Privacy
This notice explains how PickyGoat handles personal data today. Last updated 20 September 2026.
Browsing needs no account
You can read every public ranking, dish page and hunt result without creating an account and without submitting any contribution data.
Signing in to contribute
Contributing uses a sign-in link sent to your email address. Your email address lives in the sign-in system; your contributor profile holds profile and reputation fields such as a display name, an optional public handle, an optional home city and your progress. A public contributor page can show: public handle, display name, whether a picture exists, home city if you set one, level, reputation points, verified rating count, verified new-dish count, the month you joined and earned achievements. If you choose a public handle, that handle and genuine verified achievements may also appear in the Latest from the Herd activity section. The activity feed never uses your email address, and profiles without a public handle are not shown there. Your email address and our internal weighting data are never public.
What contributions can include
Ratings, head-to-head comparisons, dish submissions and photos attached to a submission. Community contributions do not automatically change rankings. Selected verified contributions may later be reviewed and used as evidence. Photos attached to a submission are not automatically published. A contributed listed-dish photo may be displayed on PickyGoat or reused in PickyGoat social/promotional posts only where the contributor granted explicit public-use permission and PickyGoat selects that photo after the required review. You can withdraw that public-use permission from your account below.
Location
"Near me" asks your browser for your location only after you tap it. Your precise coordinates are used transiently to work out that one nearby result, are sent in the body of that request rather than in the page address, and are not saved in the PickyGoat database or in your browser's storage. They are cleared from the page when you reload. On a single dish page, the distance is worked out in your browser and your coordinates are not sent to us at all.
Basic product analytics
When analytics is configured, PostHog may record page views and simple events such as opening a dish. Our analytics wrapper filters out sensitive properties including email addresses, names and free-text comments, and precise location coordinates are not sent as analytics properties. We can't make promises about general internet and hosting telemetry that sits outside the app.
Who is responsible
PickyGoat is responsible for deciding how personal data is used for this service. Contact us through the Contact page. Signed-in users can make account-specific privacy requests directly on this page.
Why we use personal data
We use account and contribution data to provide requested features, verify and moderate contributions, prevent fraud and abuse, keep the service secure, respond to support and privacy requests, and understand whether the product is working. Where applicable law requires a legal basis, this may include performing the service you requested, PickyGoat's legitimate interests in operating and securing the service, complying with legal obligations, and your permission for uses that depend on consent or a licence.
Service providers
Supabase supports authentication, database and storage. OpenAI is used for automated safety, relevance and spam classification of submitted content. PostHog may process the limited product analytics described above, and hosting/CDN infrastructure serves the site. Providers may process data outside Thailand; we limit the data sent to what is needed for each function and use available safeguards where appropriate.
Retention and deletion
We keep account and contribution data only as long as reasonably needed for its purpose, including operating rankings, moderation, abuse prevention and legal or audit needs. One-time contribution handoffs are designed to expire or be consumed and scrubbed. Deletion requests are reviewed across account records, stored photos and free-text fields; depending on the record, data may be deleted, anonymised, detached or minimally retained where there is a legitimate legal, security or audit reason.
Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to certain processing, withdraw consent where processing depends on consent, and complain to the relevant data-protection authority. Withdrawing consent does not invalidate earlier lawful processing.
Your requests
You can ask for access to your data, correction of it, deletion of it, or raise something else. Signed-in users can track the request status below. We may contact you at your account email if we need more information to handle a request safely.
This notice reflects the current pre-launch service. We will update it when our data practices materially change. See also our terms.