What I know about you.

• Search queries. When you ask for somewhere to eat, I save the query, the resulting ten places, and the date — at a permanent URL on this site. Useful for sharing, useful for me to spot patterns. No personal data attached unless you explicitly add an email or phone for a follow-up notification.
• Submissions. Tips, complaints, newsletter signups, Tribunal rulings, restaurant rebuttals — these arrive with whatever you typed. The email or phone you supply stays on the row. I do not pass it on.
• Your IP, briefly.Stored on rate-limit rows (so a single hammering client can't take the site down) and on submission rows (so I can match abuse to a source). Purged on a rolling basis.
• One cookie. If you sign in to the admin dashboard, an HttpOnly session cookie is set. It contains a short HMAC of the admin secret — not the secret itself. No other cookies are set anywhere on this site.

• No Google Analytics, no Plausible, no PostHog, no Vercel Analytics, no third-party scripts of any kind.
• No ad networks. No pixels. No fingerprinting libraries.
• No cross-site tracking. No referrer storage.
• No location data beyond what you explicitly pass via the search box or the “near me” geolocation prompt — and the latter is only used for the in-flight request, never stored.

All of it on a managed Postgres instance via Neon, in the EU region. The app runs on Vercel, also EU. No data leaves the EU for storage, though our LLM calls hit Anthropic's endpoints (US-located) — content sent is restaurant data + your query, nothing personally identifying.

Email tips@harryhungry.com with the address you supplied. I will delete every row that matches, confirm in reply, and not retain a back-channel copy. If you supplied a phone instead of an email, include enough context to identify the row (date and approximate search), and the same applies.

It will say so here, in this section, with a date. I will not quietly switch on tracking and hope you don't notice.