Privacy Policy

1. Who to contact

Bibiko LLC operates Bite and is responsible for the personal data handled through its service. Our privacy contact is admin@bitesg.com. For privacy questions, access or correction requests, withdrawal of consent, or concerns about your data, email that address. Please include your Bite username and the nature of your request. Do not send your password, one-time codes or banking credentials.

You can also contact us through Account settings → Contact Us. We may ask you to verify that you own the account before acting on a request.

2. Data we collect

Account and profile data: your email address, account identifier, username, display name, profile photo, bio, sign-in provider information, account settings and authentication/session records. If you sign in through Apple, Google or another supported provider, we receive the account information that provider supplies with your authorisation. Email/password authentication is handled through our authentication provider.

Content and social activity: the restaurants you review, rate, visit or save; visit dates; review text; what you ordered; uploaded photos, videos and associated file metadata; guides and recommendations you create; recommendation credits; comments; likes; tags; follows and follow requests; blocks; historical mute preferences; chat messages and shared restaurant, visit or guide links.

Taste and progress data: numerical ratings, including optional ratings during onboarding; preferences derived from those ratings and restaurant characteristics; your XP, level and milestone history; and invitation attribution. XP has no cash value.

Support and safety: the name, email address and message you enter in a support or advertising enquiry, content reports, report reasons, moderation decisions and related correspondence.

Technical and usage data: network information such as IP addresses, request times, device/app information supplied to our services, push notification tokens, error and performance information, and limited interaction events such as saving a place or opening a restaurant from the feed. These help us operate the app, diagnose failures and prevent abuse.

When product analytics is enabled, Bite uses PostHog to measure screen visits, onboarding steps, saving places, publishing reviews, visible deal cards, opening deals and tapping their website links. Deal events include the public deal identifier and headline, the screen placement and a random card-exposure identifier so we can count views, clicks, unique accounts and click-through rates. We do not send the destination website URL in these events. Events also include an anonymous installation identifier or your internal account identifier, app/device information and the app environment. Analytics does not include your email, display name, review or message text, contact list, precise location, passwords or sign-in tokens. Screen names use route templates rather than usernames or invitation codes. Session recording and automatic capture of taps and text are disabled.

When error tracking is enabled, Bite also sends PostHog JavaScript error reports and native crash diagnostics to investigate app failures. Reports can include exception messages, stack traces, app version, device and operating-system information, and an anonymous installation or internal account identifier. Bite filters common credentials, email addresses, URL query strings and request payloads from JavaScript error reports. This filtering is best effort and does not run on reports produced directly by the native crash SDK; diagnostic messages may contain incidental personal information. Console-log collection, session recording and network request-body capture are disabled.

Optional permissions can provide contact email addresses, foreground location, selected photos or videos, and camera or microphone input. Section 5 explains how we use these.

For Sign in with Apple, authorisation codes and identity tokens are verified with Apple. Bite stores the refresh authorisation in encrypted form to revoke Apple access when you delete the account.

3. How we use data

We use this data to create and secure your account; display and deliver content; help you discover restaurants and people; operate follows, chat and notifications; calculate restaurant and personal scores, recommendations, Taste Match, XP, levels and Top Fan status; attribute invitations and recommendations; answer enquiries; moderate content; prevent fraud and abuse; diagnose and improve the service; and meet applicable legal obligations.

Recommendations and Taste Match use permitted numerical restaurant ratings and restaurant characteristics to estimate preferences and similarity. They are suggestions, not guarantees that you will enjoy the food. Ratings supplied during onboarding inform recommendations and restaurant averages without creating a recent visit. Restaurant scores, visit counts and XP also use information derived from activity in Bite.

We do not sell personal data. We do not use contact matching for advertising, and we do not use your Bite activity to track you across other companies’ apps or websites for targeted advertising.

We filter submitted text for certain harmful terms and threats. Automated text filters can make mistakes; contact Bite support if you believe your text was incorrectly rejected.

4. What other people can see

Your profile starts public. Public profile activity can include visits, reviews, rated places, published guides and saved places. A private profile limits its activity to approved followers; your basic profile identity may still be visible so people can find or recognise your account. Guides from private accounts require sign-in and approved follower access; a shared link can still show the guide title, author and publication date. Publishing a guide from a public profile is an explicit sharing action. Exported guide images can be saved or shared by recipients and cannot be withdrawn from their devices.

Important: making your profile private does not make restaurant reviews private. Published restaurant reviews, ratings, associated photos or videos, and author identity can still appear on restaurant pages. Aggregate restaurant scores and visit counts can include activity from private accounts without listing those accounts’ private histories.

Following and tagging can reveal social connections. Taste Match and shared-rating comparisons are shown only where the viewer is permitted to access the underlying information. Chat messages are visible to the conversation participants; authorised Bite personnel may access data where needed for support, safety or service operation.

Eligible reviews can be shared through public links when sharing is allowed. Review sharing is automatically disabled for private profiles. Making a profile public enables review sharing. People may save screenshots, forward links or copy content they can access. Changing settings or deleting content cannot remove copies already made outside Bite.

Your sign-in email and contact-matching input are not displayed to other users through those features. Bite's current XP and badges have no cash value and cannot be redeemed. If you supplied payout details under an earlier Bite programme, access to those historical records is restricted to authorised administrators and they are retained only as needed for outstanding requests, security or legal obligations.

5. Optional device permissions

Location: with your permission, Bite uses foreground location to centre Explore and find nearby restaurants. Map areas and search terms are used to retrieve restaurant options. Bite does not request background location tracking. You can search or move the map manually without granting location access.

Contacts: with permission, Bite reads contact email addresses and sends a limited set to its service to match discoverable accounts. The matching input is not stored as a contact list, and Bite does not send automatic invitations to your contacts. You can control whether your verified email can be matched through Let friends find me in Find Friends.

Photos, camera and microphone: these are used when you select or capture media for a review or profile photo, including audio in a video. Uploaded files can contain embedded metadata. Take care not to include private information about yourself or others in content you publish.

Notifications: if enabled, your device’s notification token is used to deliver notifications through our delivery providers. Previews may be visible on your lock screen, depending on your device settings.

You can decline optional permissions or withdraw them in your device settings. This stops future permission-based access, but does not automatically delete content you already uploaded or messages you already sent. Some related features may become unavailable.

6. Providers and other disclosures

Bite uses service providers to operate the app. These include Supabase for authentication, database and media storage; Google Cloud for backend services, media processing and operational logs; Cloudflare for network delivery, caching and abuse protection; Google Maps for maps; Expo and platform push services for notification delivery when enabled; and Resend and mailbox providers for account, support and operational email. They receive the data necessary for their respective services.

PostHog processes the product analytics and error/crash diagnostics described above to help us understand and improve Bite. These reports are sent to Bite’s PostHog project in the United States and may be processed outside Singapore. PostHog receives network information needed to deliver events. Bite disables automatic IP-based geolocation enrichment for product analytics and JavaScript error events; native crash reports may still receive approximate location derived from the network connection.

A sign-in provider processes your login under its own privacy terms. Map services may receive network, device, map-request and location information when you use their features. The Google Maps Android SDK also collects an SDK-specific pseudonymous identifier, request metadata, crash metrics and map interactions such as panning or zooming to operate and improve Google services. Links you choose to open outside Bite are governed by the destination service’s privacy terms.

We require providers processing personal data on Bite’s behalf to protect that data and limit its use to the agreed service purposes. Independent services, such as your chosen sign-in provider, also apply their own privacy terms.

We may disclose necessary information when required by law or a valid legal process, or where permitted by law to investigate abuse, protect people’s safety, resolve disputes or protect the service.

7. Storage and overseas processing

Bite’s primary database, media storage and backend services are configured in Singapore. Supporting providers, network delivery, email, maps, notifications and their support or security operations may process data in other countries. We do not promise that every copy stays in Singapore.

For transfers of personal data outside Singapore, we use applicable contractual and other safeguards to require a standard of protection comparable to the requirements of Singapore’s Personal Data Protection Act, unless an applicable legal exception permits otherwise.

8. Retention and deletion

We retain account information and published content while needed to provide the service and for necessary security, dispute-resolution or legal purposes. Saved places and social settings remain associated with your account until you change them or delete the account.

Chat messages expire from normal access 90 days after acceptance by the server. Expired messages are eligible for scheduled deletion; cleanup can occur later than the access expiry.

Deleting a visit or review removes it from normal display. Related records may remain for restoration, XP accounting and abuse prevention. Media attached to a deleted review becomes eligible for cleanup after 30 days. Incomplete uploads expire, and abandoned, unattached processed media becomes eligible for cleanup after 31 days of inactivity; cancelled, rejected or expired uploads can be cleaned up earlier. Cleanup timing can depend on processing and provider availability.

Unfinished visits can be saved as drafts on the device where you write them. Draft text, visit details and selected media are stored separately for each Bite account and are not synchronised as drafts to your other devices. Selected media may be uploaded for processing before you publish a review; saving a draft does not publish it. You can resume or delete drafts from your own profile. Signing out keeps your local drafts for that account; completing account deletion in the app removes its local review drafts, pending review data and draft media from that device. Uninstalling the app normally removes its local data, subject to device backup and restore settings. Submitted changes with an uncertain server response can retain account-scoped retry information until resolved. Chat can retain local working text and pending messages.

To delete your account, go to Account settings → Delete account and complete the verification. You can also request deletion of your Bite account and associated data by emailing admin@bitesg.com from your registered email address with the subject Delete my Bite account and your Bite username. You do not need to reinstall or sign in to the app to make an email request. We verify account ownership before processing it; do not send your password or sign-in codes. A verified deletion request disables account access and starts removal of your profile details, content, guides, ratings, social connections, chat conversations, progress history, authentication account and stored media. Provider removal may take additional time; a temporary provider failure can delay completion.

Limited deletion receipts and an internal identifier can remain to record the outcome and prevent duplicate processing. Necessary security, support and moderation records are retained only while needed for their purposes or required by law.

Where providers maintain backups or operational logs, deleting live data may not immediately remove every historical copy. Such copies remain subject to the provider’s retention and deletion schedules. Copies held by other users or independent services are outside Bite’s control. Contact us if you need details about retention or a particular deletion request.

Restricted provider authorisation tokens and cleanup identifiers can remain while deletion or revocation is pending, and are removed when those operations complete.

9. Keeping data secure

Bite uses encrypted network connections, account authentication, access controls and restricted administrative access to protect personal data. Access is limited according to the feature and the person or service’s role. No system can guarantee absolute security.

Bite chat is not end-to-end encrypted. Messages are processed and stored by the service to deliver chat and enforce access and expiry rules. Keep your device and sign-in credentials secure, and contact us if you suspect unauthorised access.

10. Your choices and requests

You can edit profile information, change profile privacy, manage follows, block accounts, control email discoverability in Find Friends, manage notification settings, and delete reviews or your account using the app. Review sharing follows your profile privacy. Hide from Top Fan in Account settings lets you opt out of Top Fan participation and badges. Device settings control location, contacts, camera, microphone and photo permissions.

You can email admin@bitesg.com to request access to your personal data, ask how it has been used or disclosed, correct inaccurate information, withdraw consent or raise a privacy complaint. We will handle requests according to applicable law, including any required identity checks, exceptions or response notices. If withdrawing consent prevents us from providing a feature, we will explain the consequences.

Uninstalling the app or signing out does not delete your server-side account or published content. Use Delete account or contact us for a deletion request.

11. Age and availability

Bite is intended for users aged 13 and over and operates only in Singapore. Children under 13 should not create an account or use the service. If you are a parent or guardian and believe a child under 13 has provided personal data, contact admin@bitesg.com so we can investigate and address it under applicable law.

12. Changes to this policy

We will post updates here with a revised date. For material changes we will provide additional notice where required, and seek any consent required before using personal data for a new purpose.