Almost nothing, and this page says exactly what. No email, no password, no trackers — a seat is a name, a mark and the plates you post.
Last updated 2 September 2026
Sanatori Co, LLC, a California limited liability company, at 2108 N St, Ste N, Sacramento, CA 95816. For anything on this page, including a request to see or delete your data, email hello@sanatori.co.
Only what the app needs: the name and mark you choose for your seat, the table code you joined with, your photos and their captions, the place you tagged and its city and country, the verdicts you give and receive, your remarks and table chat, and the times all of it happened. We also store a one-way hash of your seat key, and your IP address briefly, to stop a four-letter code being guessed at scale.
No email address, no phone number, no password, no date of birth, no location from your device, no contacts, and no advertising or analytics trackers of any kind. There is no third-party pixel on this site. We do not know who you are beyond the name you typed into a seat.
The app keeps a few things in your browser’s local storage rather than on our servers: your table code, your seat ID, your seat key, when you last opened the activity tray and the tallies at that moment, which plates you marked bougie, and — if you set one — your seat’s picture, which never leaves your device at all. None of it is a tracking cookie, none of it is read by anyone else, and clearing your browser storage removes all of it. Clearing your seat key means losing the seat, because we hold no copy.
Under the GDPR we rely on three bases. Running your seat — storing your name, mark, table code and the plates you post so your table can see them — is necessary to provide the service you asked for, so the basis is performance of a contract. Your photos, captions, places, remarks and chat are content you choose to publish to your table, so the basis is your consent, which you can withdraw at any time by deleting the content or leaving the table. Hashing your seat key and briefly logging your IP address to stop table codes being guessed rests on our legitimate interest in keeping tables secure.
Photos are not scored, rated, classified or described by any AI model, and they are not used to train one. A plate gets a name only if you give it one. There is no automated decision-making and no profiling of any kind.
The four other seats at your table, and nobody else. There is no public feed, no discover page, no followers, and no cross-table browsing. Photo files themselves are served from an address that is unguessable but not password-protected, so anyone you personally send a photo link to could open it.
The database and the app run on Railway. Photos are stored on Cloudflare R2. When you search for a restaurant, the text you type is sent to Google Places to return suggestions; Google is not told who you are. Those three companies process data on our behalf under their own data-processing terms. Nobody else receives it.
Sanatori Co, LLC is in California, and the companies that store your plates for us — Railway, Cloudflare and Google — are United States companies. So if you are in the EU, the UK, or anywhere outside the US, your data is transferred to and stored in the United States. Where that transfer is regulated, we rely on the safeguards those processors put in place: their standard contractual clauses and, where they are certified, the EU–US and UK–US Data Privacy Framework. You can ask us at hello@sanatori.co which applies to your data. If you would rather your plates never left your own country, do not take a seat.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising — in the specific senses California law gives those words, and in the ordinary sense too. We have never done so and there is no arrangement under which we could. Nothing you post is used to target advertising, here or anywhere else. We also will not treat you differently for exercising any right on this page: the app behaves identically whether or not you ask us for your data.
Table chat and per-plate remarks are stored as ordinary text, so whoever holds the database credentials could read them. We do not, and the app contains no tool for it — reading your table would mean opening the database deliberately. Chat is not end-to-end encrypted, and we would rather tell you that plainly than imply otherwise.
Everything travels over HTTPS. There are no passwords to steal, because there are no accounts — your seat is proved by a key held on your device, and the server stores only a one-way hash of it, which cannot be reversed into the key. Storage credentials are scoped to a single bucket and live in the host’s environment, never in our code. Table lookups and seat claims are rate-limited so a four-letter code cannot be walked. None of that makes us unbreakable: this is early software run by very few people, and you should post accordingly. If we ever discover a breach affecting your data, we will email the address that reported the seat and post a notice on this page.
Until you remove it. Leaving a table deletes your seat, its plates and their photo files straight away. Table chat is filed by day and kept so the calendar can walk back to any room. A written deletion request removes everything we hold about you.
You can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, object to our relying on legitimate interests, withdraw a consent you previously gave, or ask for your content in a portable file you can take elsewhere. Californian residents have the equivalent rights to know, delete, correct and opt out, and may use an authorised agent. Email hello@sanatori.co with your table code and seat ID from the app’s settings. We answer by hand, so allow a few days, and we will not charge you or degrade the app for asking. If you are in the EU or UK you may also complain to your data protection authority; in California, to the California Privacy Protection Agency.
The app is not for anyone under 16 and we do not knowingly hold their data. If you believe a seat belongs to a child, email us and we will delete it.
The date at the top of this page is the date of the current version. If what we collect or who processes it changes, this page changes with it.
Nothing here is guaranteed to survive. Plates, photos, verdicts, chat and entire tables may be lost, corrupted or deleted — by a fault, by a deploy, or by the service being taken down — and there is currently no backup. Sanatori Co, LLC accepts no responsibility for lost or unrecoverable data, to the fullest extent the law allows. Keep your own copy of any photo that matters to you. The full disclaimer is in clauses 09 and 10 of the Terms of Service.
We would rather this page were boring and true than thorough and vague. If something here is unclear, email us and we will fix the wording.