Effective September 19, 2026. Last updated September 19, 2026.

Privacy

This page describes what the app actually does — it was written against the code, not against ambition. As the service grows, this policy will be updated to match what the code does then, with the effective date above moved when it changes.

What BRGR does with what you give it

BRGR is a burger journal. You can open the map and browse the burgers on it without an account; keeping a journal needs one, and signing in with your phone number is how you get it. This page lists what stays on your phone, what goes to your account, and what anyone else can see.

Stays on your phone

• Your drafts
• Your Want to Try list
• Where you are

Your location is used to sort burgers by distance and to center the map when you tap Near me, or when the map opens if you have already allowed location. It is held in memory, never saved, and never sent to BRGR. The map itself is drawn from MapTiler's tiles, so MapTiler sees which area of the map is on your screen. Analytics record only whether you were far from every burger BRGR lists — never where you are.

Goes to your account when you sign in

• Your phone number. It is sent to our verification provider so it can text you a code. The code passes through our server on its way to be checked; we never store it. We keep your number with your account, and a short record of code requests so the sign-in can't be abused. A one-way, keyed fingerprint of your number is registered so that people who have your number in their contacts can find you — only while your profile is public.
• Your account identifier, so your journal can come back on a new phone.
• Every rating you save, with its private note and the price you paid, backed up to your account and never shown to anyone; and its one-line public note and your overrated-or-underrated answer.
• Your display name, your handle and your Top 10. Your ratings, public notes, name, handle and Top 10 are shown to others only while your profile is public. One switch covers all of them.
• Who you follow.
• Reports and suggestions you send — a report with any words you add, and a missing burger's name, address and menu link — and the share and invite links you create.
• Your photographs, and any description you write for one, so a journal survives a new phone. A description is what the photo shows, in your words, for people who cannot see it; it is shown wherever the photo is shown, goes up and comes down with it, and has no switch of its own. Our server removes every metadata block — location and camera data included — before it stores the photo. While its Auto publish switch is off, a photo goes nowhere but back to you — not to other people, and not to BRGR's reviewers. A photo of yours appears on a burger's public page only if its Auto publish switch is on — one switch per photo — and the rating it belongs to is public and your profile is public with a handle, which is the name the photo is credited to. Auto publish is on by default while your profile is public and has a handle: you do not have to do anything to publish a photo, and it is yours to turn off, where you add the photo or in the burger's photo gallery afterwards. Photos you added earlier may already be published this way; each one's switch, in the burger's photo gallery, says which. Turning a switch off takes that photo down. A photo appears straight away. BRGR can take a photo down if it breaks its rules; a photo BRGR takes down stops being shown at the next read, though a copy already served can keep showing for up to five minutes. Either way it stays in your own journal. When a published photo is served, we add one to a running total kept on the photo itself, so we can choose which photo a burger's page leads with; nothing about who looked — no account, no address, no device — is kept with it, and the number is shown only in BRGR's review tool. Replace one and the old file is deleted; remove one and it is deleted; delete your account and every one of them goes, published or not — with one exception you should know before you publish. A photo you have published may appear in BRGR's own App Store screenshots, and a screenshot we have already shipped cannot be recalled on demand: we leave the photo out of the next version we submit, and until that version is live the screenshot stands. It carries no handle and no name. §4 and §8 of the Terms set the conditions, including an age limit.

Signing out removes the account from this phone, not the journal. Deleting your data is a separate, clearly labeled action.

Leaves your phone only if you connect your contacts

If you tap Connect contacts, each phone number in your address book — up to 500 — is turned into a hash on your phone, and only those hashes are sent, to find the people who already keep a public BRGR profile. This happens each time you open Find people you know. Our server mixes each hash with a secret key it holds in memory, compares the result against the numbers BRGR's own users registered when they signed in, and stores none of them; it keeps only which account asked, a keyed fingerprint of the network address the request came from, and when, so the lookup can be rate-limited. A hash like this can be traced back to a number: there are only so many possible phone numbers, so anyone holding one could work out which number it came from. What is true is that the names, emails and addresses in your address book never leave your phone, that we keep none of your contacts, and that BRGR never messages anyone or writes to your address book.

Analytics, on until you turn them off

Usage analytics, with no name, number or account attached, are on from the first launch — including on the map, which you can browse without an account. You can turn them off at any time with the Help improve BRGR switch, and collection stops at once. Without an account the switch is on the map itself, under Privacy in the map's controls, alongside a link to this page; with one it is in Me → Settings → Data, analytics and deletion, which also names every event one by one. What the events record is which screens you opened and what you tapped — never what you wrote, your photographs, or your precise location, and the full list of what is never collected is below. Nothing in the app is gated behind the switch, and deleting your data keeps your choice. The app refuses in code to send any event that is not on its list.

Our analytics provider receives a random identifier for this installation, device and operating-system details, language and time zone, the app version, and — like any server you connect to — your network address, which it is set not to store. It can still estimate your city and country from that address, and keeps that estimate with the event. We do not build a profile of you, we do not combine this with data from other companies, and we do not track you across apps.

Never collected

• Your email address
• Your precise location — BRGR never receives it
• What you type into search
• The names, emails and addresses in your address book

Who handles it for us

• Stytch — phone verification. It receives your phone number in order to text you a sign-in code.
• Cloudflare — hosting. The account service, the catalog, your synced journal and your photographs run on Cloudflare Workers, D1 and R2, which keep request logs.
• PostHog (US region) — the analytics above. The app stops sending to it the moment you turn analytics off.
• MapTiler — map tiles. It receives your network address and the area of the map on your screen.
• US Census Bureau geocoder — putting a new restaurant on the map. When you add a place BRGR doesn't have, our server sends the street address and neighborhood you typed for it, and nothing that identifies you.

How long it is kept

Every kind of data above, with how long it is kept and what ends it.

• Your journal — your ratings with their private notes and the prices you paid, your public lines and your overrated-or-underrated answers, your display name, your handle, your Top 10 and who you follow — is kept until you delete your account. A journal is meant to last: none of it ages out on its own, and nothing in it is taken away behind your back.
• Your photographs are kept until you replace one, remove one, or delete your account — each of those deletes the stored file itself, and any description you wrote for it. They have no expiry of their own. A copy already served can keep showing for up to five minutes after one comes down. One copy is outside that: a photo you published that we used in a BRGR App Store screenshot stays in the screenshot shipped with that version of the app, until we submit a version without it. It carries no handle and no name.
• Your phone number and your account identifier are kept for as long as the account exists. Deleting your account deletes the account's copy of both, and with them the keyed fingerprint that lets people find you by your number, the follows in each direction, any blocks, the record of the contact lookups you made, and the share and invite links you made — those links have no expiry, so deleting the account is what ends them. Your number also sits in plain text in the record of each code request, which is filed under the number rather than the account: deleting the account does not reach those. They go when the next code request sweeps out everything past 24 hours — not on a timer, so a record can sit for longer than that if nobody asks for a code.
• Reports and suggestions you send are kept for twelve months from the day you send one, and deleted then. Deleting your account deletes them sooner.
• Analytics are kept for twelve months by PostHog and deleted then. Turning the switch off stops new ones; the events already sent carry no name, number or account, so there is nothing in them to find you by.
• The short-lived abuse-prevention records. A record of a code request — your number, a keyed fingerprint of the network address, and when — lasts 24 hours. A record of a contact lookup — which account asked, a keyed fingerprint of the network address, and when — lasts an hour, and so does a record of a change you saved. Each is deleted the next time anyone makes a request of that kind, so none outlives its window by more than the quiet between requests. A sign-in in progress is good for ten minutes, and using the code clears it.
• What only your phone holds — your drafts and your Want to Try list — stays there until you delete it or delete the app, and there is nothing on our side to keep. Your location is never written down on your phone, and BRGR never writes it down either — apart from the city and country estimate analytics keep for twelve months, and the part of the map MapTiler is sent in order to draw it.
• What survives deleting your account: the record of a code request; the record of a change you saved — including the one the deletion itself spends. Those two are filed under your number and your account, and nothing clears them early: each goes on the sweep the next request of its kind runs, on the windows above, so either can sit for longer than its window while the service is quiet. The contact lookups go with the account rather than waiting. Then the analytics already sent, which are not tied to your account, and Cloudflare's request logs, kept on Cloudflare's schedule rather than ours. Nothing of your journal survives on our servers. One thing outside them does: if a photo you published is in a BRGR App Store screenshot we have already shipped, that screenshot stays with the released version of the app until we submit one without it, carrying no handle and no name. The community score of every burger you rated is worked out again without you.
• What other people's records keep. If somebody reported your profile, their report still names the handle they reported, and BRGR keeps what a reviewer decided as an audit trail. Deleting your account does not reach either: they are somebody else's record of their own action, not part of your journal, and they hold nothing else of yours.

Your choices

• Turn analytics off — on the map under Privacy with no account, or in Settings with one. Nothing is gated behind it.
• Keep your profile private. Nothing you rank is shown to anyone, and a private profile hides your name, handle, Top 10 and every score. A burger's community score is an average of public ratings, so while your profile is private none of your ratings count toward any burger's score or its bite count — and they are counted again whenever your profile is public.
• Export your journal as JSON.
• Delete your account and journal, on your phone and on our server. What survives it, and for how long, is listed above.

Scope, and who is responsible for it

This policy covers the BRGR app. It will be updated as the service grows. The periods above are the ones BRGR keeps to now, for everything this page describes.

BRGR is offered in the United States, and every burger it lists is in New York. The Terms are written for that one place: New York law governs them, and §16 names the courts a dispute goes to.

Who is responsible for all of it — for what is collected, for what is done with it, and for answering about any of it:

Odd Pair Ventures LLC
418 Broadway STE N
Albany, NY 12207
+1 917 624 9340
dor@urbero.com

That is the same address the Terms print in §19 and §20. Questions about anything here go to it.