smaqa

Privacy Policy

Senast uppdaterad: October 3, 2026

This policy describes how personal data is processed in Smaqa. It describes how the service currently works and will be updated as things change.

1. Data Controller and Contact

Data controller: Smaqa (operated by a private individual), Sweden. Privacy inquiries and general support: smaqa.app@gmail.com.

2. Data We Process and Why

  • Account (if you create one): email, user ID, optional display name, login credentials (passwords are stored encrypted, or login via Google). Purpose: providing your account. Legal basis: contract.
  • Discovery: selected location, search radius, activity, filters, liked/passed and saved restaurants. Purpose: showing and saving restaurants. Legal basis: contract. Stored on your device and, if logged in, in your account.
  • Ad frequency: number of swipes since the last ad. Purpose: showing an ad every fifth swipe. Legal basis: legitimate interest.
  • Lists: list names, descriptions, restaurants, personal tips/notes, members, and display names. Legal basis: contract.
  • Group searches: name, display name, search location, swipes, and votes within the group. Visible to other members with the link. Legal basis: contract.
  • Advertisers: campaign details, uploaded images, and payment status. Legal basis: contract.
  • Statistics: aggregated views and clicks per restaurant and ad without connecting them to your identity. The ad provider (Google) processes its own data according to its own privacy policy. Legal basis: legitimate interest (operating and financing the service).
  • Reports: if you report an issue or content, the report and possibly your user ID are saved.

3. Location Data

You can always search for a location manually. "Near me" only requests location access when you tap it. Coordinates are used to find restaurants and are saved as your selected location (on your device and, if logged in, in your settings). We do not track your location in the background.

4. AI

Smaqa currently sends no personal data to AI services. "Great match for you" suggestions are calculated directly in the app based on your swipes. Restaurant details are retrieved from Google and are never fabricated.

5. Ads

Ads are labeled "Ad". They are selected based on the location and activity you are currently searching for — not based on an individual profile about you, and no sensitive data is used. Advertisers only receive aggregated statistics.

6. Cookies and Local Storage

We only use essential local storage (localStorage) for login, settings, and core features. No analytics or marketing cookies are used today. Review and update your preferences under Cookie Settings.

7. Third-Party Service Providers (Data Processors)

  • Lovable Cloud – hosting, database, authentication, and login emails. Lovable acts as a data processor governed by their service agreements.
  • Google Places – restaurant data and place search are fetched via our server, not directly from your browser. Google may transfer data to the US (EU–US Data Privacy Framework).
  • OpenStreetMap / Leaflet – map tiles are rendered using open map data from OpenStreetMap. Your browser contacts OpenStreetMap directly, and your IP address may appear in their logs.
  • Google – only if you choose to "Log in with Google".

We do not sell personal data and do not share it with advertisers.

8. Retention Period

  • Account data: kept until you delete your account.
  • Ad frequency counter: reset daily; previous days are not stored.
  • Backups: deleted data is cleared from backups as backup cycles rotate out.

9. Your Rights

You have the right to access, rectify, erase, restrict, object to processing, data portability, and withdraw consent. When logged in, you can download your data, update your name, and delete your account under Profile → Privacy. Otherwise, contact smaqa.app@gmail.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

10. Deleting Your Account

Profile → Delete Account, or visit /delete-account. Your account, saved places, lists you own, notes, settings, and group memberships will be deleted; your name in group searches will be replaced with "Deleted user".

11. Security

Encrypted connections (HTTPS), database access policies ensuring users can only access their own data, server-side authorization checks for admin operations, and secret API keys that are never exposed to the browser.

12. Age Limits

The app can be used without an account. If you create an account and are under 13 years old, you must have parental or guardian consent.

13. Changes

For significant changes, we will update the date above and post a notice in the app.