Privacy policy.

What the app handles

• Your account: your name, email address, account identifier, optional profile picture, sign-in credentials and session information. Supabase provides authentication and password-recovery services.
• Your dining records: restaurants you save, cuisine likes and dislikes, group memberships and invitations, shortlists, decision rounds and votes, visit dates, spending you enter, dishes, ratings, notes and photos you choose to upload.
• Search information: a restaurant or area you type, a map area you choose, or your foreground location when you choose a location-based feature and allow permission.
• Service and support information: request counts associated with your account, technical request and error information, and messages or screenshots you send us. Hosting and distribution services may process IP addresses, device or browser information and timestamps.

We use this information to run the app, keep the correct account and group in sync, support your requests, protect access, investigate problems and manage the pilot's usage limits. The pilot has no ads, advertising trackers or purchases.

Who can see your memories

Personal-workspace restaurants and visits are restricted to your account. Records saved in a group are shared with that group's authorized members. Your personal cuisine preferences stay with your account; switching groups does not copy another group's visits, spending or notes into the new group.

Group members can see identifying profile information, including names, email addresses and any profile picture. Decision participants can see progress and the result. Own-phone voting does not reveal another participant's individual ballot. In pass-phone mode, the organizing phone records the named participants' choices, so its user can access those entries.

Restaurant covers, visit photos and dish photos you upload use private storage and the account or group access of the related record. Leaving a group removes your access to its shared records, but does not itself delete those records for the people who remain. Authorized service administration also supports maintenance and troubleshooting.

Profile pictures are different: the current pilot serves them through publicly accessible image links. Anyone who has a profile-picture link may view that image. Choose a picture you are comfortable sharing this way, or leave it unset.

Only upload photos and information you have permission to share. Group members may save or share information they can see outside the app; OffCourse cannot control those copies. There is no public discovery feed or public list-sharing feature in this pilot.

Personalized dinner guidance

Dinner guidance uses the selected workspace's saved places and visits, your confirmed cuisine tastes when enabled, linked gift-card reminders and the dinner filters you review. Other groups' private memories are not copied into this workspace. Real provider search results can be filtered and ordered using these choices.

Optional spoken requests are limited to one minute each. Send request sends that recording through Supabase to OpenAI for transcription and interpretation. Each turn is processed separately; we do not send a conversation history, restaurant collection, gift-card amounts or other people's preferences to the language model. Review the interpreted changes before applying them. Location access and nearby searches require their own actions. Dinner requests use the same temporary audio, result and usage-ledger retention described below.

Listen uses your device's system text-to-speech service to read the displayed suggestions. OffCourse does not call a separate paid speech-generation API. Voice availability and processing depend on your device and installed speech engine. Speech stops when you leave the screen or app, change workspace, or begin a recording. Text controls remain available without speech.

Optional voice recaps

When enabled for your pilot account, you can record a visit recap of up to two minutes. Microphone permission is optional, and recording starts only when you choose it. Leaving the app stops recording. You can keep entering visits manually without using voice.

Stopping a recording does not send it for AI processing. If you choose Create draft, our Supabase service sends the recording to OpenAI for transcription, then sends the transcript and limited context, such as the date you recorded it, to OpenAI to suggest visit details. If you start a visit from voice before choosing a restaurant, this also extracts restaurant name and location clues stated in the recording. You confirm the restaurant; OffCourse does not automatically assign a branch from your current location. We do not send your other visits, group ballots or full dining history for this feature. Review and correct the suggestions before applying them to your draft and saving the visit.

Pending recordings and recap results are kept in the app's private device storage, separated by account and workspace. They expire after 24 hours and are cleared when the app next checks them. Applying or discarding a recap, or signing out, also starts local cleanup. OffCourse does not keep uploaded audio in server file storage. A private server cache retains the transcript and suggestions for up to 30 minutes so an interrupted request can retrieve its result; expired results are scheduled for removal every five minutes. Minimal request identifiers, hashes and usage reservations remain to enforce limits and prevent duplicate processing.

OpenAI processes API content on our behalf and does not use it to train models by default. Its audio-transcription endpoint currently lists no retained application state or abuse-monitoring logs. Text processing has different retention: standard abuse-monitoring logs can retain content for up to 30 days, subject to stated exceptions. We disable stored Responses API results, but this does not eliminate provider abuse-monitoring or applicable temporary caching. See OpenAI's API data controls and retention details.

Once you apply and save a recap, its transcript becomes part of your visit notes and follows the personal or group access of that visit. Record your own summary, with permission for any other person's information you include. Do not use this feature to secretly record conversations. You can revoke microphone permission in your phone's settings.

Optional receipt capture

When enabled for your pilot account, you can take or choose one receipt photo. Camera access is optional. Selecting a photo does not send it for AI processing. If you choose Create receipt draft, OffCourse sends a resized copy through its Supabase service to OpenAI to suggest receipt details. We do not send your other visits, group ballots or full dining history for this feature. Avoid including unnecessary personal or payment details in the photo.

Review and correct the suggested date, server, amounts and items before applying them and saving your visit. We ask the model to omit payment and customer identifiers. Suggestions may be incorrect or incomplete; this is not an accounting record or payment service.

Pending receipt copies and suggestions are kept in private app storage, separated by account and group. They expire after 24 hours and are cleared when the app next checks them. Applying, discarding or signing out also starts cleanup. Your original photo-library image is unchanged. The first version does not permanently attach the receipt image to the saved visit. OffCourse does not write uploaded receipt images to server file storage. A private server cache makes suggested details available for up to 30 minutes to recover interrupted requests; expired results are scheduled for removal every five minutes. Minimal identifiers, image hashes and usage reservations remain to enforce limits and prevent duplicate processing.

OpenAI does not use API content for model training by default. We disable stored Responses results, but standard abuse-monitoring logs can retain content for up to 30 days, with stated exceptions; temporary prompt caching and image safety-review retention may also apply. See OpenAI's API data controls.

Once you apply and save the suggested details, they follow the personal or group access of that visit. Only include information you have permission to share. You can use manual visit entry without receipt processing.

Gift-card reminders

You can remember a merchant, an optional nickname and USD balance, whether a card is used, and the saved restaurants you link to it. OffCourse stores these details in Supabase with the creator, last editor and update times. Personal cards are private to your account. Current group members can view and edit group cards; the creator or current group owner can delete them. Leaving a group removes your access but does not itself remove its shared cards.

Gift-card details help display reminders and filter saved restaurant choices in that workspace. They are not sent to Google, OpenAI or a card issuer. This feature does not collect card numbers, PINs or card images, check issuer balances, or redeem cards. Please do not put payment credentials in the merchant or nickname fields.

Before a save or delete request, the app keeps a copy of that pending change on your device, separated by account and workspace. This allows you to retry the same request after an interruption. Pending changes are retained until the result is resolved and local cleanup succeeds; signing out does not discard an unresolved request. There is no automatic background retry. The server keeps prior successful change details to recover retries while the card exists. Deleting the card removes its merchant and balance details from this retry history, while minimal request and card identifiers remain to prevent accidental recreation. Service backups and logs follow the retention described below.

Location, restaurant search and Google

When enabled for your pilot account, Google Maps Platform provides maps, restaurant search, current place details and default restaurant photos. A nearby search sends the chosen coordinates and search area through our server to Google. Typed searches send what you enter, including an area or restaurant name. Detail and photo requests send the relevant Google place or photo identifier.

Location permission is optional. You can type an area instead. OffCourse requests location while you use a location feature; it does not request background location or build a continuous location history. You can change permission in your phone's settings.

The map and provider images also connect your device to Google. Google can receive technical information such as your IP address, device information and the content requested. We do not add your OffCourse account email, private notes, group ballots or cuisine preferences to Google search or photo requests.

Google place facts and photos are loaded for temporary display and may expire or become unavailable. We keep saved place identifiers and your own dining records separately. Google photos are not added to your private uploaded-photo collection. Your own cover photo can replace the default shown in OffCourse without changing Google's listing.

The Google Privacy Policy applies to Google's processing and is incorporated here for Google-powered features. See also the Google Maps Additional Terms. Google Maps and contributor credits identify provider content in the app; they do not mean that Google can read your private dining notes.

Services that help run the pilot

Supabase hosts authentication, the app database and uploaded files on our behalf. See Supabase's privacy notice and data-processing terms. Vercel hosts this website and may process website request information for delivery and security; see Vercel's privacy notice.

Apple TestFlight distributes the iPhone pilot and processes installation, diagnostic and feedback information under TestFlight & Privacy. Feedback you choose to send through TestFlight can be made available to us.

Service providers may process information in the United States and other places where they operate. We may also disclose information when needed to comply with applicable law, respond to lawful requests, or protect people and the service.

On your device and this website

The app keeps sign-in state, settings and some drafts or pending actions on your device so you can resume work. Images you choose or capture may also remain in your device's photo library. Camera or photo access is requested when needed for the action you choose.

This website stores your Light, Dark or System appearance choice in browser storage. It has no account-signup or payment form and loads no advertising or analytics scripts. The password-reset page helps you open the installed app; it is not a website account-management area.

Your choices and removal requests

You can change your profile and cuisine choices, edit records where the app permits, remove an uploaded cover, leave groups and change phone permissions. To request access to, correction of or deletion of account information, contact matt@mattzimmerman.io. We may need to verify account ownership and discuss how a request affects shared group records.

Signing out or deleting the app from your phone does not delete hosted records. A decision round or discovery allowance ending does not automatically erase your dining history. Removing or resetting a cover stops its use as that restaurant's cover; it does not promise immediate erasure of every underlying file or backup.

Account deletion does not establish that all uploaded files, shared information, backups and technical logs have been removed. Contact us for help with a complete removal request. Retention depends on the information, its use in shared records, service-provider backup and log handling, and applicable legal requirements. We do not promise a fixed deletion or support turnaround during the pilot.

Pilot scope and changes

This pilot is intended for invited adults in the United States. It includes manual gift-card reminders. Optional AI voice recaps and receipt drafts may be enabled for selected accounts within limited allowances. Personalized dinner guidance filters real saved or searched places. Public discovery lists are not included. Contact us if a child has supplied personal information or if you believe information was shared without permission.

We will update this page as the pilot's data practices change. The date above identifies this version. Review the pilot terms for use of the service and support page for help.