Privacy, in plain words

What we keep if you sign in

We don’t keep a customer list. We don’t keep your name, your email address, or your password with your account (a name you type into a group order is kept with that order; see Group orders). For each person who signs in and subscribes, uses a gift or membership code, or starts a free trial, we keep only:

• A scrambled sign-in ID, made from your email address mixed with a secret key. We can’t read your email from it.
• The date your subscription or gift year is paid through, whether your subscription is set to renew, and whether you’ve had a paid year before (so the half-off first year goes only to accounts with no record of a paid or gift year).
• If you use a lifetime membership code: that you have a lifetime membership and when it started. Codes are kept only in scrambled form, with when each was made, used or voided and the scrambled sign-in ID of the person who used it. If you delete your data, your membership ends and that record forgets your ID.
• If you use a Visit Meridian pass code: the date your 30-day pass ends (it’s added after any paid or gift time you already have) and that your account used a Visit Meridian pass, so each account gets one. Pass codes are kept only in scrambled form, with when each was used, never who used it. If you delete your data, the pass ends and that record goes.
• If you start the free trial: when it ends (72 hours after you start it). Separately, a scrambled mark that your sign-in has used its free trial, with the month you started it and nothing else. We make the mark from your scrambled sign-in ID with a secret key; it has no name, email or account number in it. If you delete your data, the trial ends and its end time goes, but the mark stays, so the same sign-in can’t start another free trial.
• Stripe’s customer and subscription numbers for you, so the “Manage subscription” button works and we update the right subscription.
• Your gift code, stored scrambled (and locked with a secret key so we can show it to you again).
• If you use them: the places you save or favorite, and your EatUSA rating of a place (1 to 5 stars overall, 1 to 5 stars for service if you add it, and a short comment if you write one), one per place, stored under your scrambled sign-in ID with when you first rated. Only subscribers see EatUSA ratings. Other subscribers see your stars and comment as “A subscriber”, never your name, and a place’s overall and service numbers only once it has enough ratings. A new rater’s ratings start counting toward those numbers after a short wait. A log of rating changes (place, stars and time, with a scrambled review number instead of your sign-in ID) helps us spot unfair rating. If you report a review, we keep a scrambled mark so the same person can’t report it twice. These stay until you remove them or delete your data. Deleting your data removes your ratings, your comments and the scrambled review numbers in that log. If a moderator removes a comment, we keep a scrambled fingerprint of it so it can’t be posted again at that place. If you delete your own rating after others reported it, we keep a similar scrambled record so the reports aren’t wiped by posting it again. These records don’t contain your words or your name, but our server could match them to your scrambled sign-in ID, so they aren’t fully anonymous. They stay even if you delete your data.
• If you use it: the menus you save with “Save menu” (which places, in the order you saved them), stored under your scrambled sign-in ID with your saved places and favorites. Only you see them, in the Menu drawer on your account page. They stay until you remove them or delete your data.
• If you use them: your thumbs up or thumbs down on places, one per place, stored under your scrambled sign-in ID. Other subscribers see only how many thumbs up and down a place has, never who gave them. They stay until you change or clear them, or delete your data.
• If you use them: your likes on other subscribers’ comments (which comment, whose comment it is, and when), stored under your scrambled sign-in ID. Your Rep isn’t stored as a number. Our server works it out each time from a log of what earns it: likes on your comments, bug reports we confirm, and the days you rate, comment or vote (the date only, once a day). Other subscribers see a comment’s like count and its writer’s Rep next to “A subscriber”, never your name or who liked what. Because the same Rep number shows on each of your comments, someone could guess that two comments with the same number came from the same person. Only you see your own Rep in detail. The site owner sees a list of the most active subscribers by Rep under short codes, never names or emails, and alerts when one person gets many likes in a short time. These stay until you unlike, or delete your data. Deleting your data removes your Rep log, the likes you gave and the likes on your comments.
• If you use them: your “Fast enough” or “Too slow” vote on a place you picked from Back by 1:00, one per place, stored under your scrambled sign-in ID. Other subscribers see only the counts, and only once at least 3 subscribers have voted on that place. They stay until you change or clear them, or delete your data.
• If you use it: your “Is it closed?” vote on a place, one per place, with when you voted, stored under your scrambled sign-in ID. When 3 subscribers have voted, the place is hidden on the site while we check. The person who keeps our restaurant list sees each place’s vote count and the first and last dates, never who voted. It stays until you take it back or delete your data.
• If you use them: what you send us with “Submit a restaurant”, “Submit a logo”, “Submit a menu” or “Request a feature”: the words you type, a fresh copy we make of a logo or menu picture (or the PDF you send), and when you sent it, stored under a scrambled code made from your sign-in ID. Only the person who keeps our restaurant list and the site owner see them; nothing appears on the site unless it’s used to update a listing. They stay until we’ve reviewed and removed them, or you delete your data, which removes any still waiting.
• If you start an office lunch: the places you picked, a scrambled form of its code, and a scrambled form of your sign-in ID so you can only run one at a time. See “Office lunch” below.
• The “Subscriber favorites and ratings” order uses how many subscribers favorited each place (only once at least 3 have) and its EatUSA rating. It shows only the order, never who favorited or rated.
• A second scrambled form of your sign-in ID, used only to count new sign-ups (see “Counting new sign-ups” below).

Group orders

EatUSA doesn’t place, send or pay for orders. A group order is a list for the person who started it to order from the restaurant themselves.

When a subscriber starts a group order, we keep, for that order only: which restaurant, when it started, a scrambled form of the code, and a scrambled form of the starter’s sign-in ID (so only they can see and close it). For each person who adds to it: the items and amounts they picked, the name they typed and any note they added for their whole order or for a single item (like “no pickles”), when they sent it, and a scrambled form of a random key their browser keeps so they can change or remove their own order. You don’t need to sign in to join. Your internet address isn’t saved in the order; the short-term anti-abuse counters under “No tracking” use a scrambled form of it.

An order that is still open stops taking changes 4 hours after it started; it is deleted the next time anyone uses group orders after that. When the starter closes it, it is deleted as soon as their browser tells us the PDF is made, or else the next time anyone uses group orders once 15 minutes have passed. The starter can delete it at any time, and deleting your data deletes any group order you started, with every name and note in it. Someone who joined can take their own order, name and notes out with Remove my order until the order is closed. The PDF and the copied text are made on the starter’s device; we don’t keep a copy of them.

We also keep a scrambled form of every group order code ever made, with nothing else in it, so no code is given out twice.

Office lunch

A subscriber starts an office lunch; anyone with its code can join without signing in, up to 25 people. For each one we keep the places picked, a scrambled form of the code, the votes (Maybe or Not there) under a scrambled form of a random key your browser gets when you join, and when it started. We don’t ask for or keep anyone’s name. Your browser keeps the code and your key on your device so a reload keeps your place. An office lunch ends 4 hours after it starts, or sooner if the person who started it ends it, and everything about it is erased then or the next time anyone uses office lunch. So a code is never used twice, we keep a scrambled form of every code ever made; it has nothing about anyone in it.

Bug reports

Anyone who is signed in can report a bug, with or without a subscription. For each report we keep: the kind of problem, what you wrote (with any web or email addresses taken out), the page or place it’s about, your browser’s name and version as it sends them (its “user agent”), when you sent it, what we decided (confirmed, not a bug, or fixed), and your scrambled sign-in ID so you can see your reports on your account page. No files, photos or emails. We don’t email anyone about a report. Other users never see reports. A confirmed report adds to your Rep. They stay until you delete your data, which removes all of your reports.

If you sign in but never subscribe, use a gift, membership or pass code, or start a free trial, we keep no account record for you. Your sign-in lives only in a cookie on your device. The only other things we keep are a scrambled mark that your account has signed in before (see “Counting new sign-ups” below), your bug reports if you send any, your votes in an office lunch you join and what you add to a group order you join (each is deleted with the lunch or order, as described above), and the short-term anti-abuse records listed under “No tracking.”

Counting new sign-ups

To count how many new accounts sign in each day, we keep a second scrambled form of your sign-in ID, made with a key derived from our sign-in secret and used only for this count, with no date or anything else attached. The first time we see it, we add one to that day’s count of new sign-ups, and to the count of free ones if you had no membership then. If you delete your data, your mark is deleted; the day’s count stays, because it’s only a number. If you sign in again after that, you’re counted as new again.

Signing in

Right now you sign in with an email link. Google, Facebook and X sign-in aren’t switched on.

If you sign in by email, we use your address only to send the sign-in link and don’t store it. Our email service, Resend, keeps its own log of sent emails for 30 days. To limit how many links one address can get, we keep a scrambled form of it (mixed with a secret key) in a counter for about an hour.

Payments

Payments are handled on Stripe’s own checkout page. Your card number never reaches us, and we store no card details. Stripe keeps its own payment records, under Stripe’s privacy policy.

EatUSA and EatMDN are the same company. Checkout and your card statement show EatMDN, and one membership works on both sites.

No tracking

• No ads, no tracking cookies, and no outside analytics. Every page loads only from our own site.
• We keep a running count of how often each restaurant is picked or skipped. The count has nothing about you in it. Skipping (“Not there”) is for subscribers, so when a subscriber skips a place, the browser sends the sign-in cookie with it; we use it only to check the subscription, and it isn’t saved with the count.
• We also keep daily totals: how many times place pages are opened, for each place, and how many saves, favorites, thumbs up and thumbs down are added across the site. Our page counts each place once per browser tab: it remembers which places it has counted in that tab’s own storage (if your browser blocks that storage, a reload can count a place again). These totals hold only the place, the day and the number: no internet address, cookie, sign-in ID or device details. Deleting your data doesn’t change them, because nothing in them points to you.
• Your screen colors, a subscriber’s site color, a subscriber’s “Not there” choices, whether a subscriber closed the “Subscriber features” box, whether you closed the “add to your home screen” tip, your “Not again” list (places picked for you or where you tapped “Let’s eat here” in the last 7 days), a subscriber’s Back by 1:00 settings and picks, and the group orders you started or joined that are still open (each one’s code, the restaurant, when it ends and your key to change your own order, so View pending order can take you back) are saved only on your device. A group order is taken off that list when its time is up, when you remove your order, or when you next open it after it was closed or erased.
• If you use a Visit Meridian pass code: while your pass is running, opening a place’s page, picking it or saving it adds one to a count for that place and month. The counts have nothing about you in them, and any count under 5 is left out of every report. To keep one person from flooding them, we count how many you send in an hour under a scrambled form of your sign-in ID; that counter is deleted after the hour, or when you delete your data.
• If you let the site use your location, it’s used only on your device to work out distances. It isn’t sent to us.
• To stop abuse, we keep short-term counters of how often something has been tried: sending sign-in links, entering gift, membership or Visit Meridian pass codes, posting ratings and reports, liking comments, sending bug reports, saving places, counting picks and page views, starting, joining or adding to group orders, checking, closing or erasing a group order you started, starting office lunches, entering office lunch codes, office lunch votes, “Fast enough” and “Is it closed?” votes, and submissions and feature requests. They’re keyed by a scrambled, shortened internet address, a scrambled email address, your scrambled sign-in ID or the scrambled form of a group order’s code, never the real thing. The pick and page-view counters cover one minute and are overwritten every minute. The sign-in link, gift code, membership code, saving and group order counters cover one hour, the rating, report and bug report counters one day, the like counters one hour and one day, the whole-site bug report counter one hour and holds no ID, the office lunch start, code and vote counters one hour, the “Fast enough” counters one hour and one day, the “Is it closed?”, submission and feature request counters one day (after too many wrong gift, membership, pass, group order or office lunch codes, a lockout adds up to one more hour), and old ones are deleted automatically the next time that feature is used.
• If Stripe has a problem when you press Subscribe, we count the tries for that hour under your scrambled sign-in ID, so your next try starts fresh. It’s deleted after that hour, the next time anyone starts a subscription.
• When an email sign-in link is used, we keep its random ID so it can’t be used twice. The ID has nothing about you in it, and it’s deleted once the link’s 15 minutes are up, the next time anyone uses a link.
• Like most websites, our web host keeps standard server logs, which include internet addresses.

Deleting your data

Sign in, open your account, and use “Delete my data.” That removes everything we keep under your sign-in ID, including any group order or office lunch you started, and signs you out. The few anti-abuse records described above stay, and so does the scrambled free-trial mark described above if you started a free trial. What you added to someone else’s group order isn’t tied to your sign-in ID: take it out with Remove my order while that order is open, or it’s deleted with that order. Your votes in someone else’s office lunch aren’t tied to your sign-in ID either; they’re erased with that lunch.

If you still have paid time, a gift year, a Visit Meridian pass or a free trial, we ask you to confirm first. Deleting then cancels your subscription with Stripe right away, and you lose the rest of your paid or gift time, with no refund. Deleting our record doesn’t delete Stripe’s payment records.

To sign out without deleting anything, use “Sign out” on your account page.

Contact

Email us at admin@57beef.com.