Privacy Policy

Last updated: September 6, 2026

Endorsed is a private, invite-only app for sharing restaurant recommendations with friends. This policy describes what the app collects, why, and what happens to it.

What we collect

• Phone number. Signing in is by SMS code, so your phone number is your account. It’s stored with your profile and in a lookup table that lets a friend who already has your number find you. Anyone signed in can check whether a number is registered — that’s how “add by number” works. You can see your number on Me. Friends you’ve accepted do not see it.
• Numbers you invite. When you invite a friend, the phone number you entered is stored so the app can recognise them when they sign in, along with your display name so they can see who invited them. It is removed when they accept the invite, when you withdraw it, or when you delete your account — whichever comes first.
• Friend requests. When you send a request, we may store the number you typed and your display name on the friendship record so the pending row can show who asked whom. That record is visible to the two of you as needed for the pending request; it is not a public directory. Friends you’ve accepted still do not see your number on your profile.
• Profile. The display name you choose and, if you add one, a profile photo. You can optionally set a home city; see Location.
• Your places. The entries you create: place, status, questionnaire answers, and any photos you attach. These are visible to you and to friends you’ve accepted — nothing in Endorsed is public.
• City asks. When you ask friends to endorse places in a city, we store the city (name and region), optional map coordinates used to aim search, and any note you write. Each accepted friend gets a private copy of that ask — city, optional coordinates, and note — so they can see it. Only you and those friends see it.
• Your history. A timeline of your own actions in the app — places you added, endorsed, or deleted, and friends you added or removed, each with a date. It’s visible only to you (friends never see it) and exists so the app can show you what happened when.
• Feedback you send. Me → Send feedback stores the type you picked, your message, and device diagnostics (app version, build, iOS version, and device model) with the feedback so we can reproduce bugs — not for advertising. You can see your own submissions in Inbox → Feedback. Friends never see them.
• Reports. If you report a friend’s entry, we store which entry it was and that you reported it, so we can act on it. Reports are not visible in the app.
• Approximate activity data. Crashlytics collects crash reports so we can fix crashes. The app also includes Firebase Analytics and records basic usage (screens, sessions, and a handful of named events such as a place added or a friend request sent) so we can see how the app is used. We don’t attach your name or number to those events.
• People you block. Blocking someone stores their account id so they cannot send you friend requests and you will not see their places. You can unblock them from Me → Blocked. The list is visible only to you.
• Device push tokens, so friends’ activity can reach your lock screen.
• Contact form. If you write from the Support page, we store the email you give us, your message, and a salted hash of your IP address (not the address itself) so we can rate-limit abuse. These are not visible in the app and are not tied to an Endorsed account.

Location

If you allow location access, your coordinates are used to suggest places near you and sort your feed by distance. Coordinates are sent to Google Places to run those searches. Exact coordinates are never saved to your profile.

You can optionally set a confirmed home city (the city name, region, and a city-centre pin — never a live GPS fix). That city is visible to friends you’ve accepted, and you can remove it at any time.

Contacts

The app never reads your address book. Adding a friend from Contacts uses Apple’s contact picker, which runs outside the app; only the single phone number you pick is shared with Endorsed.

Who else touches the data

Endorsed runs on Google Firebase (authentication, database, storage, push notifications, analytics, crash reporting) and uses the Google Places API for place search. Your data is processed by Google Cloud on our behalf. We don’t sell data, run ads, or share data with anyone else.

Deleting your account

Me → Delete account removes your places and their photos, profile photo, friendships, blocks you filed and blocks filed against you, history, city asks you wrote, city-ask inbox copies (ones you received and copies of asks you sent), feedback, unredeemed invites you sent, phone lookup entry and any leftover invite on your number, profile including push tokens, and sign-in — permanently and immediately.

A few things other people or the app own are kept, with the link to you removed:

• If a friend added a place from your list, their entry stays theirs; the note that it came from you is removed.
• A restaurant you were the first to add stays in the shared place list (it is just the restaurant’s name, address, and map link); the record of who added it is blanked.
• If you reported an entry, the report is kept so we can act on it, with your account removed from it.
• Your display name may remain in a friend’s own private history — e.g. “You and Alex became friends” — the same way it would in their memory; it is visible only to them.

Messages you sent from the website Support form stay, because they are not linked to your account.

Contact

Questions or requests: use the form on the Support page.