Privacy Policy

Effective 1 October 2026

Arbiter helps a group of friends decide where to eat. This page explains what it collects, why, who it's shared with, and how long it's kept. Arbiter is a small personal project: there are no ads, no analytics or tracking tools, and your information is never sold.

What Arbiter collects

When you use it as a guest

The name you choose, shown to people in the sessions you join.
A sign-in token kept in your browser, so the app remembers you. The server stores only a one-way hash of it, which can't be used to sign in.

When you make an account

Your email address, to sign you in and to send password-reset and confirmation links.
Your password, stored only as a salted, slow one-way hash (scrypt). Nobody, including whoever runs Arbiter, can read it.
Whether you've confirmed your email address.

Your preferences

What you choose in the form: budget, distance, vegetarian, cuisines and kinds of place you like or dislike, fast food, vegan options, nutrition goals (calories, protein, carbs) and allergies. They're saved to fill in the form next time and used to pick suggestions. Nobody else ever sees your preferences. Others in a session see only that you've submitted, never what you chose. Allergies are never used to pick places; the group only sees that someone has an allergy, never who or what.

Sessions

Your location, if you share it (your device's location or a place you type), is used only to decide where the group searches. When the group meets between everyone, nobody else in the group sees where you're coming from; they only see that you shared. It's kept with the live session on Arbiter's server (so a restart doesn't end the session) and deleted automatically 24 hours after the session's last activity. It's never saved to the database or to your history.
The session record: its code, who joined, which places were suggested (stored only as Google place IDs) and each person's likes and dislikes. This is kept so people with an account can see their past sessions. Others in the session see totals, not who liked what.
Nutrition marks ("the group says it has vegan options") are kept for the session only.

Technical information

Your IP address is used to prevent abuse (rate limits, and a daily limit on searches per network). These counts are kept in memory only. The server's request logs also record IP addresses; they're rotated and kept only for a limited time, for troubleshooting.
Your browser's local storage holds your sign-in and the code of the session you're in, so you can rejoin. Arbiter uses no cookies.

Who your information is shared with

Google Maps Platform (Places API and Geocoding API) receives the location of each search, to find nearby places, and any place you type, to find it on the map. It doesn't receive your name, email or preferences. Use of Google Maps features is subject to the Google Privacy Policy.
fatsecret (nutrition for chain restaurants) receives only chain restaurant names, never anything about you.
Hosting providers that store or carry the data on Arbiter's behalf: Google Cloud (the server), Neon (the database) and Vercel (the website). They may keep their own technical logs, such as IP addresses.
An email provider, once password-reset emails are switched on, receives your email address and the message.
Anyone else only if the law requires it.

How long it's kept

Your account, guest name and preferences: until you ask for them to be deleted.
Session records: until you ask for your data to be deleted.
Sign-in tokens: they stop working after 90 days without use, and are deleted after that.
Password-reset links (1 hour) and email-confirmation links (24 hours): deleted within a week after use or expiry.
Your location, nutrition marks and Google's place details (names, prices, hours): only for the live session, deleted automatically 24 hours after its last activity.

Your choices

You can use Arbiter as a guest, without an email address.
You don't have to share your location.
Every preference is optional; leave any of it blank.
To see, correct or delete your data, contact the project owner via Arbiter's GitHub page. There isn't yet a button to delete your account in the app, so requests are handled by hand.

Security

Connections are encrypted (HTTPS). Passwords and sign-in tokens are stored only as one-way hashes. No system is perfectly secure, but Arbiter is built to keep what it holds to a minimum.

Children

Arbiter isn't meant for children under 13 and doesn't knowingly collect their information.

Changes

If this policy changes, the new version will be posted here with a new effective date.