1. Introduction
Welcome to NateEatsHawaii.com ("we," "our," or "us"), operated by NateEatsHawaii LLC, a Hawaii limited liability company. We value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, share, and safeguard your data when you visit our Website, use the NateEats iPhone app, subscribe to our newsletter, or otherwise interact with our content. Sections 1, 2 and 4 through 12 describe our Website; Section 3 describes the mobile app specifically, and where the two differ, Section 3 governs the app. NateEatsHawaii LLC acts as the data controller for personal information collected through the Website and the app. By using the Website or the app, you consent to the practices described in this policy. This document is provided for informational purposes and does not constitute legal advice.
2. Information We Collect
- Information you voluntarily provide: email address (newsletter signup), name and message content (contact forms), and any details you submit through giveaways, comments, or correspondence
- Automatically collected technical data: IP address, browser type and version, operating system, device type, screen resolution, language preference, referring URL, and timestamps
- Usage and analytics data: pages visited, time spent on each page, scroll depth, click patterns, search queries within the site, and traffic sources
- Cookies and similar tracking technologies as described in Section 5
- Aggregated, non-identifying statistics derived from any of the above
3. The NateEats iPhone App
This section covers the NateEats mobile app, which is published by NateEatsHawaii LLC and shares a database with this Website. Browsing restaurants, reading reviews, searching, and using the map in the app require no account and no personal information.
Account
If you choose to sign in — needed to save spots, post reviews, check in and earn points, redeem rewards, RSVP to events, host or join a table, report content, block a user, or request a restaurant owner account — we receive your email address and a user ID from Sign in with Apple or Sign in with Google. Those two are the only sign-in methods the app offers, and it has no password field: we never receive, see, or store a password. If you use Sign in with Apple's Hide My Email, we only ever receive the private relay address Apple issues, we never request your name, and we make no attempt to resolve a relay address to your real one. Your account record holds your email address, a user ID, whether you are a diner or a restaurant partner, the restaurant you have been approved to manage if you are a partner, and the date the account was created. We do not collect a display name, username, avatar, or profile photo — reviews are shown under a label generated from your user ID, such as "Diner 4F2A".
Location
With your permission, the app uses your location to show how far restaurants are, to sort and filter listings by what is nearest, to look up walking, driving and transit times, to answer "what's good near me" in Ask NateEats, and to confirm you are actually at a restaurant when you check in for points. The app asks only for "While Using the App" access and never requests background or Always access. Distances and all "nearest first" ordering are computed on your device from a restaurant list already downloaded to the app; no coordinates are transmitted for them. Your coordinates leave your device in exactly three situations: when you check in, so our server can verify you are within 150 metres of that restaurant; when you ask Ask NateEats a question while on Oahu, so it can answer "near me"; and when a restaurant page loads travel times, which sends your position to Apple Maps to calculate the route. Your location is never used for advertising and never used to track you across other companies' apps or websites. Every feature except checking in works with location turned off.
Content you post
Your rating, tags, review text, photos and voice recordings are stored with your account and shown on that restaurant's page. Ratings, tags and review text appear as soon as you post them and are visible to everyone, including people who are not signed in. Photos and voice recordings are different: they are held and appear only after a person at NateEats has reviewed and approved them. Photos can only be taken with the camera inside the app — there is no photo library upload, and the app does not request access to your photo library. Photo and voice files are stored at long, randomly generated web addresses that we do not publish, list, or index; those addresses are not password-protected, so anyone who obtains the exact address can open the file directly, including before it is approved.
Microphone and speech recognition
The review composer's microphone button both transcribes your speech into text and saves the recording as an audio clip attached to your review. Transcription uses Apple's speech recognition: it runs entirely on your iPhone wherever your device and language support Apple's on-device model, and where they do not, iOS sends the audio to Apple's servers for transcription under Apple's own privacy policy. Separately, the audio recording itself is uploaded to us when you post the review, unless you remove or re-record the clip first, and is published on the restaurant's page once approved. See our Terms of Service for how to have a posted recording removed.
Ask NateEats
Ask NateEats is an in-app assistant that answers questions about where to eat, and it works with or without an account. When you ask a question, we send the question text, up to four previous turns of that conversation, your app language, your account token if you are signed in, and — if you have granted location access and are on Oahu — your coordinates, to our own server at nateeatshawaii.com. That server forwards your question and those previous conversation turns to Voyage AI to compute a search index lookup and to Anthropic's Claude API to compose the answer. Your coordinates are not sent to either provider: they are used only on our own server, to work out which restaurants are nearest you and to order the results. The resulting distance to each suggested restaurant (for example "0.4 mi") is included in what we send to Anthropic, so the answer can tell you how far away a place is. Your account token is used only to count your questions against your own rate limit and is not sent to either provider. We retain the question, the answer, and a truncated one-way hash of your IP address so we can evaluate and improve answer quality. We do not retain your coordinates.
Diagnostics
The app reports technical errors — for example a failed network request — so we can spot outages. The diagnostics table has no user, device, or session identifier column, and we do not attach your account ID to a report. Because a report includes the text of the underlying error, it can incidentally contain the technical address of the request that failed, and for requests that fetch your own saved spots, points, check-ins or redemptions that address contains your account ID. These reports are readable only by the app administrator and are used solely to spot aggregate failure rates.
Advertising and tracking
The app contains no advertising SDK and no cross-app tracking SDK, does not use an advertising identifier, and does not ask for App Tracking Transparency permission. We do not sell or share app data. The one third-party SDK in the app is Google Sign-In, which we use solely so you can sign in with a Google account; Google may collect a device identifier and usage data through it as described in Google's own privacy policy. Note that this Website — including the page you are reading — is separate from the app and does use Google Analytics, the Meta Pixel and MailerLite as described in Section 6.
Where it is stored
App data is stored with Supabase (PostgreSQL and object storage), hosted on Amazon Web Services infrastructure in the United States, under Supabase's data processing terms. Additional processors receive specific data as described above: Apple and Google for sign-in, Apple for maps, directions and speech recognition, and Voyage AI and Anthropic for Ask NateEats. Each operates under its own privacy policy.
Deleting your data
You can delete your account at any time from inside the app: tap the gear icon at the top of the screen to open Settings, tap "Delete account", then confirm with "Delete everything permanently". This deletes your profile, reviews, photos, voice recordings, saved spots, check-ins, stamps, points and redemption history, and deletes your uploaded photo and audio files from storage. Content you created in a partner or administrative capacity is retained with your identifier removed, as are reports other users filed and anonymous diagnostics that carry no account identifier. Deleting your app account does not remove ratings or comments you left on this Website without signing in, because those are stored against a browser cookie rather than an account. You can also email hello@nateeatshawaii.com for any deletion request and we will action it within 30 days.
4. How We Use Your Information
- To send our weekly food guide newsletter and occasional updates about new restaurants, guides, and content
- To improve our Website performance, content quality, and user experience
- To respond to inquiries, contact form submissions, and giveaway entries
- To analyze traffic patterns and understand how visitors discover and navigate the site
- To detect, prevent, and address technical issues, fraud, abuse, or security threats
- To comply with applicable laws, regulations, and lawful requests from authorities
- To enforce our Terms of Service and protect our legal rights
- To send occasional news and deals emails to app account holders — you can unsubscribe from any email, or in the app's Settings, at any time
5. Cookies & Tracking Technologies
We use cookies and similar technologies to enhance Website performance, remember your preferences, measure traffic, and understand how visitors interact with our content. For visitors located in the European Economic Area, the United Kingdom, or other jurisdictions requiring prior consent, non-essential cookies will only be set after you provide explicit consent through our cookie banner. Cookies on this site are set by:
- Google Analytics 4 (GA4) — measures website traffic, session behavior, and usage patterns. GA4 collects data including IP addresses (anonymized), device information, and page interactions. Google Consent Mode v2 is implemented for EEA visitors. You may opt out using the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout
- Meta Pixel (Facebook/Instagram) — measures the effectiveness of content shared on Meta platforms. Meta Pixel collects IP addresses, page views, clicks, cookie identifiers, browser and device information, and Facebook account linkage where applicable. Data is transferred to Meta Platforms, Inc. in the United States. For EEA visitors, Meta Pixel only fires after explicit consent
- Cloudflare — provides website security, bot mitigation, performance optimization, and privacy-respecting web analytics. Cloudflare processes IP addresses and HTTP request data for security purposes
- MailerLite — manages newsletter subscriptions and tracks email engagement. MailerLite acts as our data processor under a data processing agreement
- Essential first-party cookies — to remember your language preference (EN/JP) and other site settings
You can disable cookies in your browser settings or use private browsing mode at any time. Disabling cookies may limit some site features. We honor Global Privacy Control (GPC) signals where technically feasible. Your browser may also send a "Do Not Track" signal; we respect such signals where supported by our analytics providers.
6. Data Sharing & Third-Party Services
We do not sell, rent, or trade your personal data to third parties. The following third-party service providers process visitor data on our behalf as data processors under their own privacy policies and data processing agreements:
- Google Analytics (GA4) — operated by Google LLC, certified under the EU-US Data Privacy Framework for transatlantic data transfers
- Meta Pixel (Facebook) — operated by Meta Platforms, Inc., certified under the EU-US Data Privacy Framework
- Cloudflare, Inc. — provides website security, performance optimization, and analytics; certified under the EU-US Data Privacy Framework
- MailerLite (UAB MailerLite) — stores email addresses and sends newsletters on our behalf; ISO/IEC 27001:2022 certified, with EU data stored in Germany and the Netherlands
- Our hosting provider — stores website files and processes server logs
- Supabase — provides the PostgreSQL database and object storage behind the NateEats app and this Website's review and saved-spot features, hosted on Amazon Web Services infrastructure in the United States
- Apple and Google — provide Sign in with Apple and Sign in with Google for the app; Apple additionally provides maps, directions and speech recognition as described in Section 3
- Voyage AI and Anthropic — process the text of questions asked through Ask NateEats in order to search our guides and compose an answer, as described in Section 3
- Calendly — if you submit the enquiry form on our services pages, a Calendly scheduling page opens so you can book a call; Calendly receives whatever you enter there under its own privacy policy
Each service operates under its own privacy policy, and we encourage you to review them. We may disclose your information if required by law, court order, subpoena, or to protect the rights, property, or safety of NateEatsHawaii LLC, our users, or others. We may add additional services in the future and will update this policy accordingly.
7. Data Security & Retention
We apply industry-standard security measures including encrypted HTTPS connections, secure third-party processors, and access controls. No system is completely secure, and we cannot guarantee absolute security. Specific retention periods: newsletter subscriber data is retained while your subscription is active and deleted within 30 days of unsubscribe; contact form submissions are retained for 12 to 24 months and then deleted; Google Analytics data is retained for 14 months; Cloudflare server and access logs are retained for 30 to 90 days for security purposes; cookie consent records are retained for the duration of your consent plus up to 3 years as compliance evidence. In the event of a data breach affecting Hawaii residents, NateEatsHawaii LLC will provide notification in accordance with Hawaii Revised Statutes Chapter 487N.
8. Your Rights
- Right to access the personal data we hold about you
- Right to request correction of inaccurate or incomplete data
- Right to request deletion of your personal data ("right to be forgotten")
- Right to object to or restrict certain processing activities
- Right to data portability where technically feasible
- Right to unsubscribe from the newsletter at any time using the link in every email
- Right to lodge a complaint with a data protection authority in your jurisdiction
- For European Economic Area and United Kingdom visitors: rights under the General Data Protection Regulation (GDPR) and UK GDPR, with NateEatsHawaii LLC acting as data controller. The legal bases for processing are consent (for non-essential cookies and marketing), legitimate interest (for site security and analytics), and contractual necessity (for newsletter delivery)
- For California residents: rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know, delete, correct, and opt out of any sale or sharing of personal information. We do not sell personal information
- For Japanese residents: rights under the Act on the Protection of Personal Information (APPI), including the right to access, correct, and request deletion of personal information. NateEatsHawaii LLC processes personal information in the United States, which may have different data protection standards than Japan. By using the Website, you consent to the cross-border transfer of your data to the United States
9. Third-Party Links & International Visitors
NateEatsHawaii includes links to external websites and social media platforms (including Instagram, YouTube, Facebook, TikTok, Google Maps, and restaurant websites). We are not responsible for the privacy practices, content, or accuracy of these third-party sites and recommend reviewing their privacy policies separately. The Website is operated from the United States and hosted in the U.S. If you access the Website from outside the United States, including from the European Economic Area, the United Kingdom, or Japan, your data may be transferred to, stored, and processed in the U.S., which may have different data protection laws than your country of residence. Where applicable, we rely on the EU-US Data Privacy Framework, Standard Contractual Clauses, or your explicit consent as legal bases for international data transfers.
10. Children's Privacy
Neither NateEatsHawaii.com nor the NateEats iPhone app is directed at children under the age of 13. The app is rated for ages 17+ on the App Store, is not aimed at children, and is not included in Apple's Kids Category. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If you are a parent or guardian and believe your child has provided personal information to us through the Website or the app, please contact hello@nateeatshawaii.com immediately and we will take steps to delete it, including any account, reviews, photos and voice recordings.
11. Updates to This Policy
We may occasionally update this Privacy Policy to reflect changes in our practices, services, or applicable laws. The "Last updated" date at the top of this page will reflect the most recent version. We encourage you to review this policy periodically. Continued use of the Website after changes are posted constitutes your acceptance of those changes.
12. Contact Us
For any privacy-related question or request about either the Website or the NateEats app — including access, correction, deletion of your data, or a question about how the app handles your location, photos or voice recordings — please contact us at the address below. In the app you can also tap "Contact" at the bottom of Settings, which opens a pre-addressed email to the same inbox. Our support page at nateeatshawaii.com/support lists the fastest route for common requests. We aim to respond within 24 hours and will action deletion requests within 30 days.