Privacy policy

Last updated: November 2, 2026

Billy Chan operates SafeBiteTO, an iOS app for exploring Toronto restaurants and their public health inspection records, and this website. The app is intended for users in Canada. For privacy questions and requests, email contact@billycychan.com.

At a glance

Preferences, your selected browsing area and limited recent histories are saved on your device.
Restaurant searches and browsing coordinates are sent to our restaurant data service. Apple Maps handles maps and area searches.
Release builds use Google Analytics, Firebase Crashlytics and Google Mobile Ads. Information therefore does not stay entirely on your device.
AI inspection summaries are generated on your device, with no cloud fallback.
You can manage location permission and clear recent histories. Those choices do not turn off analytics, crash reporting or advertising.

Location, searches and local storage

SafeBiteTO requests location permission when you choose Use Current Location or the map’s Location button. You can choose a browsing area manually instead. With permission, the active map can show your position.

Nearby requests send your selected browsing coordinates to our data service to find restaurant records. These can be coordinates from your current location or an area chosen manually. Restaurant searches send your search text. Opening a restaurant sends its identifier to retrieve inspection details.

The app saves your appearance preference, selected browsing area and coordinates, up to five recent areas, and up to five recent restaurant searches used to open a result. After nearby results load successfully, the selected browsing area is saved and can be restored at launch without requesting a new location.

Clear recent restaurant searches in Search. Clear recent areas in the area picker opened from the home screen. Clearing either history keeps the current browsing area. Revoking location permission does not delete a previously saved area or information already received by online services. Device backups may preserve local data according to your backup settings.

Maps and restaurant services

Map displays and area searches use Apple Maps. Search here and Use Current Location in the area picker send selected coordinates to Apple Maps to obtain an area name. The map’s Location button centres the map without itself searching for restaurants or saving a browsing area. See Apple Maps and privacy.

Our restaurant gateway runs on Cloudflare and passes restaurant queries to the database service. Network providers receive IP addresses and request information to deliver and protect the service. The gateway derives a keyed identifier from your IP address for rate limiting. Its application log statements include request ID, endpoint type, status, duration and cache status; nearby and detail statements also include that derived identifier. This identifier is pseudonymous, not a guarantee of anonymity.

Search text and coordinates are sent in request URLs. They are excluded from the gateway’s custom log payload, but may be available to infrastructure services processing those requests. Do not put sensitive personal information in restaurant searches. See Cloudflare’s privacy policy.

Usage analytics

Release builds automatically enable Google Analytics to understand how discovery, inspection views and other features are used and where requests fail or take too long. Custom events describe feature interactions, screens, outcomes, result counts and timing. They exclude search text, coordinates, addresses, restaurant identifiers and AI summary text.

Google can also process app, device and installation information and approximate location derived from network information. The app disables Analytics IDFV collection, automatic screen reporting and advertising-personalization signals, and sets Analytics advertising storage, advertising user data and advertising personalization consent to denied. These settings apply to Analytics; the advertising SDK is separate.

The Analytics property currently has Google signals off and granular location/device collection on. The app does not currently provide an in-app analytics opt-out. Contact us about questions or requests concerning this collection.

Crash reports

Release builds use Google Firebase Crashlytics to send crash reports, app and device information and installation identifiers to diagnose failures. Automatic crash reporting is disabled in Debug builds. Crash reporting is separate from usage analytics.

Google also processes Firebase Service Data generated in providing and administering Firebase. The project’s Service Data setting allows Google to use that data to improve non-Firebase Google services. See Firebase privacy and security.

Advertising

SafeBiteTO integrates Google Mobile Ads for banner advertising. The SDK can process network-derived approximate location, device identifiers, advertising interactions, performance information and diagnostics for ad delivery, measurement and fraud prevention. Available identifiers and other collection depend on device permissions and SDK behavior. Ad requests and SDK initialization can communicate with Google even when an ad is not displayed.

The app’s banner ad unit currently has no active mediation groups. The app does not currently provide an in-app advertising consent or privacy-choice screen. Denying location permission or clearing search history does not disable the advertising SDK. We do not describe all advertising as non-personalized or all SDK information as anonymous.

For Google’s handling of this information and available Google account controls, see Google’s privacy policy and how Google uses information from apps and sites. Google account controls do not necessarily stop all SDK collection.

AI summaries

Inspection summaries use Apple’s on-device model when you open a summary or retry generation. There is no cloud fallback. Custom usage events can record a summary request and its outcome, but exclude summary text. AI summaries can make mistakes; consult original inspection records for official findings.

Website visits, correspondence and external links

This website has no account registration, payment form, advertising SDK or client-side analytics configured in its source. Its own scripts do not set tracking cookies or tracking browser storage. Cloudflare hosts the website and processes network request information to deliver it. Its response headers also configure browser network-error reporting to Cloudflare, which supported browsers may use to report connection failures. Visual effects use browser capabilities and accessibility preferences on your device.

If you email us, we receive your email address and the information you send, and use it to respond to your inquiry or privacy request. Avoid including sensitive information that is unnecessary for your request.

Opening an external link connects to the selected website, whose privacy practices apply to that visit.

Retention

Local histories: up to five recent areas and five recent restaurant searches are saved until cleared or replaced. The current browsing area is stored separately.
Analytics: event retention is configured to 2 months and user-data retention to 14 months. New activity resets the user-data retention period. These controls do not cover most standard reporting based on aggregated data.
Crash reports: Google states that Crashlytics retains traces and associated identifiers for 90 days before starting removal from live and backup systems. This is not an exact day-90 erasure guarantee.
Restaurant-detail cache: the reviewed gateway caches public restaurant-detail responses for one hour. Search and nearby responses bypass that application cache.
Rate-limit state: the gateway schedules hourly cleanup checks and deletes state when it has been idle for at least one minute since its last successful update. Ongoing activity can delay deletion; hourly checks are not an exact deletion-time guarantee.

Infrastructure records, advertising information and email correspondence have separate retention arrangements. We have not established a single fixed retention period covering all of these categories. Provider policies and configurations govern provider-held records; the periods above do not promise deletion of all exports, backups or copies. Contact us to ask about a particular record or request deletion.

Information goes to the hosting, database, maps, analytics, crash-reporting, advertising and email services used for the purposes described above. Providers may process information outside Canada, including in the United States, where different laws and lawful access rules can apply. Canada-only app availability does not mean all processing occurs in Canada.

We may also disclose information where required by applicable law. No system can guarantee complete security. Do not send passwords or unnecessary sensitive personal information in support messages.

Your privacy requests

Email contact@billycychan.com to ask what personal information we hold about you, request access or correction, ask about deletion or withdrawal of consent, or raise a concern. Rights and exceptions depend on applicable law. We will respond within the time required by the law that applies to your request.

We may need proportionate information to verify your request and find relevant records. A name or email alone may not identify an installation or pseudonymous gateway record. Do not send identity documents unless we explain why they are needed and provide an appropriate way to send them. Removing local histories does not delete provider-held records.

You can also raise concerns with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. A parent or guardian concerned about a child’s information can contact us using the same email address.

Policy changes

Changes will be posted on this page with an updated date. Where applicable law requires additional notice or consent before a new collection or use, those requirements still apply. This policy does not itself supply consent for every collection described above.