Privacy Policy

01Controller and contact

Favy and favy.mehrbytes.com are operated by mehrbytes GbR, Mika Jens Ramsl und Mats Ramsl, An der Ehmsenkoppel 28, 24376 Rabel, Germany. We are the controller for the processing described here. Contact us about privacy or your data protection rights at favy@mehrbytes.com.

02What Favy does

Favy lets you save and rate dishes and restaurants, organize personal and shared lists, discover recommendations from friends, view places on a map, collect Food Passport stamps, and display widgets. Favy is an online service: account information, uploaded photos, reviews, and shared content are processed on our backend. They are not stored exclusively on your device.

03Account and profile information

We process your account identifier, email address, authentication information, and profile details you supply, such as display name, profile photo, location, phone number, favorite cuisines, and food preferences. If you choose Apple or Google sign-in, we receive the identifiers and profile information made available by that provider, such as your email address. We do not receive your Apple or Google password.

These data enable authentication, account management, profile display, and the social features you request. The legal basis is Article 6(1)(b) GDPR. Information needed for an account is necessary to provide account-based features; optional profile fields can be left blank. Avoid including health, religious, or other sensitive information in free-text fields.

04Dishes, photos, reviews, and lists

We process the dishes, restaurant or place information, ratings, photos, notes, visit dates, tags, and other details you save, together with list membership, saved items, and creation or modification times. We use this information to provide your food collection, rankings, maps, Food Passport, and sharing features under Article 6(1)(b) GDPR.

Selected photos are uploaded when you use an upload feature. Your device may retain local copies and cached images. Camera or photo access is controlled through your device permissions; access is not permission to use your whole photo library for marketing.

05Public and shared content

Content you make public can be viewed by other people in accordance with the relevant visibility setting. Your display name, profile image, reviews, and associated place or visit information may identify you. Shared lists are accessible to their authorized participants. Following relationships, requests, and invitations are processed to provide the social features you use.

Check the visibility of a profile, dish, or list before sharing. Recipients may save, screenshot, or redistribute information they can see. Making an item private or deleting it cannot automatically remove independent copies held by others.

06Your visibility and how people can find you

You can manage how other people discover your profile in Favy. In Settings → Privacy, you can independently switch “Appear in suggestions” and “Appear in search” on or off. You can change these choices at any time.

Phone discoverability is a separate choice associated with your phone-number settings. If you enable “Discoverable by phone”, people who know your number may find your profile through phone search or contact matching. You can disable that choice again. Switching off search or suggestions does not by itself disable phone matching; review the phone-discoverability setting separately.

In the Privacy settings, you can also choose whether your profile photo and profile location are visible to everyone or only to friends. Friends can still see these profile details under the friends-only setting.

Discoverability controls govern how people find you; they do not automatically make your profile, reviews, or lists private. Direct profile links and existing connections may still allow people to reach your profile. The visibility settings for your profile and individual content continue to apply. Changes do not recall information that another person has already seen or saved.

07Location and maps

With location permission, Favy can use your device location to show nearby places and position the map. You can refuse or revoke this permission in system settings and use available manual search or map navigation instead. Locations you attach to a saved dish or restaurant are part of that entry and follow its visibility setting.

Google Maps and related place services process technical connection information, including IP addresses and information needed to deliver map content. Map areas, search terms, or location coordinates may be sent when required for the feature you request. The basis for requested map functionality is Article 6(1)(b) GDPR; optional device-location access relies on your permission and, where required, Article 6(1)(a) GDPR.

08Contacts and finding friends

If you grant contacts access and use the friends-discovery feature, Favy reads contact phone numbers on your device, normalizes them, and sends up to 500 distinct numbers per lookup to our backend to match Favy profiles. This is a server-side lookup, not a purely local search and not an anonymized lookup. Other users can find your profile by matching your phone number only when you have enabled phone discoverability. Adding a phone number alone is not permission to make you discoverable by phone.

Contacts access is optional and can be revoked in system settings. Your optional access is based on consent under Article 6(1)(a) GDPR where applicable. Limited matching of third-party contact information serves the legitimate interest in connecting existing users under Article 6(1)(f) GDPR, subject to their rights and reasonable expectations. You may object to this processing through our privacy contact. An address-book permission does not give us permission to advertise to your contacts.

09Notifications and widgets

Firebase Cloud Messaging and our notification backend process device registration tokens, account associations, and notification payloads to deliver app notifications. Notification permission can be changed in system settings. Service messages rely on Article 6(1)(b) GDPR; optional notifications that require consent rely on Article 6(1)(a).

Home-screen widgets use selected Favy content and locally shared app data to show dishes or Passport information. People with access to your device may be able to see this content on your home screen.

10Cloud infrastructure and Supabase

We use Supabase for authentication, database storage, and uploaded images. Account information, food entries, social relationships, lists, and related files are processed there to operate Favy. Supabase Pte. Ltd. acts as a service provider for these functions. Processing necessary to deliver your requested features is based on Article 6(1)(b) GDPR; security and abuse prevention are based on Article 6(1)(f).

11Usage analytics with PostHog

We use PostHog to understand how Favy is used and improve the app. We collect information about features you use, such as opening screens, creating dishes or lists, and using maps, together with technical device information. These usage events can be linked to your Favy account through a technical user ID, so they are not anonymous. We do not use session recordings.

In the current app configuration, analytics is enabled by default and can be disabled through the app tracking setting. Disabling analytics does not itself delete previously collected information; you can also contact us to request deletion. Optional analytics requiring consent must rely on Article 6(1)(a) GDPR and any applicable device-access consent rules. This notice and continued use of Favy do not themselves constitute that consent.

12Firebase diagnostics and configuration

Favy uses Firebase Crashlytics for crash reports and technical error analysis, Firebase Remote Config for app configuration, and Firebase services for notification-related infrastructure. These services can process installation identifiers, device and operating system information, app version, IP addresses, and error or configuration-request data. Firebase is provided by Google; the responsible entity depends on the applicable service agreement.

Crash reporting is currently enabled in the app independently of the PostHog analytics setting. Necessary security and reliability diagnostics are assessed under Article 6(1)(f) GDPR; where consent is required for additional collection or access to device information, Article 6(1)(a) GDPR and the applicable device-access rules apply.

13Purchases and subscriptions

Favy uses RevenueCat, Inc. to manage purchases, subscription status, and access to paid features. This involves an app user or purchase identifier, product and transaction identifiers, subscription status, and technical information. Payment is handled by Apple or Google; we do not receive your full card details. Processing to provide purchased features relies on Article 6(1)(b) GDPR and legally required transaction records on Article 6(1)(c).

14Website, hosting, and local storage

When you visit favy.mehrbytes.com, our hosting infrastructure processes connection data such as IP address, request time, requested URL, browser and operating system information, referrer, and security logs to deliver and protect the website. This relies on Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure and functional website.

The website uses Google Analytics 4 to measure page views and general website usage. Google may process technical and usage data such as browser and device information, approximate location, referrer, and interactions with the website. The app stores settings, session information, and cached content on your device as needed for its functions. Opening an external link subjects the subsequent visit to that website’s privacy practices.

15Support and content reports

If you contact us, we process your email address, message, and any screenshots, account references, or transaction information you choose to provide. This is used to answer requests, resolve problems, and investigate reported content under Article 6(1)(b) or (f) GDPR, or Article 6(1)(c) where a legal duty applies. Do not send passwords, payment card details, or information about other people that is not needed for your request.

16Public reviews in Favy marketing

We may feature public reviews, ratings, and photos in Favy marketing within the limited promotional licence described in the Terms. Private entries and restricted shared lists are excluded. Copyright permission does not remove your data protection or personality rights.

Where promotional material identifies you through a name, profile photo, recognizable likeness, or other personal data, we obtain a separate, voluntary consent before that use. The legal basis for that identifiable promotional use is Article 6(1)(a) GDPR. We explain the intended material and channels when requesting consent. Refusing does not affect core app access.

Withdraw that consent or request an end to promotional reuse by emailing favy@mehrbytes.com. Withdrawal does not make earlier lawful use unlawful. We stop new uses and remove material under our control as described in the Terms, subject to your statutory rights.

17Recipients and international transfers

Data are accessible to authorized people working for Favy and service providers only as needed for their tasks, and to other users or the public according to your sharing choices. Authorities or advisers may receive information when required by law or necessary to establish, exercise, or defend legal claims.

Some providers or their subprocessors may process data outside the EU or EEA, including in the United States. An EU service endpoint alone does not rule out international access. Where a restricted transfer takes place, it requires an applicable adequacy decision, or suitable safeguards such as the European Commission’s standard contractual clauses and any necessary supplementary measures. Contact us for information about the safeguards applicable to your data.

18How long we keep data

We retain account and food content while needed to provide your account and the features you use, unless you delete it earlier. After deletion, information needed for legal obligations, fraud prevention, or the defense of legal claims is retained only for the relevant statutory or limitation period and restricted to that purpose. Backups and cached copies may expire later according to the service provider’s retention cycle.

Diagnostics and analytics are retained for the periods configured in the relevant service and only for as long as needed for their stated purpose. Support correspondence is retained while handling the request and for any necessary follow-up or legal period. You can ask us for the applicable retention details for a particular category. Promotional permissions and their withdrawal may be retained as evidence of compliance.

19Your rights and account deletion

Subject to the applicable conditions, you can request access, rectification, erasure, restriction, or portability of your personal data. You may object to processing based on legitimate interests, and may object to direct marketing at any time. Consent can be withdrawn at any time with effect for the future.

You can request account deletion through the app settings or email favy@mehrbytes.com, including if you can no longer access the app. We may need proportionate verification to protect your account. Deleting an account or uninstalling Favy does not automatically cancel an Apple or Google subscription.

You can complain to a supervisory authority, including the authority for your habitual residence, workplace, or the alleged infringement. Our local authority is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD).