Privacy and analytics
You can use Eatcrush whether you allow optional analytics or choose No thanks. Scrolling or closing the notice never gives consent. Reopen Privacy choices in the footer at any time. Choices expire after 180 days.
Without permission
We count page views, settled searches and their redacted words, results, filter and allergen chips, clicks, scroll depth, Plan and Compare use, sign-in completions, city votes and page performance. A random tab-session identifier joins activity during that tab session. We do not store IP addresses or a persistent visitor identifier, and do not load third-party analytics or session replay. We classify device, browser and operating system, screen size, referring host, source, medium and campaign tags, and country supplied by Cloudflare. We do not store region, city, timezone, referrer paths, or other campaign tags without permission. Search words and campaign tags have emails and phone numbers removed; please do not include personal or sensitive details.
With your permission
We also use a random visitor identifier to understand repeat visits, store your full and truncated IP address, and record masked session replay using rrweb. Full IP addresses are cleared after 30 days by a scheduled task; truncated IPv4 /24 or IPv6 /48 prefixes are cleared after 13 months. Masked replay is deleted after 30 days. Events, sessions and visitors are deleted after 25 months (events from collection; sessions and visitors from last activity). With consent we may also store Cloudflare region, city and timezone and campaign term/content tags. Input values and text are masked in replay; account and group-person areas are blocked. Replay still shows page structure and interactions. Optional Google Analytics 4 and Meta Pixel load only if configured and you allow them. These services may process data overseas under their own policies.
Shares, invites and ideas
When you share a page or send an invite, we count the share and how it was sent (share sheet, copy, WhatsApp, text or email), never who received it. Shared and invite links carry a short random code (ref); a visit or sign-up that arrives with it is counted against that code. Signed in, your code is a one-way hash of your account, not your email or account number. For links to other sites we count the site and page you opened. On the Ideas page your idea and its details are public. An email you add there is only for replying to you and is never shown; votes use a random identifier kept in your browser and a salted hash of your connection, never your IP address itself.
Talk to our agent
On a restaurant page you can talk to (or type to) our table-request agent. While you talk, your voice (or what you type) goes to OpenAI, which runs the agent; we do not record or keep the audio or a transcript. We keep the request: the restaurant, party size, date, time, your name and any needs you tell the agent. We do not ask for your email unless we email you the request's link; then we keep the email you type and use it only for that. We delete your name, email, needs and notes after 30 days. To limit how often the agent runs we keep a salted hash of your connection, never your IP address itself.
Your browser and your choices
Do Not Track and Global Privacy Control stop all analytics events and remove the Allow option. Only the pre-existing anonymous, redacted search log continues. Turning optional analytics off stops recording, removes the visitor identifier and deletes accessible Google Analytics, Google advertising and Meta analytics cookies (_ga*, _gid, _gcl*, _fbp); previously collected data is not automatically erased. Your next activity uses a new session identifier. A privacy preference is stored on your device to remember your choice.
Access, correction and deletion
Analytics is for improving search coverage, reliability and usability. Access is restricted to authorised administrators. To request access, correction or deletion, or raise a privacy concern, contact the Eatcrush site operator. Include an approximate visit date and the session identifier if available; never send passwords or account tokens. Account and group information follow the separate account controls.