Privacy Policy

Last updated: September 30, 2026

Endorsed is a private, invite-only app for sharing restaurant recommendations with friends. This policy describes what the app collects, why, who else handles it, how long it is kept, and what you can ask us to do with it.

Who we are

Endorsed is made and run by Jamie Stokes, who is responsible for the personal information described here and is the privacy officer for it. You can reach him through the form on the Support page.

What we collect

• Phone number. Signing in is by SMS code, so your phone number is your account. It’s stored with your profile and in a lookup table that lets a friend who already has your number find you. Any member can check whether a number belongs to a member — that’s how “add by number” works. The app shows your number only to you, on Me.
• The waitlist. If you sign in without an invite, you can join the waitlist from the Invite only screen by picking your city. We store your phone number, the city you picked (name, region and a city-centre pin, never a live GPS fix), and when you joined. We use it only to decide where to invite people next and to invite your number when Endorsed opens near you; we don’t message anyone on the list. Nobody else can see it. It is removed when you leave the list, when you join Endorsed, or when your sign-in is deleted.
• Numbers you invite. When you invite a friend, the phone number you entered is stored so the app can recognise them when they sign in, along with your display name so they can see who invited them. It is removed when they accept the invite, when you withdraw it, or when you delete your account — whichever comes first.
• Who invited whom. When you join, your profile records who invited you and where that chain of invitations started. We use it to understand how Endorsed grows and to spot abuse. It isn’t shown in the app.
• Friend requests. When you send a request, we may store the number you typed and your display name on the friendship record so the pending row can show who asked whom. That record is visible to the two of you as needed for the pending request; it is not a public directory.
• Profile. The display name you choose and, if you add one, a profile photo. You can optionally set a home city; see Location.
• Your places. The entries you create: place, status, questionnaire answers, and any photos you attach. These are visible to you and to friends you’ve accepted — nothing in Endorsed is public.
• Conversations. Each place can have a conversation. The note you write on a place starts one, and you can write messages, mention friends, mute, or leave. A conversation is visible to the friends it was shared with — all your accepted friends, or a group you picked — and records who has read what, so it can show what’s new. New messages can send push notifications.
• City asks. When you ask friends to endorse places in a city, we store the city (name and region), optional map coordinates used to aim search, and any note you write. Each accepted friend gets a private copy of that ask — city, optional coordinates, and note — so they can see it. Only you and those friends see it.
• Your history. A timeline of your own actions in the app — places you added, endorsed, or deleted, and friends you added or removed, each with a date. It’s visible only to you (friends never see it) and exists so the app can show you what happened when.
• Feedback you send. Me → Send feedback stores the type you picked, your message, and device diagnostics (app version, build, iOS version, and device model) with the feedback so we can reproduce bugs — not for advertising. You can see your own submissions in Inbox → Feedback. Friends never see them.
• Reports. If you report a friend’s place, a Scouts pick, or a message, we store what you reported and that you reported it, so we can act on it. We also record whose place or which Scout it was, and for a message we keep a copy of its text and who sent it. Reports are not visible in the app.
• People you block. Blocking someone stores their account id so they cannot send you friend requests and you will not see their places. You can unblock them from Me → Blocked. The list is visible only to you.
• Approximate activity data. Crashlytics collects crash reports so we can fix crashes. The app also includes Firebase Analytics and records basic usage (screens, sessions, and a handful of named events such as a place added or a friend request sent) so we can see how the app is used. We don’t attach your name or number to those events.
• Device push tokens, so friends’ activity and messages can reach your lock screen.
• Contact form. If you write from the Support page, we store the email you give us, your message, and a salted hash of your IP address (not the address itself) so we can rate-limit abuse. These are not visible in the app and are not tied to an Endorsed account.

Scouts

Scouts shows restaurant picks from public Instagram posts by professional food accounts in a few cities. We read those public posts through Meta’s Instagram API, send each post’s caption to Anthropic’s Claude to pick out the places it names, and match those places with Google Places. Scouts picks are shown to every member. None of your own information is sent to Meta or Anthropic for this. If you save a Scouts pick, it becomes one of your places like any other.

If you run one of these Instagram accounts and would rather your posts weren’t included, tell us through the Support page and we’ll remove them.

Location

If you allow location access, your coordinates are used to suggest places near you and sort your feed by distance. Coordinates are sent to Google Places to run those searches. Exact coordinates are never saved to your profile.

You can optionally set a confirmed home city (the city name, region, and a city-centre pin — never a live GPS fix). That city is visible to friends you’ve accepted, and you can remove it at any time.

Contacts

The app never reads your address book. Adding a friend from Contacts uses Apple’s contact picker, which runs outside the app; only the single phone number you pick is shared with Endorsed.

Who else handles the data

• Google. Endorsed runs on Google Firebase (sign-in, database, storage, push notifications, analytics, crash reporting) and uses Google Places for place search. Your data is processed by Google Cloud on our behalf.
• Apple. Push notifications are delivered through Apple’s push service.
• Meta and Anthropic, for Scouts only, as described above. They receive public Instagram posts, not your information.
• OpenAI. Jamie uses a private admin page, hosted on OpenAI’s Sites service, to see members, places, friendships, invitations, and history so he can run and support the app. Only he can sign in to it. Data passes through that service when he views it and is not stored there.

When someone new joins, Jamie gets a notification with their display name, the last four digits of their number, and their home city if they set one.

We don’t sell your data, and we don’t use it for advertising.

How long we keep it

• Your account, places, conversations, and history are kept until you delete them or your account.
• The database and the list of sign-in accounts are backed up daily, and backups are kept for 14 days. Deleted photos can be recovered for 7 days. So after you delete something — including your account — a copy can remain in backups for up to 14 days before it is gone for good. Backups are only used to recover from mistakes or failures.
• Crash reports and analytics are kept by Google under Firebase’s retention settings.
• Reports are kept so we can act on them, including after an account is deleted (see below).
• A waitlist entry is kept until you leave the list from the Invite only screen, you join Endorsed, or your sign-in is deleted.
• Support form messages are kept until you ask us to delete them.
• Scouts data (public posts and the places they name) is kept while we use it for Scouts.

Deleting your account

Me → Delete account removes your places and their photos, profile photo, friendships, blocks you filed and blocks filed against you, history, city asks you wrote, city-ask inbox copies (ones you received and copies of asks you sent), feedback, unredeemed invites you sent, phone lookup entry, any leftover invite and any waitlist entry on your number, profile including push tokens, and sign-in. It happens straight away; backup copies expire within 14 days.

Conversations you started are deleted with all their messages. In conversations someone else started, your messages are replaced with “Message removed” and your name with “Former member”.

A few things other people or the app own are kept, with the link to you removed:

• If a friend added a place from your list, their entry stays theirs; the note that it came from you is removed.
• A restaurant you were the first to add stays in the shared place list (it is just the restaurant’s name, address, and map link); the record of who added it is blanked.
• Reports you filed are kept so we can act on them, with your account removed from them.
• Reports other people filed about your places or messages are kept, including the copy of a reported message, so we can deal with abuse.
• If you invited people, their profiles keep an internal account id pointing to your deleted account. It no longer leads to your name, number, or anything else.
• Your display name may remain in a friend’s own private history — e.g. “You and Alex became friends” — the same way it would in their memory; it is visible only to them.

Deleting a single place doesn’t delete its conversation; the note you wrote stays as the conversation’s first message.

Messages you sent from the website Support form stay, because they are not linked to your account.

Your choices and rights

You can see and change most of your information in the app, and delete it there too. You can turn off location access and notifications at any time in iOS Settings. You can also ask us to tell you what we hold about you, to correct it, or to delete it; send the request through the Support page and we’ll answer within 30 days.

If you’re in Canada and you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (or, in Quebec, the Commission d’accès à l’information).

Children

Endorsed isn’t meant for children under 13, and we don’t knowingly collect information from them. If you believe a child under 13 has an account, tell us through the Support page and we’ll delete it.

Changes

If this policy changes, the date at the top changes with it.

Contact

Questions or requests: use the form on the Support page.