Privacy Policy

• Account: your phone number or Sign in with Apple identifier, plus the name and profile photo you choose.
• Signing up: the friend’s code you enter or the friend’s link you tap at “Who brought you?”, used to record who brought you and to make you friends. It’s optional. Whether you came from a friend’s link, a code or on your own is sent to our analytics service (PostHog) so we can see how people find Zuii. If you came in through a group link, you become friends with the person who started the group. If you came in through a follow link, you only follow that person’s list and don’t become friends. Either way, we record whose link brought you in.
• Logs: the spots you log, your reaction (Coming back / It’s fine / Never again), Face-off results, one-liners, what you ate, spend, who you were with, photos (up to 6 per log; if you use AI tidy-up, we keep both the original and the tidied version) and when you logged.
• Saved: the spots you save, and which friend you saw each one from (only you can see where it came from). If you later go and rank it S, the friend who put you onto it gets a “they went” notification (they can turn that kind of notification off on its own in Settings).
• My Four S: the four spots you pin from your own S-tier logs, and when you pinned them.
• Location: only while you’re using the app, never in the background. Used to find spots near you when you log a photo and to tell whether you’re actually there (for a photo from your library, where that photo was taken); for Nearby must-eats; for Within 1 km (spots near you that you or your friends put in S or A, plus your saved spots); for how far away spots are on Picks cards (only if you’ve already allowed location, and it never asks here; we only use the last location your phone already has, rounded to about 100 m before it’s sent); for Nearby in Explore, which besides spots you, your friends and other people put in S also lists well-reviewed spots near you on Google (only after you’ve allowed location and tap Nearby); your phone sends your location rounded to about 100 m to our server, we use the center of the grid square you’re in (about 500 m across) to look up nearby spots on Google Places, and the spots found are kept in Zuii for up to 30 days and shared with people in the same area, without recording who looked; when you don’t have many friends yet and Worth saving runs short, it also adds these stored spots near you; to list spots near you when you sign up; and to keep spot search results near you. When we look for nearby spots for a log or you search for a spot, the location (and, for a search, what you typed) is sent to Google Places to find spots. We don’t store your coordinates; a log only keeps whether you were there. Before a photo is uploaded, your phone removes location, camera and time data stored in the file.
• Where faces, people and text are in your photos: found only when needed (you share a log beyond your friends, open a share image, or tap AI tidy-up), so we can blur or protect them. We store boxes only. We don’t identify anyone or create facial templates. At those moments your phone also uses Apple’s built-in tools to find faces on the device and sends the boxes along as a hint. Photo looks (Original, Natural, Bistro, Moody, Bright) are adjusted on your phone, not by AI.
• Photo library: onboarding import filters your photos by location and time on your phone and uploads only small thumbnails and where they were taken to identify spots (the location goes to Google Places to find nearby spots), then discards them. Photos you pick from your library while logging are saved with your log, just like camera photos.
• Just ate? (only if you’ve already let Zuii access your photos; it never asks here): when you come back to Zuii’s Home screen, your phone looks through photos taken in the last 12 hours and since your last log (imports don’t count), skipping videos and screenshots, for ones that have a location. Your phone sends only where those photos were taken (the coordinates) to our server, which passes them to Google Places to find the nearest spot, so Home can show a “Just ate here? Rank it” card. The photos aren’t uploaded, we don’t store the coordinates, and no AI is involved. Which photos were checked and which spot was found are kept only on your phone. A photo is uploaded only if you tap the card and log it, the same as any photo you pick from your library. Tap × and that photo and any earlier ones won’t show again.
• Pasting spot names (only if you use it): the text you paste is sent to our server, split into one spot per line (numbers, links, symbols and trailing comments removed) and looked up on Google Places; spots we already have on file are matched from our own data. No AI is involved. Once you confirm, what’s saved is those spots and the reactions you picked, the same as other imported logs. We don’t keep the text you pasted.
• Groups (only if you start or join one): the group name, who started it, who’s in it, when each person joined, and whether it’s been closed.
• Phone tilt: the camera uses your phone’s tilt to help you shoot straight (top-down, 45°). Read only while the camera is open. The angle itself isn’t uploaded; we only report whether the phone was level at that moment.
• Contacts (only if you turn it on): numbers are hashed on your phone before upload and used only to find friends who also turned it on. We never store the raw numbers.
• Phone number (optional, if you sign in with Apple): if you add your number on the Add friends page and confirm it with a text code, it’s stored with your account the same way as for people who sign in with their phone, and you can use it to sign in too. We also keep a hash of it so friends who have you in their contacts can find you. Skipping it doesn’t limit anything.
• Notifications (only if you allow them): your phone’s push token, used to send things like friend requests, a friend’s new S-tier spot, comments, a friend calling you out to argue, a friend going where you recommended, and a fix for something you reported through Roast Zuii. Notifications can include friends’ names, spot names, tiers, comments or a short summary we write. We also use it for Zuii’s own notices about new features, events and partner offers, which you get only if you turn them on in the app and can turn off anytime in Settings. Zuii news (new features and events) shows in the app’s notification list and on Home for everyone, without a push. To get it as a push, turn on “News and events from Zuii” in Settings → Privacy (off unless you do): at most one a week, never between 10 pm and 8 am, and you can turn it off anytime. When a friend has just logged a spot you’ve also ranked and you’re two or more tiers apart, you get a hard-disagree notification (between friends only; it includes your friend’s name, the spot and both your tiers; imported, backfilled and Only me logs don’t count). You’re also notified when someone joins through your group link.
• Notification permission status: whether you’ve allowed or declined Zuii’s notifications on your phone, or haven’t been asked yet. We use it to decide when to explain why and ask you to turn them on.
• Roast Zuii (only if you send one): the text you write, the screenshot you attach, plus the app version and build number, iOS version, phone model, the app’s language and which screen you opened it from (Settings, Me or a notification), added automatically. The screen lists these before you send. Only the Zuii team sees them, to fix problems and improve Zuii.
• Taste quiz results, your four taste axes, Daily Duel votes and comments, and who follows whose list.
• Usage data (PostHog) and crash reports (Sentry), used to improve the product. Never sold, never used for ads. In the app, both are linked to your account ID (not your phone number or name) and include your phone model, iOS and app versions, language and time zone; PostHog also uses an anonymous ID created for each install, and works out a rough city from your IP address. Our website’s analytics stores an anonymous visitor ID in your browser (a cookie and the browser’s local storage) to tell repeat visits apart. On our website, the addresses sent to analytics have share codes, invite codes, crew links, group codes and mini-game answers masked first, and page titles aren’t collected. For group and follow link pages, we keep one view count per link per day, with no IP address, device or record of who opened it. In our back office we also use account data to count how many people each link brought in, how many spots they logged on day one and whether they came back, to see whether invites work.
• Service usage records: the time, feature and amount each time you use our AI or place data services (no photos or log content), linked to your account, used for billing, spending limits and preventing abuse.
• Anti-cheating: the first part of your IP address when you log (truncated to /24), used only internally to review suspicious ranking activity.
• Reports and appeals: the reports and appeals you submit, and our handling records.

• Strangers (including people who follow your list or see you in Taste match): your name, profile photo, taste persona, four axes, Picky Score, the names of your S-tier spots in each category, your pinned My Four S, your Daily Duel record and your Daily Duel comments. Your taste card (taste persona, four axes and Picky Score) is as of the day before (if that version doesn’t include you yet, for example because you just joined or your taste card wasn’t public that day, strangers see your taste quiz result, or the default values if you skipped the quiz, and your Picky Score isn’t counted yet). Your S-tier spots, how many you have and My Four S are as of the day before, so a log you add today, or a tier you change on a revisit today, takes at least 1 day to reach strangers. A log you switch from Only me back to Friends also waits for a later version. Deleting, switching to Only me, making your taste card friends-only and blocking take effect right away. Turn off Public taste card in Settings, and strangers don’t see your taste card, S-tier spots or My Four S. Following each other’s lists in the app makes you friends (friends see the logs you share with friends). “People you may know” shows the names of friends you have in common. The one-line bio on your profile is shown to friends and strangers alike, just like your name and profile photo (live, not the day-before version). A bio with a link, a phone number, other contact details or abusive words is visible only to you, and if your profile photo is hidden after reports, your bio is hidden too until we handle it; it comes back if the report doesn’t hold up.
• People’s picks and Split spots: people signed in to Zuii see counts: how many put a spot in S and how many said never again (as of the day before; only people with a public taste card, an account past a minimum age (at least 1 day) and a minimum number of logs (at least 1; imported and past spots count too); in People’s picks a spot shows once 1 person puts it in S, and a Split spot needs at least 2 on each side, S and never again), never when. Tapping the S count lists names, photos, taste personas and taste match, but only for people on the Taiwan Tastemakers board (you’ve seen the explanation and haven’t turned the board off in Settings → Privacy); everyone else is only counted. People who said never again are only ever a count. Sides picked by people who haven’t been to a Split spot are shown only as totals (at least 3), and no one can see who picked which side.
• Worth saving (in Picks): lists spots by how many people put them in S, counted the same way as People’s picks, plus public logs you can see in Picks. Friends who put a spot in S or A are named; strangers are only counted, and no times are shown.
• Spot menus: when you read a menu in menu mode while you’re near that spot (or logged it that day), the dish names, second-language names and prices read off it go on that spot’s menu, which anyone signed in to Zuii can see on the spot page. It never says who snapped it, only roughly how many weeks ago; menu photos still aren’t saved.
• Strangers can tap Agree or Seriously? on your public S-tier spots (the same day-before version): you only get a combined count, with no push and no names. Turn off “Let strangers weigh in on my S” in Settings → Privacy.
• Anyone with your add-friend or invite link or code (no sign-in needed, including link previews in LINE and iMessage): your name and profile photo, plus, if your taste card is public, your taste card as of the day before and how many S-tier spots you have in each category as of the day before.
• People with your share link (no sign-in needed) can see, at zuii.app/u/your-code, your name, photo, taste persona, four axes, Picky Score, how many spots you’ve logged, how many S-tier spots you have, how many people follow your list, this week’s title and the names of your top 3 S-tier spots (as of yesterday; older spots you imported may show right away). No other spot names appear on the web. You can turn off your public list page in Settings → Privacy.
• The Taiwan board (all signed-in Zuii users): when you’re on it, your name, photo, taste persona, this week’s four numbers (followers, recs that landed, backed, Picky Score) and your rank, plus this week’s title. Turn off “Show me on the Taiwan board” in Settings → Privacy; the Friends board stays the same.
• Table vote: people at the same table vote can see your name, photo and your vote at that table, only there. The table, its votes and its notifications (including the reveal) are deleted 7 days after the table closes.
• Groups: anyone with a group link (no sign-in needed) can see, at zuii.app/g/group-code, the group name, how many people have joined, how many days are left, the name, profile photo and taste persona of members who are on the Taiwan Tastemakers board (everyone else is only counted), and the spots the group puts in S with how many people (added up only from the top 3 S-tier spots already on members’ public list pages, never who). Joining makes you friends with the person who started the group, not with the other members. We may also send friend requests for you to other members you can see when you join; you only become friends if they accept. In the app, members see the names, profile photos, taste personas and taste match of members who are their friends or on the Taiwan board, and everyone else only as a count. The group list and “They disagree” show counts; only friends are named, and strangers count as of the day before and only when there are at least 2 on a side. The group page can be saved as a share image with only the group name, member count and the group’s S-tier spots. When someone joined is never shown to anyone. You can leave a group; the person who started it can close it (no one else can join, and members can still see the group page).
• Anyone with your follow link (zuii.app/f/your-share-code, no sign-in needed): your name, profile photo and taste persona, plus, if your public list page is on, your top 3 S-tier spots and how many people follow your list (the same as on zuii.app/u). If your taste card isn’t public, no one can follow you through the link. People who follow you through it only follow your list and don’t become friends; you become friends only if they later tap Follow in the app themselves and you follow each other.
• Your follower numbers (only you see them): how many people follow your list, how many came in through your link, running totals for recs that landed and Agrees, and what share of your followers put at least one of your S-tier spots in S too. That share only uses the day-before S-tier spots of followers with a public taste card, shows only once there are at least 5, and never lists anyone. When you follow someone, your S-tier spots count toward their share the same way.
• New people you bring in (through your add-friend link, code, group or follow link): when they sign up, they see the spots and tiers on your list so they can pick the ones they’ve been to. If you’re friends, they see what you share with friends; if not (for example, they came through your follow link), they only see your S-tier spots as of the day before. No times, one-liners or photos. At the end they see your taste match and how many hard disagrees you have. If they’re your friend and add spots from your list, you get a notification that they went through your list.
• “People who eat like you” (people suggested to you by taste) and “Follow a few lists first” during sign-up (everyone signed in to Zuii): only people on the Taiwan Tastemakers board are listed, with their name, profile photo, taste persona, taste match and S-tier spots as of the day before (up to 3) or how many they have. No times, one-liners, photos or locations. They’re ordered by taste match and follower count, and some list makers we pick are moved up. If you tap × on someone, we won’t suggest them to you for 30 days. Turn off “Show me on the Taiwan board” in Settings → Privacy and you won’t appear here.
• Cards in Picks show a line on why you’re seeing them, such as which friend also ranked the spot, that someone with similar taste put it in S, how far away it is, or how many people put it in S. Friends are named; strangers are named only if they’re on the Taiwan Tastemakers board. Otherwise it just says someone with similar taste, or gives a count.
• Top Sharers (all signed-in Zuii users): once you have a log in Picks, you’re on Top Sharers with your name, how many spots you’ve posted to Picks (in total and new this week) and your rank, plus your profile photo and taste persona if your taste card is public. Each week’s top 3 get “Top Sharer of the Week #1–3”, shown on your page and next to your name on your public log cards for a week. Your page also lists your “Spots posted to Picks”: spot name, tier and month. All of it comes from logs you made public yourself, with no times or places. Turn off “Show me on the Taiwan board” in Settings → Privacy and you’re off Top Sharers and won’t get Top Sharer of the Week; the public spots on your page still show, so to take one back, switch that log to Friends.
• Friends: your logs, tiers, one-liners, dishes, photos (originals, plus the AI versions you choose to show), saved spots (without where each one came from) and My Four S.
• Friends of friends and anyone signed in to Zuii: only when you set a log to Friends of friends or Public. Friends of friends see it on that spot’s page; Public logs show to everyone signed in to Zuii in the Picks tab, automatically the day after you set them (never in real time). They see your name and that log’s tier, its place on your list, one-liner, dishes, month and photo copies (faces, receipts and text on screens blurred as best we can; body shapes and clothing may still show). The exact date and time and who you were with are never shown. Friends-of-friends logs never add up to a profile of you; public ones are listed on your page under “Spots posted to Picks” (spot name, tier and month only; see Top Sharers). One-liners or dishes with links, phone numbers, contact details or your friends’ names are held back until our staff check them. A reported public log is hidden right away and we handle it within 24 hours. People can tap Agree or Seriously? on a public log and save the spot: you only see counts, never who, and those Agrees, plus visits that follow, count toward Backed and Recs that landed on the Tastemakers board. Public by default for new logs: once you’ve seen the note in the app and tapped OK, new logs you rate S, A or B are set to Public automatically (same rules as above). C (Never again), Only me and earlier logs never are. You can switch any log back to Friends anytime, or turn off “Post new logs to Picks by default” in Settings → Privacy. The same goes for spots you import (photo import, pasted spot names, flipping a friend’s list, spots you rank when you sign up): if you’ve turned on public by default, the import screen has a “Post S, A and B to Picks” switch, on unless you turn it off. With it on, that batch’s S, A and B logs are set to Public (same rules as above); C never is. With it off, that batch is for friends only. Imports from older versions of the app never go public.
• Anyone signed in to Zuii (stats without names): logs you haven’t set to Only me (including friends-only ones) count, with your name removed, toward stats on spot pages and nearby, such as Nearby must-eats, the rough number of visitors on a spot’s page and the dishes under Popular here. We only use logs that are at least three days old. Nothing shows when too few people count (for example, Popular here dishes and visitor numbers on spot pages need at least 5 people who aren’t the viewer’s friends), and visitor numbers on spot pages are only shown as rough ranges. No names, dates or who wrote what. To leave a log out, set it to Only me.
• Any single log can be set to Only me: no other user can see it, and it isn’t counted in the stats above.
• Zuii staff: only a small number of people we authorize look at photos (originals) and log details in our back office, for these reasons: handling reports and appeals; reviewing Friends-of-friends logs and checking public logs that were reported or had their text held back; spot-checking whether AI tidy-up changed the food or removed the wrong thing (a random sample from the last 7 days, plus any you flagged with “AI changed my food”, whatever the log’s audience, including Only me); and handling the text and screenshots you send through Roast Zuii. They look only for these reasons, and what they do is logged.
• Filtering and reports: before names and Daily Duel comments are posted, our server checks them against abusive words and reserved names (the check itself isn’t stored). If two different users whose accounts are at least 7 days old report someone, that person’s profile photo is hidden. Comments and profile photos with a report still open after 12 hours are hidden too, and come back if the report turns out to be unfounded.
• Crew members: your tiers and scores as used in the shared list (private logs excluded) and your votes.
• Blocking: neither of you can see anything from the other, and any friendship or follow between you is removed.
• Restaurants and partners: they only receive de-identified statistics and trends (for example, a spot’s visitor range, popular dishes, taste distributions). Nothing identifies anyone and no photos are included. This is a paid service of ours.
• Affiliates: our affiliates may access data when helping us with operations, support or maintenance, on our instructions and only to provide Zuii, and they must protect it to the same standard as this policy.

We use Google Gemini for these features: identifying spots from photos, photo import, spotting the dishes in your photos, reading dish names off a menu you snap (menu photos aren’t saved), one-liner suggestions, Zuii’s take after you log, Daily Duel headlines, AI tidy-up (clearing clutter off the table only), AI style for share images (changing only the background, light and props, never the food), and, when you share beyond your friends, open a share image or use tidy-up, checking that a photo shows food and finding faces, people and receipts to blur or protect. The app asks you the first time you use spot recognition, dish recognition or suggestions, and asks separately the first time you tap AI tidy-up, and again separately the first time you tap AI style on the share screen. You can change each one on its own in Settings. We send what each feature needs, for example: photos (or thumbnails), a list of nearby places, spot names and cuisine, tiers, reactions, places you compared, what you ate, how long the line was, whether it’s a repeat visit, the spot’s rank on your list, and how friends ranked the spot (friends as codes). Never anyone’s name (friends are sent as codes and swapped back afterwards), your phone number or your account. One-liner suggestions never include photos, location or time. After AI tidy-up is done, our staff spot-check a random sample by comparing the original and the tidied version to make sure the food wasn’t changed and nothing wrong was removed (see “Who sees what”). AI style sends the copy of that log’s cover photo with faces blurred (never the original) and no spot names, dishes or one-liners. The result is only for you to share, is marked “AI style”, never replaces your log photo, never appears in anyone’s feed or on spot pages, and is deleted after 7 days. If you turn off AI style, results are deleted within a day.

We hand this data to Google only to provide these features, and never to anyone for training models. We don’t use your photos to train models that generate images or video. To make spot and dish recognition more accurate, we may use logs and photos with names and identifying details removed to improve Zuii’s own recognition. We only do this if you turn on “Use my data to improve recognition” in Settings, and you can turn it off anytime. We use Google’s paid API. Under Google’s paid API terms in force at the time, Google processes this data as a data processor, doesn’t use your prompts or responses to improve its products, and keeps them for a limited period only to detect violations of its usage policy and for legally required disclosures. If Google changes its terms, we’ll update this section. Photos only go to Google. If Gemini is temporarily unavailable, text-only features (one-liner suggestions, Zuii’s take, Daily Duel headlines) may be handled by Anthropic Claude instead (also a paid API). Place data comes from Google Places. In Explore, spots with no tier that are marked “Google Maps” are nearby spots picked from Google Places reviews. We don’t show their scores, and they never appear on Home.

If you say no to AI for spots, dishes and suggestions, you can still log (search for the spot, type your dishes), but there’s no spot or dish recognition and no one-liner suggestions, and Zuii’s take uses fixed lines. Photos in logs you set to Friends of friends or Public aren’t shown beyond your friends (tier, one-liner and dishes still are), and share images don’t include photos. If you say no to AI tidy-up, you just don’t get AI tidy-up; everything else works the same. If you say no to AI style, you just don’t get AI style; Magazine and Menu share images work the same (no AI).

• Comparing taste on the web (a friend’s “compare your taste with me” link): the link only carries your friend’s share code, and the page only shows the public fields of their taste card. Your 20 answers are worked out in your browser only, never sent and never stored. Our analytics service only gets the result (taste code, persona and match %), never your friend’s share code or name, and codes in the address are masked before anything is sent.
• Mini-game links only carry question numbers and answers. When a share image is made, the result code is sent to Zuii’s server to draw it and isn’t stored.

• Export: Settings → Download my data gives you a copy of your data, as a spreadsheet (CSV) or in full (JSON). The full copy also includes where your saved spots came from, My Four S and the Roast Zuii messages you sent, plus which spots you sent menus for.
• Delete account: Settings → Delete account. You can cancel within 7 days. After 7 days we delete your logs, photos, lists, friends, comments, Roast Zuii messages and account, permanently. Groups you started are deleted too, and you’re removed from other people’s groups. While deletion is pending, nobody else can see your taste card. If you signed in with Apple, we also try to revoke Zuii’s sign-in authorization with Apple when you ask to delete, and handle any that don’t go through separately.
• Photos: originals, AI versions (the tidied version, or one an earlier version of the app edited with AI) and thumbnails stay until you delete that photo, that log or your account. After that they’re usually removed from our servers within 1 hour, and always within 25 hours. Switching back to the original doesn’t delete the AI version, so you can switch again. Copies shown beyond your friends are taken down when you narrow who can see, stop sharing or delete, and deleted the next day.
• Boxes marking where faces, people and text are: deleted with the photo (within 2 days), and when you turn off both AI settings in Settings.
• AI tidy-up job records (time, result and cost, no photos) are kept for 90 days.
• AI style results for share images: kept for 7 days, and deleted sooner if you turn off AI style or delete your account.
• Roast Zuii: screenshots are deleted 90 days after we finish with the issue (fixed, or decided not to change), and kept no longer than 180 days in any case. The text and the details added automatically are kept for up to 1 year. Everything is deleted with your account.
• The daily versions strangers see (taste card, S-tier spots): only the last few days are kept (3 for taste, 5 for S-tier), then overwritten.
• Service usage records (the time, feature and amount of each AI or place data request) are kept with your account for billing and preventing abuse. When you delete your account, we remove the link to you and keep only anonymous usage.
• Groups: the name, members and join times are kept, including after a group is closed or expires (members can still see the group page), until the person who started it deletes their account. When a member leaves or deletes their account, their entry is removed.
• Spot menus: dish names and prices belong to that spot’s menu and stay with the spot; we hide ones that are reported or wrong. Who sent how many dishes and when is only used to handle abuse and is never shown to any user. When you delete your account, that link to your account is removed and the dish names stay on the spot’s menu.
• Photos you took but didn’t log (you left before saving) are deleted automatically once they’re 24 hours old (usually within 25 hours).
• Photos taken down after a report are kept as evidence in a back-office-only archive for 180 days, then deleted; for “I’m in this photo” cases, 30 days.
• Data in backups is overwritten when the backup cycle ends.
• Data sent to AI providers: Google keeps it for a limited period under its paid API terms, only to detect violations of its usage policy and for legally required disclosures. Anthropic keeps it for a limited period under its commercial terms and then deletes it. The exact periods are set by their terms at the time.
• Data we’re legally required to keep (for example, when a court or regulator lawfully asks) is kept until that legal requirement ends.
• Offline logs that exist only on your phone disappear when you delete the app.
• Reports and appeals: reports you submit (the reason and the reported content) and our handling records are kept in our back office, and appeal emails stay in our support mailbox, to handle repeat violations and appeals. The person you report never learns who reported them.

• What we collect: the email you leave on our website, the city if you choose to add one, and the language you were browsing in (Chinese or English). Once the app is on the App Store, the website stops taking new sign-ups.
• Why: only to send you two emails: a confirmation when you sign up, and one when Zuii is on the App Store. No marketing, no ads, and it isn’t linked to any app account.
• How long: deleted once the launch email goes out. Want it gone sooner? Email hi@zuii.app and we’ll delete it. After that we keep only a hash computed from your email (not the email itself), used only to make sure we never email you again and nobody can put you back on the list. Resend keeps its sending records (recipient and message content) for about 30 days and then deletes them, as set by its terms at the time.
• Sharing: never sold, never shared for anyone else’s use. Resend sends these two emails for us (see “Where your data is processed and by whom”) and only on our instructions.