LunchClub ("we", "us", or "our") is operated by Madaket Labs. This Privacy Policy explains how we collect, use, and protect your information when you use the LunchClub iOS app ("the App") or visit mdkt.dev/lunchclub.
By using LunchClub you agree to the terms of this policy. If you do not agree, please do not use the App.
1. Information we collect
Information you provide directly:
- Account details: username, email address, and password (stored as a secure hash)
- Profile information: profile photo and bio
- Posts: photos, captions, and location tags you create in the App
- Social interactions: comments, votes, and friend connections
- Contact form submissions on this website
Information collected automatically:
- Device information: device type, operating system version, and app version
- Push notification token (only when you grant permission, used to send notifications)
- Basic usage logs for debugging and error reporting (no third-party analytics)
Location information:
- When you tag a restaurant or location on a post, we store the place name and coordinates you selected
- We do not track your GPS location in the background or without your explicit action
- We do not use location for advertising
2. How we use your information
- To provide and operate the LunchClub service
- To display your posts, profile, and activity to your friends
- To send you push notifications about friend requests, votes, and comments (only with your permission)
- To send transactional emails (password reset, account notices) via SendGrid
- To respond to support and contact form requests
- To detect and prevent abuse, spam, and security issues
We do not sell your data. We do not use your data for targeted advertising.
3. Sharing of information
We do not sell, rent, or share your personal information with third parties for their own marketing purposes. We share information only in these limited cases:
- Other users: Your posts, profile photo, and username are visible to your friends (or publicly, if your account is public)
- Service providers: We use Google Firebase (database, authentication, push notifications) and SendGrid (transactional email). These providers process data on our behalf and are bound by data processing agreements
- Legal requirements: We may disclose information if required by law, court order, or to protect the safety of users
4. Data storage and security
Your data is stored securely on Google Firebase (Firestore) hosted in Google's cloud infrastructure. We use industry-standard security measures including encrypted connections (TLS), server-side token authentication, and access controls that prevent any client from reading another user's private data.
Passwords are hashed using bcrypt and are never stored or transmitted in plain text.
5. Data retention
We retain your account data for as long as your account is active. If you delete your account, your personal information (name, email, profile photo, bio, and posts) is permanently removed from our systems within 30 days. Some residual data may remain in encrypted backups for up to 90 days before being purged.
6. Your rights
You have the right to:
- Access: Request a copy of the data we hold about you
- Correction: Update your profile at any time in the App
- Deletion: Delete your account in Settings → Delete Account, or email us at hello@mdkt.dev
- Portability: Request an export of your data by emailing us
- Objection: Object to how we use your data by contacting us
If you are located in the European Economic Area (EEA), UK, or Australia, you may have additional rights under GDPR or applicable local law. Contact us to exercise any of these rights.
7. Children's privacy
LunchClub is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover we have collected information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.
8. Third-party services
The App uses the following third-party services:
- Google Firebase — database, authentication, cloud messaging (Privacy Policy)
- Google Places API — location search when tagging a post (Privacy Policy)
- SendGrid — transactional email (Privacy Policy)
- Apple Sign In / Google Sign In — optional third-party authentication
9. Push notifications
We send push notifications to tell you about new friend requests, votes on your posts, comments, and replies. You can disable push notifications at any time in your device's Settings app. Notification permissions are requested at first launch and are never required to use the App.
10. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and notify you via the App. Continued use of LunchClub after the effective date of changes constitutes acceptance of the updated policy.
11. Contact us
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
- Email: hello@mdkt.dev
- Website: mdkt.dev/lunchclub
- Operator: Madaket Labs, Australia