Privacy

Last updated 2 November 2026

This policy covers the Ghosted eats apps for iPhone and Android and this website (ghostedeats.app). Ghosted eats is published by Aditha Jayasuriya, an independent developer in Australia ("we"). Questions go to support@ghostedeats.app.

Ghosted is a parody of a food delivery app. No food is ordered and no payment is taken. "Payday" and "kept" are numbers inside Ghosted, not money.

Your location

• On your device. When you allow location, or type an address, Ghosted uses it on your phone to choose and place the restaurants around you, to work out delivery times and fees, and to draw your driver's route.
• Address lookup. The app turns coordinates into a street and suburb with Apple's geocoder on your device. This website uses Photon (photon.komoot.io), an OpenStreetMap search service, which receives what you type in the address box, or your coordinates if you press "Use my current location".
• Routes. To draw the drive on real roads, Ghosted sends the start and end coordinates of each route (the restaurant's made-up spot near you and your delivery point) to the public OSRM routing server (router.project-osrm.org). Pickup walking routes go to the FOSSGIS routing server (routing.openstreetmap.de). These services see the coordinates and your IP address, as any website would. They don't receive your name or account.
• Maps. The app shows Apple Maps on iPhone and Google Maps on Android; the map provider sees which part of the map is on screen. This website loads map tiles from OpenFreeMap (tiles.openfreemap.org), which sees which part of the map you're looking at.
• Steps. For pickup orders the app can read your step count from the phone's motion sensor while you walk. It stays on your device.

Signing in (optional)

You can sign in with Apple or Google in the app, and with Google on this website. We receive the identifier those services give us, and your name and email if you choose to share them. We use it only to recognise your account on another device. Before you sign in, the app may register an anonymous device identifier with our server so features like driver chat work; it isn't linked to your name.

Backup of your orders

When you're signed in, the app backs up your Ghosted history to our server: your orders, Payday, kept total, streak, rewards and settings, so you can restore them on a new phone. Before upload, saved locations are rounded to roughly 100 metres and route lines and walking paths are removed.

Friends (optional, signed in)

Friends only works when you're signed in, and only people you accept as friends see what you share. There are no public profiles and no search by name.

• Username and profile card. You choose a username so friends can add you. Friends see your first name, username and a small card the app publishes: your kept total, streaks, number of orders, the drivers you've met and the restaurant you order from most.
• Posts. When you post an order, friends see the restaurant, suburb, dishes, your note and the kept amount. The time is only included if you turn it on. Notes, usernames and other text you write are checked by an automated moderation service (Google's Gemini API) before they're saved.
• Watching a live order. If you share a live order, your friends (and anyone you send the link to) see the restaurant, dishes, driver, suburb and the drive on a map. The route shared from your phone stops about 300 metres before your delivery point, so your address is never sent.
• Group orders and clubs. Members of a group order see each other's names and what everyone added. Club members see each other's names and how much each has kept since joining. To count that, the app sends our server a record of each order you place while signed in (restaurant, driver, amount and time; never your address).
• Reactions, reports and blocks. We store reactions you leave, reports you make (so we can review them) and people you block. Blocking hides each of you from the other and isn't announced.
• Ghost kitchens. A kitchen you open, with its name, dishes and photos, is visible to anyone with its link.

Notifications

If you allow notifications, the app gives our server a push token so we can tell you about friend requests, friends' live orders, group orders and kitchen orders. Pushes travel through Expo's push service and then Apple (iPhone) or Google Firebase Cloud Messaging (Android). Order progress notifications are scheduled on your phone and don't involve our server.

Driver chat

If you message your driver, the app sends your message and the recent chat to our server to write the driver's reply, along with the details the reply needs: the order's restaurant and dishes, its progress, your first name if you've set one, your suburb, local time and drop-off preference. Our server uses Google's Gemini API to write the reply, so that text is processed by Google under its API terms. Don't put anything in a chat you wouldn't want processed that way. If chat replies are unavailable, the driver answers from a script on your device.

This website

• Your address, cart, Payday and orders on this site are saved in your browser's local storage. They don't leave your browser except for the address and route lookups above, unless you choose to save them to an account.
• Saving to an account (optional). After an order you can "Save your kept money" with Google. Google's sign-in button loads from accounts.google.com and Google tells us your account identifier, name, email and profile picture. This browser then registers an anonymous device with our server and backs up the same things the app does (orders, Payday, kept total, streak and the name for your driver, with locations rounded to about 100 metres and no routes), so they carry into the app when you sign in there with the same Google account. Signing out keeps everything in this browser.
• Restaurant photos load from our image storage (Cloudflare R2). The "Ghosted users have kept" counter reads one public total from our server.
• The site is hosted on Cloudflare Pages, which processes standard request logs (such as IP address) to serve and protect the site.
• No analytics and no advertising pixels. We set no cookies; Google may set its own when you use its sign-in button.

What we don't do

• No ads, and no advertising or tracking SDKs.
• We don't sell your data or share it with data brokers or advertisers.
• We never take payment details. There's nothing to pay for.

Keeping and deleting your data

Your account, backup and friends data are kept until you delete them. In the app, go to You → Account → Delete account. That removes your account, backup, profile card, friendships, posts and reactions from our server straight away. Shared live order links expire a day after the order arrives. You can also email us and we'll do it for you. Signing out keeps everything on your phone; deleting the app removes the local copy. On this website, clear the site's data in your browser to remove everything it saved.

Children

Ghosted isn't directed at children under 13, and we don't knowingly collect their information.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your information, or to object to how it's used. Email support@ghostedeats.app and we'll respond within 30 days. You can also complain to your local privacy regulator (in Australia, the OAIC).

Changes

If we change this policy we'll update the date above, and tell you in the app if the change matters.