changed. We won't quietly widen what we collect. On 30 October 2026 we added the badge, described under "The badge", and the count of its page's views. On 7 September 2026 we added cookieless, aggregate analytics (Plausible) and named it above, and added the early-access sign-up list for the app, described under "When you join the early-access list." On 8 September 2026 we added a contact and feedback form, described under "When you send feedback." On 10 September 2026 we said what happens when you press play on a video, under "When you press play on a video". Later the same day we added saved places, under "When you save a place" — the list lives in your browser and never reaches us. On 22 September 2026 we named the Overture Maps Foundation as a source of venue locations; your browser never contacts it, so nothing about you changed. On 24 September 2026 we corrected this page in two places. The map tiles come from our own map server, run on Cloudflare, not from OpenStreetMap, and the code that draws the map now comes from our own site rather than from another site. And the still picture shown before you press play on a video comes from YouTube's image server: we had said nothing loads from YouTube until you press play, and that was wrong. On 30 September 2026 we added "In the iPhone app", which says what the app keeps on your phone and what it sends, and corrected the early-access section: the app is free and needs no account, where we had said it would be a paid product. On 1 October 2026 we added "When a creator sends us their places", for the private link some creators use to send us places. On 3 October 2026 we said that a road trip sends the start and up to five destinations you type, where we had said the start and end, on the site and in the app, and added "When you search by ZIP code". On 4 October 2026 we added "Backups", under "Your rights": the times on this page are when we delete things from our database, and copies made before then stay in our past backups. On 19 October 2026 the road-trip paragraph changed to say that the stops you pick are sent to our database host (Supabase) to find places along the way, and that the route line is not kept. On 2 November 2026 we closed the early-access list: the app is out, the sign-up forms are gone, the list holds no addresses, and its section has left this page. The same day we said what our analytics records when you tap a link to the App Store, and corrected what this page says about what Plausible receives: a page's address can carry a search or a road trip link. We also added News to the pages the app opens. The same day we corrected this page: saving a place tells our analytics which place, and the forms store a second hash we hadn't named. We also named Resend, GitHub, Google and Apple, and corrected what the page said about ZIP searches, Near me, road trips, removing feedback, the IP fingerprint, the emailed copy of a suggestion, and YouTube links. The same day we began deleting the second hash, and the IP hash from our hidden anti-spam box, on the schedule above.

Contact

support@eatfeatured.com

This notice is written in plain language rather than legal language. It is not a substitute for legal advice; if the site's data handling grows beyond what's described here, it should be reviewed by someone qualified.