Privacy notice

Oolayum (“we”) runs this website, which lists meal prices at local restaurants. This notice explains what happens to information when you use it. Questions or requests: hello@oolayum.com.

The short version

• You don't need an account to browse, and browsing without signing in sets none of our cookies, unless you choose your city or your language, or add a meal as a guest: each sets one cookie (below). Tawk.to, our live-chat service, sets its own on every page (below).
• Explorers sign in with Google or, where they're offered, Facebook or a code we email them. We keep your email, what you contribute, and when. If you have a username (one we pick when you first add a meal or a price or post in the community, like SpicyElote42, or one you claim), anyone who opens the community sees it on what you post there, and anyone sees it on the leaderboard beside your Heat.
• Once you've joined, we email you news on your meals, at most once a day and only when there is some, unless you turn it off in your settings or with the link in any of them (below).
• “Use my location” (when you browse), and “Restaurants near me” and the things to do near you (when you add a price), work on your phone: we send your phone the list, it sorts it by distance, and your location stays there. So does the restaurant search when you add a meal: if your browser already lets this site see your location, your phone puts the nearest matches first (we send it the matches; your location isn't sent, and you're never asked for it there). The map's search works on your phone too: what you type stays there until you show it on the map (then it's part of the page's address, like any filter), and once you've shared your location, your phone puts nearer restaurants first. We don't collect your precise geolocation. When the map moves to another city, your phone works out which one from a list it downloads; when you pick a city to add a meal in, or open a city's map, that city is part of the address, so it reaches us like any page you open.
• Which city's map or meals list you see first: when you open the plain address of either, we pick the city from the approximate, city-level location Cloudflare works out from your IP address, never your device's location. We don't store it ourselves; like every request, it's in the request logs we keep for up to 7 days (below). If we can't tell, or you're near San Antonio, it opens on San Antonio. The city we picked then goes in the page's address, so it's in those logs like any page you open, and in any link you copy. A link that names a city always opens that city. If your browser already lets this site see your location, the map then opens on the area around you when you're in that city: your phone works that out, and your location isn't sent to us. The map never asks for your location when it opens; it asks only when you tap something that needs it, such as Current location. The city button at the top of the page, and the 1,000, Feed and Leaderboard links on a page that isn't about a city, use the same city, worked out the same way each time you open a page here. If you choose a city on the Cities page (the city button opens it), the map, the list and those links open on it instead: we set a cookie, oolayum_city, holding that city's short name (like laredo-tx) for up to a year, and your browser sends it with every request to this site. It holds nothing else, isn't linked to your account, and we don't store it ourselves. Forget my city on the Cities page removes it, and so does clearing this site's cookies in your browser.
• The site is in English or Spanish. With no choice of yours, we pick from your browser's language setting and the country Cloudflare works out from your connection (Mexico and other Spanish-speaking Latin American countries get Spanish). Your browser's setting and your country are never stored. If you tap Español or English, we set a cookie, lang, holding only es or en for up to a year; clearing this site's cookies removes it. If you sign in, we store one thing about this with your account: the language, es or en. It's the page's language when you joined or next sign in, and it changes when you tap Español or English while signed in. The emails we send you are in it. Our sign-in provider, Supabase, keeps a copy with your account to write your sign-in codes in it, updated each time you sign in.
• If you have a username and Heat, anyone sees your username on the leaderboard beside your Heat and Spice Level, never beside a place, and you can't take it off. Without a username, you're counted but not named. Your Spice Level shows beside your username wherever it appears.
• When you add a meal or a price, anyone can see your username beside it, with the date (never the time): who added a meal is shown on the map, on restaurant pages and on meal pages, and a price you add shows as “Spotted by” your username there from the moment you add it, until a second local confirms it. So anyone who knows your username can see which restaurants you've added meals and prices at, and on which day.
• Your profile is public once you have a username, and it can't be hidden: anyone can open it and see your Spice Level, some badges, a few counts, the meals and restaurants you added that show now, and your posts and comments that show, with dates (never times). The meals, prices, posts and videos you add show your username.
• We don't sell personal information or use it for targeted advertising.
• Since October 11, 2026, Tawk.to (below) shows us who's on the site right now and which pages they're on, and lets you chat with us. We also count visits ourselves, without cookies or anything stored in your browser: each page you open, your city as the site already uses it, where you came from (the kind of site that linked you, like Reddit or Google, never the address), whether it's a phone, tablet or computer, when you open Add a meal, when you add or confirm a meal (and the restaurant's city), when the sign-up prompt opens (and on which page), when you start signing in (with Google, Facebook or an email code, and from which page), when you create an account (and which way), whether joining finished or why it didn't, when you open a card on the map (only its kind, never which restaurant), when you tap a restaurant's Directions, menu link or Call (and which restaurant), when you open, send or get an error from the form to add a restaurant we don't list (never what you typed), what you search for here and how many results it found, and the home-screen tip shown, added or closed. A day's events are tied together only by a code made from your connection and browser that changes every day, with no name, account or IP address attached, so nobody is followed from one day to the next and your IP address itself is never stored. Our team's visits while signed in aren't counted. We keep these counts 90 days. We use no other analytics.

What we and our service providers receive

• Cloudflare hosts the site. Like any web host, it receives each request: your IP address, your browser and device type, the page asked for, and an approximate location worked out from your IP address. We keep these request logs for up to 7 days to run and secure the site.
• OpenFreeMap supplies the map tiles whenever the map shows (the home page opens on it). Your browser asks OpenFreeMap for tiles, so OpenFreeMap receives your IP address, browser details, our site's address and the areas you view or pan to (never your location from us). The map opens on a whole city (the city picked from your connection, or the one you chose), or on what a search link found, never on your exact location. The exceptions: if you tap Current location, or Near me while exploring, the map moves to where you are; and if your browser already lets this site see your location, the map opens on the area around you when you're in that city. Then OpenFreeMap sees the map area around you. Your device's location itself never reaches us: exploring tells us only which city the map is over and, when you tap a place, which place.
• The US Census Bureau's geocoder and OpenStreetMap's Nominatim place a restaurant someone adds that isn't on our map yet: our server sends them only the restaurant's address as typed, with its city (the Census Bureau for an address in the US, Nominatim for one in Mexico), never anything about you.
• Cloudflare Turnstile runs only on the guest form (adding a meal without an account), on the contact form once you start filling it in, when you report something without being a signed-in Explorer, or report a menu photo or a Foodlist, and when you ask for a sign-in code by email, to check that a person is sending it. Cloudflare receives your IP address and browser details from it, under Cloudflare's own privacy policy. For a sign-in code, our sign-in provider (Supabase) checks it with Cloudflare.
• Resend, our email service, delivers each report to our own inbox. The email says what was reported (a link to it), why, and whether it's hidden now: never who reported it, and never the words or the photo themselves. It also delivers what you send with the contact form, which is different: that email has your words in it (see Contacting us, below). And it delivers sign-in codes: Resend receives your email address and the code it carries. It also tells our inbox when someone creates an account (only how they signed in, never who) or adds a meal (the dish, its price and restaurant, and whether an Explorer or a guest added it, never who). And it delivers our emails to Explorers (below): Resend receives your email address and what each one says.
• Tawk.to runs on every page, for live chat and so we can see how many people are on the site and which pages they're on. It receives your IP address and the approximate location worked out from it, your browser and device details, the pages you visit and when, and anything you type in a chat. It keeps a visitor ID in a cookie and in your browser's storage, so it knows a return visit. What Tawk.to does with that is covered by its own privacy policy.
• Apple Maps or Google Maps open when you tap Directions, and Google Maps when you tap Look it up on Google Maps while adding a restaurant (it searches for the name you typed, in that city). What happens there is covered by their own privacy policies.

Contributor accounts

Signing in. If you sign in with Google, we ask Google only for your email address and account identifier. Our sign-in provider (Supabase) may also receive your Google name and profile picture; we never use or show them. A sign-in cookie keeps you signed in for up to 30 days; signing out ends it on every device. During Google sign-in, a second cookie lasts up to 10 minutes to protect the sign-in. When you finish joining, a cookie holding only “1” lasts up to an hour: until then, or until you tap one of its buttons or sign out, each page shows a card suggesting a first thing to do (a price to check).

Signing in with Facebook. If you sign in with Facebook, we ask Facebook for your public profile and your email address. Supabase receives and keeps your Facebook name, profile picture and account identifier with your sign-in; we never use or show them. Meta learns that you signed in to Oolayum, under Meta's own privacy policy. During Facebook sign-in, a cookie lasts up to 10 minutes to protect the sign-in. Staff and restaurant accounts can't sign in with Facebook.

Signing in with an email code. If you ask for a code, Supabase emails it to you (through Resend) and checks it; a code works for 10 minutes. To stop codes being sent or guessed in bulk, we count, for an hour, how many codes your network asked for and how many wrong codes it tried, and, for 10 minutes, how many wrong codes were tried for your address. Each count is kept under a code made from the network or the address with a secret (never the address or the IP itself), and is deleted when its time is up. While you wait for the code, the tab keeps your address in its own storage for up to 10 minutes, so a reload comes back to the code; it's removed when you sign in, choose another address, or close the tab.

Emails from us. Once you've joined, we email the address you sign in with, unless you turn it off: at most one email a day, and only when there's news on your meals (other locals checked prices you added or a meal you saved; upvotes on the meals you added; comments on your posts). Turn it off in your settings, or with the link in any of them, without signing in; that link holds a random code for your account, nothing else. Your address is used to sign you in and for these emails, and our staff can find an account by its exact address when you ask for help with it; Supabase keeps it for signing in, Resend receives it to deliver these emails, and nobody else gets it.

What we keep. Your email, whether you get our emails (with the code in their link, and when we last emailed you), the language you read us in (above), which invite code or link you joined with (if any), when you accepted the terms (including that you're 18 or older), and your contributions: which prices you added, confirmed or reported, when, and how you said you knew (for example “I'm here now”), and which restaurants you reported closed, not a restaurant, or open. A contribution can show you were at a restaurant, so we treat it as personal information: it's never shown with your email. Your username shows beside the meals and prices you add (a price as “Spotted by” your username, from the moment you add it), and your public profile lists your meals (below). The reports you made are never shown with your name, and nor are the prices you only confirmed, but for one: when a price came from a restaurant's website (“From the restaurant”), the first person to check it is named on that meal's page (“First checked by” your username, with the day). Only you see your whole record.

Your public profile. Once you have a username, anyone can open your profile (from your username, or at /u/ and your username). It shows your username, your Spice Level and the badges you've earned (badges show without dates or counts), the month you joined, how many meals you added, how many upvotes your posts and comments got (counting the same votes their scores do) and how many posts and comments you have up, the meals and restaurants you added that show now, with the date each was added, and your community posts and comments and your comments on restaurants that show now, each with its date (and, for posts and comments, its score; never the time). It never shows your Heat, rank, weekly numbers or streak, or the prices you only confirmed. Someone watching your profile closely could see a badge or a new Spice Level appear around when you verify a meal. So anyone can see where you've eaten and added a meal, and what you've said. Profiles are public and can't be hidden, and your username shows beside the meals, prices, posts and videos you add. Profiles aren't shown to search engines, and nor are the leaderboard, recent activity, the community or a video's own page. Restaurant and meal pages are, with the usernames and days on them: who added or spotted a price, who checked one first, and whose video shows there. Staff and accounts without a username have none. Deleting your account deletes it.

Similar taste. Signed-in Explorers who open your profile see the cuisines and restaurants they have in common with you, worked out from what your profile shows (the meals you added and your videos), never from the prices you only confirmed. When you open someone's profile, the comparison also uses your own record (meals you added, prices you checked, your videos); only you see it, it isn't kept, and they're never told.

Your name, bio and photo. If you add them in Edit profile, the name you go by (always beside your username) and a one-line bio show on your profile and on Followers and Following lists, to anyone, while your profile is public. We never fill them in from your Google account. We keep the version that shows, and an earlier one only while a report is about it, so that reports apply to what people actually saw; anyone can report them, and two reports from different Explorers (or our staff) hide them until we look again, which also stops changes to them until then. If you add a profile photo, it shows in place of your initial on your profile (with the meals you added and their days) and on those lists. Before it shows, a model from Anthropic looks at what the picture shows, never who is in it: we do no face recognition and keep no face data. A photo it refuses is deleted at once. We keep one photo, at 320 pixels, until you replace or remove it or delete your account, and a replaced or removed one only while a report about it is open; one our staff hid as possibly illegal is kept, unviewed, for a year, as for meal photos and videos. Anyone in a profile photo can ask us to take it down. None of these are used anywhere outside your profile and those lists, and deleting your account deletes them, except a held photo, as above.

Heat, badges and the leaderboard. You earn Heat for meals you add, for meals you help make Yum Verified, for upvotes on your community posts, and for contributing on days in a row. We work it out from what you've done each time it's shown, so a rejected contribution, a price a local reported before it was ever verified, or a post that was hidden takes its Heat with it; we don't keep a separate score. Your Heat sets your Spice Level (“Jalapeño”). Badges are worked out the same way, from what you've done, so they can go too. The Leaderboard page shows Heat this week (from Monday, Central Time) and all time, updated within a minute. Anyone can see it, signed in or not: it's one board for every city, and the top 100 Explorers with Heat and a username are named on it, from the first one, with no way to take yourself off; an Explorer without a username is counted without a name. On the board a name only ever sits beside Heat and a Spice Level: never a restaurant, meal, price or time. Because the board is live, someone watching it closely could see your Heat rise around when you verify a meal. (While Heat is off, the board instead shows signed-in Explorers last week's Explorers by meals verified, naming them once at least 5 Explorers verified at least 10 meals that week.) Elsewhere your username sits beside things you made yourself: your community posts and comments, the meals you add and your comments on restaurants, each with a date (below). Still, verified meals are public, so someone who knows your name and watches the board can guess you helped verify some of them. Your username is kept in its own table, not in our change log. Usernames are unique and, once claimed, can't be changed (so nobody can pass for someone else); email us if you need yours changed or removed. Deleting your account deletes it. When a username is given up, we keep a code made from it, not the username itself, for 90 days so nobody else can take it; the code can be matched to that username, but to nothing else about you. In Hunt (in each city where it runs), the first Explorer to snap a restaurant's menu is named on its page (“First found by” their username, with the day, never the time) and on Hunt's map as a pin with their username and Spice Level, while their find stands; undoing the snap, or our team withdrawing it, ends that. The race in Hunt works the same way, city by city. The Leaderboard page shows each Hunt city's Top Finders: each Explorer's username, number of First Finds there this week and all time, their Spice Level, and how many weeks they finished first (“Finder of the Week”, counted from the week the race started in that city, October 19, 2026 or later). Hunt's map lists the city's First Finds of today and yesterday, each with its finder's username and pepper, the restaurant and the day (today or yesterday), never the time. A find's day is always its city's own. A profile shows its Explorer's First Finds: how many, Finder of the Week, their hunt streak (days in a row with a First Find) and the cuisines of the restaurants they found first. All of it is worked out from finds that stand, so a find that no longer stands leaves all of it, and nothing new is stored on your device. Because Hunt's map is live, someone watching it closely could see a new find appear around when it was made. Your Heat still pending and your progress toward each badge are shown only to you, on your own profile; if you have a username, your Heat and rank (this week and all time) are on the leaderboard for anyone to see. Your profile remembers which badges you've seen celebrated in your browser's own storage, on that device only; it never leaves it.

The community. Anyone who opens the community can read each post and comment (signed-in Explorers write and vote, and anyone can report; our team votes too, and its votes never earn anyone Heat), with its author's username, the date (never the time) and its net score; you see your own vote. We keep, and never show, the exact time, who voted and how, and who reported what (an author never learns who reported or why). What you write can say where you eat, and someone reading as you post can tell roughly when, so think before naming a place you are at now. Deleting a post deletes its replies, including other people's; deleting your account deletes your posts, comments and votes, and backup copies age out. When we hide or remove something, we keep a note of what we did and why, without the words. A report on a post uses the same network code as other reports, below.

Reporting. Anyone can report a post, a comment, a meal photo or a meal video. A signed-in Explorer's report is kept, as above, and two independent ones hide what they reported. Anyone else's report is only an email to us (through Resend, above): we don't keep it anywhere else, and it never hides anything by itself. To limit how many one network can send, we keep a count for the day under a code made from your network and that day's date (never your address, and never with the report), deleted after about two days.

Contacting us. The contact form sends us an email (through Resend, above) with the topic you picked, your message, your email address if you give one (only so we can reply), and, if you're signed in, which account sent it (your username and account ID, taken from your sign-in, never from the form). We don't keep it anywhere but our inbox, and keep it there only as long as we need it to answer you or follow up; ask us and we'll delete yours. Resend keeps its own copy for a short time, under its own terms. To limit how many messages one network can send in a day, we keep a count under a code made from your network and that day's date (never your address, never with the message, and apart from reports' count), deleted after about two days.

The meal card. On the map and on restaurant pages, anyone sees who added each meal (their username and the date, never a time), its net votes (only from 1 up) and how many people recommend it, and each restaurant's comments with their authors' usernames and dates. Signed-in Explorers vote, recommend, save and comment; our team votes and recommends too, and that never earns Heat. We keep, and never show, who voted or recommended what, and the exact times. Your saved meals are only for you, and never counted. These are filled in by your browser after the page loads, not part of the page we send, and on restaurant pages the comments load only when you tap to see them. Search engines that run a page's scripts may still see the names and counts. Comments on a restaurant follow the community's rules and reports. Deleting your account deletes your votes, recommendations, saves and comments, and your name leaves the meals you added.

Recent activity and today's deal. While contributions are on, the map shows the newest meals added (“SpicyElote42 added Fish Tacos · El Mirasol · today”), and the Recent activity page lists the last 7 days. A meal joins the list 3 to 4 hours after it was added, on the hour, and each day's meals are listed by restaurant, never by time, so the list never shows where someone is eating now; only the day shows (today, yesterday or a date), never a time. That delay is Recent activity's only: a price you add shows on the map and on its restaurant's page as “Spotted by” your username from the moment you add it, with the day, so anyone looking then can tell you were there that day. An Explorer is named, with a link to their profile, once they have one (a username); otherwise the list says “An Explorer”. Our team shows as Oolayum and a guest as “A guest”. The list is filled in by your browser after the page loads, like the meal card, and the Recent activity page isn't shown to search engines. Today's deal is picked in your browser from the meals on the map; if you share your location, its distance is worked out on your phone and never sent to us. If you close the deal or the activity, your browser remembers that until the next day, in its own storage (not a cookie), and nothing is sent to us. The welcome card on your first visit: once you close it or tap its Add a meal, your browser remembers that for good, in its own storage, and nothing is sent to us. The tip on phones about adding Oolayum to your home screen works the same way: closing it (or adding it) is remembered in your browser's own storage, and nothing is sent to us. So is How Hunt works: it opens by itself the first time you start Hunt on a device, and your browser remembers that it did, in its own storage; nothing is sent to us. When you open a meal or a restaurant page, your browser remembers the last 5 restaurants you opened (each one's name and short name, liketaco-haven), in its own storage on that device only, so Post a video can offer them first when you tag a clip; the list is never sent to us, and clearing this site's data in your browser removes it. A few things last only while that tab is open, in its session storage, and are never sent to us: the video feed's Sound choice; the menu prices you just marked “Wrong price?” (for two minutes, so the map doesn't show them to you again before we've hidden them); and, when you're signed in, how many unread alerts you have, so the bell doesn't ask us on every page. When you tap Save while signed out (or before you've finished joining), that tab also keeps which meal it was (a price's id, or the restaurant's and the meal's short names) for 15 minutes, so the meal is saved to your account once you sign in (and finish joining) in that tab: it's sent to us then, and closing the sign-in box or signing out removes it. On a shared device, it goes to whoever signs in next in that tab. On Android, the site also installs a small service worker in your browser, so Chrome can offer to add Oolayum in one tap: it keeps no data and caches nothing, and only shows a short note in place of the browser's error page when you're offline.

Telling independent reports apart. When you contribute, we store a one-way, keyed code made from the first part of your IP address (not the address itself) for up to 31 days, in Cloudflare. It's used only to tell whether two reports came from the same network, so one person can't confirm their own price, or take a restaurant off the map alone. When you join (on your own or through a shared invite link), two separate codes of the same kind count how many people joined that day from your network, and from your connection and browser (made from your whole IP address, or the first half of an IPv6 one, with your browser's description: its name, version and system), so that making many accounts takes more than one connection; they hold no name or account and are deleted after 2 days. None of these is ever shown.

Deleting your account. Ask us at hello@oolayum.com. We delete your email and sign-in, and remove your link to your contributions; the prices themselves stay, without anything that identifies you. Your badges, your username, and your community posts, comments and votes are deleted (a code made from your username is kept for 90 days, as above, so nobody else can take it). Prices that were Yum Verified because you and another local agreed, and prices only you reported, stop showing until two locals confirm them. Reports you made stop counting, so a restaurant you helped take off the map can come back. If you sign in without joining (with Google or, where offered, Facebook or an email code), we delete that account on request.

Adding a meal as a guest

Without an account you can add one meal at a local restaurant we list, in any city we cover. Anyone can see it right away, labelled “Spotted by a guest”, with its dish, price and the date (never the time), and never with a name. We keep the meal and price, how you said you knew, when you added it, and that you confirmed you're 18 or older and accepted the terms.

Your browser gets a cookie holding a random code for 7 days, so this device can't add a second guest meal, and so the meal can become yours if you sign up or sign in on it. We keep a one-way code made from it (never the cookie itself). After 7 days it no longer works, and we delete it the next time anyone adds or keeps a guest meal, or our team checks guest meals. A separate keyed code made from the first part of your IP address, kept in Cloudflare, allows one guest meal per network a day; it holds no name and is deleted after 26 hours.

If you sign up, or sign in, on the same device within 7 days, the meal becomes one of your contributions (above), dated when you added it, and the cookie is cleared. On a shared device, that's whoever signs in there next. Otherwise it stays without anyone's name. It stops showing after 30 days, or as soon as a local reports it or adds their own price for that dish. To have a guest meal removed, email us the restaurant and the dish.

Meal photos

Explorers, and a guest with their one meal, can add a photo of a meal. Your phone removes the photo's location and camera details before it's sent, and we remove any that remain. Before a photo shows, an AI service (Anthropic, which doesn't use it to train its models) looks at it once, to check that it shows the food, with no people, nothing unsafe and no one's personal details readable. A photo that doesn't pass is deleted at once; we keep a note of it (who sent it, which meal, when, its size and why it was refused) for our daily limits. A photo that passes is public: anyone can see it on the meal's card and page, without your name and without a date. We keep which meal it's of, who added it (your account, or that it was a guest), when, its size and the check's result. You can remove your own photo on the meal's page while it shows; a guest can ask us at hello@oolayum.com. Anyone can report a photo (see Reporting, above); two independent Explorers' reports take it down. Deleting your account deletes your photos. A photo is never used to decide a price or to make it Yum Verified. If a photo appears to be illegal, we report it as the law requires and keep it, unseen and never shown, for as long as the law asks. To limit how many photos one account or one network can send, we keep counts for the day, under your account and under a code made from your network (never your address), deleted after about two days.

Menu photos

Explorers can snap a restaurant's menu (Snap a menu). Your phone removes the photo's location and camera details before it's sent, and we remove any that remain. The photo is stored privately (in Cloudflare R2) and read once by an AI service (Anthropic, which doesn't use it to train its models) to check it's a menu fit to show and list its dishes and prices; we keep that reading privately until the snap is undone or taken down or you delete your account. A snap you don't save at a restaurant within a day loses its photo and its reading the next time anyone snaps a menu. A photo that isn't a menu, shows a screen, has nothing we can use or isn't fit to show is deleted at once; we keep a note of it (who sent it, when, and why) for our daily limits and weekly counts, until you delete your account (then without your name). For a snap you save, we keep who snapped it, when, at which restaurant, and how many lines you saved, changed or unticked. The prices you save from a menu photo show as Spotted, naming you by your username as every spotter is, with “a menu photo” and its day (never the time). While a price from it shows, anyone can open the photo itself, with the restaurant, the day and your username (and for up to an hour after, in a browser that already opened it); it isn't shown to search engines. The reader doesn't check for people in a menu photo; anyone in one can report it. You can undo a snap on the screen right after you save it; after that, ask us. Undoing takes its Spotted prices off the map (one a second local already confirmed stays) and deletes the photo. Anyone can report the photo, signed in or not: that report is only an email to us, as a visitor's is (see Reporting), and our team can hide the photo or take the whole snap down. Deleting your account deletes your menu photos and their readings, except a photo our team hid after a report, which is kept, unseen, for up to a year.

Meal videos

Explorers can add a video of a meal, up to 60 seconds. It goes from your phone straight to Cloudflare Stream, which stores it and plays it; the copies people watch carry none of the location your phone may have written into the file. Before a video shows, an AI service (Anthropic, which doesn't use it to train its models) looks at still frames from across it, once, to check that the food can be seen, that nothing in it is unsafe, that no child is a main subject and that no one's personal details can be read. We don't check the sound. A video that doesn't pass is deleted at once, with its caption; we keep a note of it (who sent it, which meal, when, its size and why it was refused) for our daily limits. A video that passes is public as soon as it does: anyone can watch it on the meal's page, with its caption, your username (or “an Explorer” while you have none) and the day you posted it, never the time. That day tells viewers you were there that day. People in your video can be seen and heard by anyone. We may repost your video, with your username, on Oolayum's own social accounts. You can remove your own video on the meal's page, and its caption goes with it. Anyone can report a video (see Reporting, above), including someone who appears in it and wants it taken down: we act within a day; two independent Explorers' reports take it down too. Deleting your account deletes your videos. A video is never used to decide a price or to make it Yum Verified. If a video appears to be illegal, we report it as the law requires and keep it, unseen and never shown, for as long as the law asks. To limit how many videos one account or one network can send, we keep counts for the day, under your account and under a code made from your network (never your address), deleted after about two days.

The video feed

Explorers can like, save and comment on videos. A like or a save shows only as a number: nobody sees who liked or saved a video, and your saved videos are listed only for you. A comment shows with your username and the day, as a comment on a restaurant does, and anyone can report it. Your likes, saves and comments are deleted with your account. We count how many times a video is watched, and how many times someone taps Go for directions from it, as totals for each day, never who watched or tapped. To count each one once, the page gets a code that lasts two hours, made from your device's internet address (never the address itself) and kept with the day's counts for about two days; it isn't linked to your account. So that creators can't count their own views, we keep the same kind of code for the device a video was posted from, for 31 days. Near me sorts videos by distance on your phone: your location never leaves it. If you share a video's link, the app you share it in may keep the preview picture it fetched, even after the video is taken down.

While public profiles are on, Explorers can follow a creator whose profile is public. We keep who follows whom with each account. A public profile lists its followers and the accounts it follows, naming only accounts whose profile is public: a follow you make shows on that creator's Followers list and on your own Following list. An account without a public profile still counts in a creator's number of followers and in the line that counts followers without a public profile. A creator can remove you from their followers; we don't notify you, and you can follow again. The numbers on a creator's page are public: their videos, their followers, how many creators they follow, the likes on their videos, each video's total views, and their tier (worked out from followers whose accounts are at least a week old and have added or checked a price). Go taps aren't public: they stay in the creator's Studio and alerts, unless the creator shares a milestone card. Every count is worked out live from accounts that still count, so a removed account stops counting at once. Following is deleted when either account is. The Leaderboard's Top creators lists, for each city, creators whose profile is public by the views their videos gained there last week and the followers they gained last week (those who count toward a tier).

A Foodlist you make is public unless you turn Public off: anyone with its link can open it, and it shows on your profile with your username. A private one only you can open. Explorers can follow a public Foodlist. We keep which Foodlists you follow with your account; a Foodlist shows how many people follow it, never who, and the Foodlists you follow aren't public anywhere: they're listed only to you. While a Foodlist you follow is private or hidden, it leaves your list and its count, and your follow comes back if it's made public again. A follow is deleted when your account or the Foodlist is.

If you post videos, we keep alerts for you when a video reaches a number of views or Go taps, when you reach a number of followers, and when your tier changes, each with the day it happened. Your alerts and your Studio (your videos' numbers by day, and their Go taps) are yours alone; they're kept until you delete your account, and a video's go with the video. If you share a milestone, the picture shows the milestone (a Go-tap milestone included, which is otherwise yours alone), its day, the dish and restaurant, and your username.

Staff accounts

People who check prices for us sign in with their email address and a one-time code, and a sign-in cookie keeps them signed in on the staff pages. Their email, and a record of who added or checked each price, are stored in our database (hosted by Supabase). A price someone spotted before joining our team (“Spotted”, waiting for a second local) keeps naming them by their username, without a link to a profile; prices staff add are never Spotted. Staff may share their phone's location to pin a restaurant they're standing at, or to rank nearby branches when searching; a pinned location becomes the restaurant's public map position. Photos they take of menus are stored privately (in Cloudflare R2), with location data removed, and are used only to verify prices (Explorers' own menu photos are under Menu photos, above). Those photos, and screenshots our team takes of restaurants' own online ordering pages, are read by an AI service (Anthropic) to list the dishes on them; Anthropic doesn't use them to train its models. Our reader also reads restaurants' own online menus automatically: the page text (dish names, prices and the top of the page) goes to Anthropic to sort the dishes, and some of those prices show on the map labelled “From the restaurant” (“their website, read” and the date). In the cities we're starting in, it reads a limited number of restaurants' menus a day this way, so each city has prices for locals to check; those prices too are never Yum Verified until two locals confirm them. “Wrong price?” needs no account: to limit how many one network can send, we keep a count under a code made from your network and that day's date (never your address, and never with the report), deleted after about a day. When we call restaurants to check prices, we don't record the calls or note the names of the people we speak to.

Restaurant information

Restaurant names, addresses and locations are public business information from our own checks and from open data (see Data sources). Restaurants can ask us to correct their listing at hello@oolayum.com.

Claiming a restaurant. If you claim a restaurant, we keep the claim with your account: the restaurant, its code, the email address you give for it (we send the code there, and tell you there when we approve, turn down or later take back the claim; Resend delivers it, above), when you asked, and what we decided, when and why, including the Facebook page your code came from. If we turn a claim down, we delete the address given for it. Our inbox gets a copy of each new claim with your username and the code. Facebook has the message you send us, under its own terms. Once approved, your restaurant's page says “Claimed by the owner” and your comments there are labelled as the owner's; your email address is never shown publicly (our team sees it with the claim). Deleting your account deletes your claims.

My restaurant. If you own a restaurant on Oolayum, the prices you set and what you say about them there (a price is still right, a new price, a dish you no longer offer) are kept with your account, with when you did it, and the audit log keeps what changed. Customers see them as “From the restaurant” with “the owner” and the day (never a time), never with your username. If your claim is taken back or you delete your account, they stop counting; they're kept, marked withdrawn, until your account is deleted, when the link to you goes too. What you keep about the restaurant there (its phone, About, hours and menu link, and the meals you feature) shows on its page as from the restaurant while your claim counts, and is removed when it's taken back or you delete your account; our change log keeps who changed what and when, as it does for every change to a restaurant, even after that. A dish photo you add at your restaurant, including any you added there before your claim was approved, is marked “Photo from the restaurant” while your claim counts, which tells anyone who sees it that the restaurant's owner took it (never your username, never when, as for every meal photo).

Your choices and requests

Wherever you live, including Texas, you can ask us to confirm whether we hold personal information about you, see it, correct it, delete it, or get a copy. We honor these requests. We don't sell personal information, use it for targeted advertising, or profile people, so there is nothing to opt out of. Email hello@oolayum.com; we'll answer within 45 days. If you browse without an account, we usually hold nothing that can be tied to you, and we'll tell you so.

If you signed in with Facebook, you can also remove Oolayum in Facebook's settings (Apps and Websites): that removes Oolayum's access to your Facebook account. To delete what we hold, including your account, email us as above.

If we decline a request, reply to our answer with “appeal” and we'll review it again within 60 days. If you're still not satisfied, you can contact the Texas Attorney General.

Children

Oolayum isn't directed to children under 13, and we don't knowingly collect their personal information. Contributor accounts are for adults 18 and over.

Changes

If we change how we handle information, we'll update this page and its date before the change takes effect.