1. About ShowMyDish and this policy
ShowMyDish is a restaurant and dish discovery service available through the ShowMyDish app (Android package com.showmydish.app) and website. It provides community food posts, restaurant profiles, menus, videos, reviews, meal estimates and private event memories. The application is created and developed by Webz Technologies.
In this policy, we, us and our refer to the ShowMyDish service. For privacy questions, correction requests, account or data deletion, or concerns about another person's upload, contact support@showmydish.com. This is our public privacy contact. You do not need to install the app or sign in to read this policy or email a request.
This policy covers information handled through our features. External services you choose to open have their own privacy practices. It does not turn public content into private content or replace the choices shown when you post.
2. Account, profile and business information
When you register or sign in, we process your name, email address, account identifier, sign-in provider, email-verification status, profile photo when supplied, account type and account/session timestamps. Firebase Authentication handles email/password and Google sign-in credentials. Google sign-in gives us basic account information authorised for sign-in, not your Google password, Gmail inbox or contact list.
Restaurant owners and authorised business accounts may supply restaurant/business names, addresses, contact details, menus, prices, facilities, opening hours, ownership/verification information, promotional links and media. Business profile information intended for discovery is public. Ownership evidence and support communications are restricted to authorised support or review staff.
Your profile name and photo can appear with named posts, reviews, your public contribution profile and advertisements. Your sign-in email is not displayed as part of a normal public food post. Information you put in a business contact field, photo, video, caption or review can still be public.
3. Public posts, photos, videos and interactions
We process dish names, prices, categories, food types, ratings, reviews, captions, photographs, videos and restaurant associations that you submit. We also process favourites, likes, comments, share actions, reports and moderation decisions to operate these features, display engagement and prevent misuse. A recorded share action does not give us access to the private conversation or recipient in the app you choose for sharing.
Public food photos, videos, profile pictures and advertising media are uploaded to Cloudinary for storage, conversion and delivery. Original files and delivery versions can exist. These are public-delivery assets: someone with a media link may be able to view it even before a post is approved or after the post is hidden. Removing an app record does not remove every hosted media copy; see the deletion section.
A named post can link to your public profile. An anonymous post hides the public author identity, but ShowMyDish retains an internal account association for moderation, safety and handling requests. Anonymous posting is not anonymity from the service. Keep personal details out of anonymous photos, videos and text.
Other users can view, report, screenshot, download or share public material. Avoid uploading people without permission, bills containing personal details, passwords, payment credentials or private documents. Only share material you are authorised to share.
Food Reels are separate from dish-post videos and business video advertisements. All newly submitted videos require administrator review before they appear publicly in the app. Rejection reasons appear in the account's Notifications and applicable submission list; device push depends on registration and notification permission. Pending Food Reels expire from approval eligibility after 30 days. Records and original uploads are not automatically deleted in this release.
4. Private memories and meal estimates
My Memory may contain your occasion, restaurant/place, date, number of people, final bill, notes and up to three family/friends photos. Memories are stored under your account in Firebase and are not placed in the public food feed, advertisements or Explore. Memory photos are compressed and stored with the private record; this feature does not upload them to public Cloudinary storage or send them for Gemini content checks.
Account-level access rules restrict normal app access to the account holder. Private does not mean end-to-end encrypted: authorised infrastructure and personnel with a necessary support, security or legal purpose may have administrative access. We do not describe memories as inaccessible to the service operator.
You can view and delete memories and download memory photos in My Memory. Downloaded or separately shared copies are under your control. Meal Budget provides an estimate based on selected dishes and quantities; saving a private memory is optional and separate from calculating an estimate.
My Food History stores meals only when you explicitly choose Add to My Food History. Your saved restaurant and dish details, date/time, listed price, optional actual payment, persons, meal type and personal notes remain under your personal user account. Other users and restaurant owners cannot browse this history. You can edit or delete entries. Expense totals use only recorded actual payments; searches, QR scans and restaurant visits do not automatically create entries. Authorised, audited Login as sessions operate with the selected account permissions.
5. Location, restaurant and city searches
With your permission, the app obtains device location to identify your city/PIN area and find nearby restaurants. You can instead select a city or PIN code manually. ShowMyDish does not request continuous background location tracking. Your selected city and coordinates may be stored locally and sent to our backend when a location-based feature is used.
Restaurant and city searches are processed by our backend using locally hosted directories derived from OpenStreetMap, Overture Maps and GeoNames. Using these directories does not itself send each search to those publishers. Google Maps Platform processes restaurant search text and the selected search location for Google restaurant searches, and restaurant identifiers for live details, photos, opening hours and selected Google reviews. Google data is labelled separately from ShowMyDish owner and community content. Places API does not provide a complete dish menu or guaranteed dish prices.
If you create a restaurant listing, the submitted city, address or coordinates may become part of that listing. Public restaurant locations are different from a private history of your movement. We do not deliberately publish your live device location as a personal tracking feed.
6. Camera, media, notifications and device storage
Camera access supports QR scanning and media capture. The photo/video picker gives the app files you choose; it is not used to upload your entire gallery. A selected video can contain sound already recorded in that video. Declining an optional permission can make its related feature unavailable while other features remain usable.
If you enable push notifications, Firebase Cloud Messaging supplies a device registration token. We associate the token and platform with your account to deliver messages, and use in-app notification/read records. You can disable notifications in the app or operating-system settings.
The app and website use local storage, preferences, authentication/session storage and caches to remember sign-in, selected location, settings and resources. SDKs may use installation identifiers needed for authentication or messaging. We do not request your contact book, SMS inbox or call history for food discovery.
7. Technical information and activity
Hosting, authentication and media providers receive technical information needed to serve requests, such as IP addresses, timestamps, browser/device information, network metadata and errors. Security controls may derive a rate-limit identifier from an IP address and time window. Server access and security logs are not publicly visible profile information.
We maintain account creation/sign-in and activity timestamps, content and engagement counts, support records and records of authorised administrative actions. These support operations, administrative reports, abuse prevention and troubleshooting. The current app does not integrate a separate advertising-ID tracking SDK or Firebase Analytics SDK.
8. How we use information
We use information to create and secure accounts; show restaurants, menus and dishes; publish contributions you choose to share; provide reviews, favourites and social features; calculate meal estimates; store private memories; deliver requested notifications; manage restaurant ownership and advertising; respond to support and deletion requests; and investigate abuse or comply with applicable obligations.
Optional permissions or actions enable features such as location, uploads and notifications. You can stop using an optional feature, revoke device permissions, change profile information or request deletion. Information necessary to deliver a requested feature must be processed for that feature to work.
9. Content moderation and AI processing
AI dish-image generation, promotional design, marketing, analytics, review replies and chef-assistant generation are postponed during this launch. Add Dish uses Camera and Gallery; bulk imports do not generate images. Existing historical AI-labelled media is retained with its provenance. No image-generation provider is activated or called by this release.
Existing photo/text content-safety checks are separate from image generation. Uploaded videos are held for manual administrator review before app publication. Review decisions and reasons are recorded. A manual approval is a content decision, not a guarantee of authenticity or safety.
10. Service providers and other recipients
Google/Firebase provides authentication, application data storage and push messaging. Cloudinary stores, processes and delivers selected public media. Vercel hosts the website and application API. Google Maps Platform supports applicable map details and reverse-geocoding requests. Google Gemini supports the AI features above. Information is transmitted to these providers when the related feature is used.
Authorised ShowMyDish administrators and support staff can access information necessary for their roles. Public profile, restaurant, post and advertisement information is accessible to other users. We may disclose information when reasonably needed to meet a legal obligation, respond to a valid legal request, protect users or investigate fraud/security incidents.
We do not sell your personal information. Advertisements do not give advertisers access to your private memories, sign-in credentials or private support messages. Providers and external services you choose to visit also operate under their own terms and privacy policies.
Authorised administrators may use audited, time-limited Login as sessions to assist a selected User or Restaurant Owner account using its normal account permissions. These sessions do not grant the selected account administrator privileges. Session starts, endings and privileged server operations are recorded for support and security.
11. Advertisements, payments and external links
Basic restaurant tools, Food Reels and approved launch advertising are free. No subscription, campaign charge or paid boost checkout is enabled. Verified owners can boost up to two approved dishes per restaurant at a time; boosts expire. Campaign dates/specifications and new free-boost duration can be configured by administrators. Sponsored placements are identified and do not guarantee views, reach or sales. Google AdMob remains planned and inactive.
12. Security and international processing
We use HTTPS, Firebase authentication and access rules, server-side checks for privileged operations, restricted administrative roles and protected server credentials. These safeguards reduce risk but do not make any online service completely secure. Keep your login secure and report suspected misuse promptly.
Public Cloudinary media links are deliberately deliverable to viewers; they are not private-document storage. Private memories use account-restricted application storage and are not end-to-end encrypted. Avoid placing sensitive personal information into public uploads.
Cloud infrastructure and service providers may process information in India and other countries where they operate. The main application database uses the configured Mumbai region, but authentication, media delivery, messaging, hosting, AI, logs and provider support may involve other locations. We do not promise that all processing stays within India.
13. Retention and removal
Account and feature records are generally retained while needed to provide the service or until you remove them or request deletion. Public posts and media can remain available until removed through the relevant process. There is no automatic expiry date for every public upload or support record.
Private memories remain until you delete them or they are removed through a complete account-data deletion request. Removing a memory removes the active record; it does not delete copies you downloaded or shared elsewhere.
Support, moderation, fraud-prevention, security and administrative records may need limited retention to resolve a dispute, prevent abuse or satisfy an applicable legal obligation. When handling deletion, we will explain information that must be retained and the reason. Provider logs, backups and cached delivery copies may follow provider retention/expiry processes rather than disappearing from every system immediately.
Uploaded media uses the existing public CDN. Pending/rejected videos are excluded from public app feeds and shared preview pages; a holder of a direct media URL may still retrieve the CDN upload. Duration, size, preparation and account upload throttles limit normal app use, but raw CDN deletion/private delivery require media-provider lifecycle configuration. Contact support for removal; approval expiry does not imply remote deletion.
14. Account deletion and other privacy requests
To request deletion of your ShowMyDish account and associated data, email support@showmydish.com with the subject ShowMyDish account and data deletion. Send from the registered email where possible, or identify the account and explain if you can no longer access that email. Never include your password or OTP. Our public account-deletion page provides these instructions without requiring app installation or login.
A complete request covers the account/profile, private memories and photos, saved items, notification registrations, and personal information associated with posts, reviews, contributions and uploaded media. We may verify ownership before irreversible action. We will contact you if clarification is needed or an exception applies, and confirm completion after processing. You may request removal of particular data without deleting the entire account.
The current app's self-service account deletion removes sign-in/profile information and certain personal records, but does not automatically remove every public post, hosted media asset or related record. For complete account-data and hosted-media removal, use the email request above. Uninstalling, signing out, hiding a post or leaving a Play test does not submit a complete account-deletion request.
An independently sourced public restaurant listing can remain after an owner account is removed, with the ownership relationship removed. Copies independently made by other people and data another service controls are outside our direct deletion controls. Contact us about personal details in such material so we can assess what we can remove.
You can request access to or correction of your information, raise a privacy complaint or withdraw an optional permission. We assess requests according to applicable requirements and may ask for proportionate verification. No fee is required to send a privacy or deletion request to our contact address.
15. Children and other people's information
ShowMyDish is not designed as a children's service. Its account, business-management and public AI-checked posting features are intended for adults. Family dining information does not mean children should create accounts or submit personal information. A family member's photo in a private memory must be uploaded only with appropriate permission.
If you believe a child has supplied personal information, or that your image or personal information was uploaded without permission, contact support@showmydish.com with enough information to locate the material. We will assess the report and take appropriate removal or access-restriction steps. Do not email sensitive documents unless specifically requested through an appropriate verification process.
16. Policy updates and contact
We update this policy when features, providers or data practices change. The effective and updated dates appear at the top. Significant changes affecting your choices will be communicated through an appropriate in-app or website notice, and additional consent will be sought where required.
Privacy and account-data contact: support@showmydish.com. Use a clear subject such as ShowMyDish privacy question, ShowMyDish correction request or ShowMyDish account and data deletion. Include only information necessary to understand and verify the request.
Camera, generated images and owner verification
Camera access is requested when you choose Take Photo. You can preview, retake, use or cancel a photo. Selecting or capturing a photo does not create a public dish post; media is uploaded when you confirm the relevant upload action or submit its form. Newly uploaded photos may be resized and compressed. Existing uploaded media is not rewritten by these changes.
Generate with AI sends the dish name to the configured image provider and stores the resulting illustrative image with AI provenance. It is labelled AI Generated Image and must not be represented as the restaurant exterior, facilities or a real customer photograph. Generation is optional and limited per account; Camera and Gallery remain available.
Owner contact verification may use Firebase mobile/email verification, a requested email OTP or administrator review. When email OTP is configured, our email delivery service receives your account email and the requested code. Challenges are restricted to your account, expire after ten minutes and allow limited attempts. Codes are not published or exposed to other users. Administrator approval is recorded separately and does not transfer an existing restaurant from another owner without review.
Security controls may use account identifiers and hashed request subjects to limit repeated signup, password-reset, verification and generation requests. Native app push uses the app device token. Legacy or unrecognised browser subscriptions are excluded from new push deliveries; supported website notifications use the official ShowMyDish domain. Notification permission and your device opt-out are respected.
Tasks, visit plans and private digital receipts
Restaurant owners publish food-related tasks with rules, eligibility, deadlines and restaurant-funded rewards. Accepting a task records your participation and agreement separately from any planned visit. Completion proof is accessible to the restaurant owner and authorised administrators for review. Do not include unnecessary sensitive financial details in proof text or public food media.
An optional shared visit plan has one organizer and a total expected group size. Friends join by invitation without increasing that total automatically. Restaurant managers receive your plan and attendance estimate only when the organizer enables consent. Plans can be changed or cancelled; these estimates are not reservations or confirmed bookings. Sharing an invitation reveals the selected plan invitation to your chosen recipients.
Owners may create ordinary digital receipts and link them using a customer account ID. The customer can confirm or dispute a linked receipt. Individual bill records and downloadable PDFs are restricted to the linked customer, that restaurant owner and authorised administrative support. They are never published in restaurant menus, public task previews or public food feeds. Sharing or downloading a PDF exports the selected private receipt to the device or service you choose.
These digital receipts are not GST tax invoices or a full billing/POS system. An owner-created bill is not automatic proof of a genuine visit. Only the current customer-confirmed revision, matching restaurant and published date, acceptance, amount and visit conditions, contributes to a challenge. Corrections reset confirmation; disputed, void and unlinked bills do not earn rewards. Repeat visits are counted once per restaurant-local calendar day. Additional proof may require owner approval.
Bill identifiers, restaurant bill-number uniqueness, correction/confirmation/dispute records and reward-redemption audit records are retained to prevent duplicates and support disputes. Corrections recompute progress and can flag a previously redeemed reward for review; they never permit a second automatic redemption. Private digital receipts are separate from manually saved Food History entries, so users should avoid recording the same expense twice. Contact support@showmydish.com for receipt-linking, correction, access or deletion support.
Provider privacy resources
Need help with your data?
Read the deletion process or contact us directly. This page and the instructions are available without login.