Hidden Gems — Privacy Policy

Last updated: September 27, 2026

Hidden Gems ("the app", "we") is a social iOS app for discovering and sharing restaurant, bar and cafe recommendations with people you follow. This policy explains what the app collects, who it is shared with, how long it is kept, and how to delete it. The hosted copy is at https://divinedavis.com/hidden-gems/privacy/.

Information we collect

Account information

• Email and password, if you sign up with email. The password is handled by our authentication provider (Supabase Auth) and stored only as a hash.
• Sign in with Apple: Apple gives us a stable account identifier, an email address (which may be an Apple private-relay address), and — the first time only — the name you allow Apple to share. We use that name to fill in your display name. You can change it at any time.
• Profile: the display name, username, bio and profile photo you choose.

Content you create

• Recommendations (posts): the place, your rating, caption, vibe tags and up to five photos or a video.
• Stories: photos or videos visible to your followers for 24 hours. After 24 hours they are hidden from others but kept in your private archive until you delete them. "View once" stories record who has viewed them.
• Direct messages: 1:1 and group chats (up to 10 people), including photos. Message text and message photos are encrypted on your device before upload, and our servers store only the encrypted data, so we cannot read them. We do store who is in each conversation, when messages were sent, reactions and mute settings. (Technical note: the scheme is not forward-secret; see the app's source for details.)
• Comments, likes, follows, saved places and collections, events you post, and events you save.
• Reports and blocks you make, so we can moderate content and hide blocked accounts.

Device permissions (each asked for only when you use the feature)

• Location (while using the app): used on your device to centre the map and show nearby places. Your last known position is cached on your device only; we do not send your location to our servers or store it in your account. Place searches are run through Apple Maps.
• Camera and Photo Library: to take or pick photos and videos for posts, stories and messages, and to save photos you download from posts. We only receive the items you choose to upload.
• Calendar (add-only): when you tap "add to calendar" on an event, the app writes that one event to your iPhone Calendar. It uses write-only access and cannot read your existing calendar.

We do not collect advertising identifiers, contacts, health data or financial information; we do not run analytics or crash-reporting SDKs; and we do not track you across other companies' apps or websites.

How we use it

Only to run the app: signing you in, showing your posts, stories and profile to other users, delivering messages, building your feed from who you follow, and moderating reported content. We do not sell or share personal information for advertising, and we do not use it to train AI models.

Who can see what

Your profile, recommendations, comments, likes and follows are public to other users of the app, and a post you share by link can be previewed by anyone with that link (via our share-preview page at divinedavis.com/hidden-gems/post/...). Stories are visible to your followers for 24 hours. Messages are visible only to the people in the conversation.

Service providers

• Supabase (database, authentication and file storage, hosted in the US) — stores your account, profile, content, encrypted messages and uploaded media. https://supabase.com/privacy
• Apple — Sign in with Apple, Apple Maps place search and map tiles, and App Store / TestFlight distribution. https://www.apple.com/legal/privacy/
• Google Places API — our server looks up opening hours, rating, price level and a cover photo for a place. We send Google only the place's name and address, never information about you. Place photos from Google may be shown in the app. https://policies.google.com/privacy
• Unsplash — a small number of older sample place photos are loaded directly from Unsplash's image CDN, which receives your IP address when the image loads. https://unsplash.com/privacy
• DigitalOcean — hosts divinedavis.com, which serves this policy and the public share-preview pages for shared posts.

We do not share personal information with anyone else, except if required by law.

Retention

We keep your account and content until you delete them or your account. Stories leave public view after 24 hours but stay in your private archive until you delete them. Deleted items are removed from the live database immediately; copies in Supabase's automatic daily backups roll off within about 7 days.

Deleting your data

• Delete individual posts, stories, comments and messages in the app.
• Delete your account in the app: Profile → Settings → Delete Account…. This immediately and permanently deletes your profile and everything attached to it (posts, stories, comments, likes, follows, saves, collections, messages, blocks and reports) and removes your sign-in credential. Photo and video files you uploaded are no longer linked to anything once the account is gone; to have those files purged from storage as well, email us and we will do it within 30 days.
• If you used Sign in with Apple you can also stop using Apple ID with the app in iOS Settings → Apple ID → Sign in with Apple.

Your rights

Wherever you live, you can ask us to access, correct, export or delete your personal information, and you can object to or restrict how we use it. We answer within 30 days and will not treat you differently for asking.

• California (CCPA/CPRA): you have the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising.
• EEA / UK (GDPR / UK GDPR): we process your data to perform our contract with you (running the app) and for our legitimate interest in keeping it safe (moderation). You may lodge a complaint with your local data-protection authority. Your data is stored in the United States.

Children

Hidden Gems is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has an account, email us and we will delete it.

Changes

We will update the date above when this policy changes, and describe material changes in the app's release notes.

Contact

Divine Davis — divinejdavis@gmail.com