Privacy Policy

Last updated: October 24, 2026

1. Who we are

Dlema is an app and website (dlema.app) that helps you find where to eat and drink in Tel Aviv. Dlema is run from Israel. Privacy questions: hello@dlema.app.

The website version (app.dlema.app): the same Dlema, in your browser. Everything here about the app applies to it too, with three differences: what "stays on your phone" is stored in your browser (removed when you clear the site's data in the browser); the website does not send usage statistics or crash reports (no PostHog, no Sentry) and has no tracking cookies; and it has no map.

2. What stays only on your phone

• Location: if you allow it, the app uses your location to show how far each place is and what's closest. It is not sent to us. Smart search sends only the distance to each place (e.g. "1.2 km"), never your location. You can say no and the app still works.
• Preferences: favorites (when logged out), language, and whether you've seen the welcome screens.
• A copy of booking requests you sent, and the list of places (so the app opens fast).

All of this is removed when you delete the app.

3. What is sent to us, and why

• Account (optional): email, name, password (stored encrypted, nobody can read it) and your favorites, so they're the same on every phone. While you're logged in, the account service also keeps the IP address and device type of the login, for security. You can also log in with Apple or Google: we receive only your name and email (Apple may give a hidden "relay" address), and no password. When you delete an account made with Apple, we also cancel the connection on Apple's side.
• Booking request: name, phone, place, date, time, party size and notes. We receive it by email so we can get back to you. It is only a request, not a confirmed reservation.
• Mistake report: the place, the reason, any short text you wrote, and the date. No personal details. We receive it by email.
• Smart search: what you typed, the time, and the list of places (with your distance to each, if you allowed location) are sent to Google's Gemini to find matching places. We don't store searches.
• Counting "Book a table" taps: when you tap a booking button (Ontopo, Tabit, phone or WhatsApp), we store only which place, which button and when. Nothing about you or your phone. It helps us see which places people are interested in. Deleted after 13 months.
• "Did you go? Was it good?": after you tap a booking button, the phone remembers the place (only on the phone) and a few hours later asks if you went and if it was good. If you answer, we save only which place, yes/no and when, with nothing about you. It helps us decide which places to recommend.
• Anonymous usage statistics: to understand what works in the app, it sends events such as: opening the app, the search text (without emails or phone-like numbers) and whether smart search answered, tapping a food type or filter, viewing a place (which place and where you came from), tapping a booking button, adding/removing favorites and opening the map. They are linked only to a random number created on your phone, not to an account, and include no name, email, phone or location (the IP address is not stored). Technical info is added: phone model, operating system, app version, language, time zone and the country set in the phone's settings (the setting, not where the phone is, and not from the IP address). You can turn it off anytime: "About & credits" → "Anonymous usage data". Deleting the app deletes the random number.
• Abuse protection: to stop flooding and unwanted costs, the server counts requests per IP address (search, photos, live place info, bookings, reports). These counts are deleted after two days. For a "the place is closed" report we also keep a scrambled code made from the IP address (it can't be turned back into the address), so one person can't hide a place alone. It is deleted after 30 days.

4. Outside services

We use these services. Each gets only what it needs to work, and each has its own privacy policy:

• Supabase – server, database and accounts. Servers in Ireland (EU). Policy
• Google – smart search (Gemini; under Google's terms for the paid service, it isn't used to improve their products), place photos and live place info (Google Maps / Places), and the map on Android. Photos load on your phone directly from Google, so Google sees your IP address, and Google sign-in (if you choose it). Policy
• Apple – the map on iPhone (Apple Maps) and Sign in with Apple (if you choose it). Policy
• Brevo (France) – emails: booking requests and reports (to us), and email-confirmation and password-reset codes (to you). Policy
• Sentry (EU servers) – crash and error reports: what went wrong in the code, app version, phone model and operating system. No name, email, phone, booking details, searches or IP address. Policy
• PostHog (EU servers) – the anonymous usage statistics described above. No name, email, phone, location or IP address. Policy
• Expo – app updates. When the app checks for an update, Expo receives the app version, phone type, IP address and a random install number. No name or email. Policy
• GitHub – hosts the dlema.app and app.dlema.app websites. Like any website host, GitHub logs visitors' IP addresses for security. Policy
• Google Maps, Apple Maps, Waze, Ontopo, Tabit – only when you tap directions or a booking link. From then on you're using their service.

Some of these services may also process data outside the EU (for example in the US), under the safeguards they commit to in their terms.

5. What we don't do

No ads. We use crash reports (Sentry) to fix problems, anonymous usage statistics (PostHog, see above; you can turn them off), and an anonymous count of booking-button taps, with no personal details. We don't track you across apps and websites, and we don't sell, rent or share data with anyone for marketing.

6. How long we keep data

Data	How long
Account and favorites in the account	Until you delete the account
Login details (IP and device type)	Until you log out or the login expires
Booking requests	Deleted automatically 90 days after the booking date
Mistake reports	Deleted automatically after 6 months
Anonymous usage statistics (PostHog)	Up to 1 year
IP counts for abuse protection	Deleted after two days
Scrambled IP code for "the place is closed" reports	Deleted after 30 days
Supabase server logs	A few days
Booking-tap counts (anonymous)	13 months
"Was it good?" answers (anonymous)	13 months
Crash reports (Sentry)	Up to 30 days
Emails sent through Brevo	According to Brevo's policy

7. Deleting your account and data

In the app: home screen → account icon 👤 → Delete my account. The account and the favorites saved in it are deleted immediately and permanently.
By email: write to hello@dlema.app (from your account's email, if you have one) and we'll delete it within 30 days. You can also ask us to delete a booking request or report before the automatic deletion. See the account deletion page.

8. Your rights

Under Israel's Privacy Protection Law: you can ask to see the data we hold about you, and ask us to correct or delete data that is wrong, incomplete, unclear or out of date.

Visitors from Europe (GDPR): you also have the right to get a copy of your data, to correct or delete it, to restrict or object to its use, to receive it in a common format, and to withdraw consent at any time. We use data because it's needed for a service you asked for (account, booking, search), for legitimate interests (security, abuse protection, fixing mistakes), or with your consent (location, through your phone's permission). You can also complain to the data protection authority in your country.

For any request: hello@dlema.app. We reply within 30 days.

9. Security

The connection to our server is encrypted (HTTPS), passwords are stored encrypted, and each user can only access their own data. No service is 100% secure, but we keep as little data as possible for as short a time as possible.

10. Children

Dlema is not aimed at children under 13, and we don't knowingly collect their data. If a child opened an account, email us and we'll delete it.

11. Changes

If we change this policy, we'll update this page and the date at the top. For a significant change, we'll also let you know in the app or by email to account holders.