iOS App Privacy Policy
Last updated: August 19, 2026
The short version
There is no account and no sign-in. We never ask for your email, and nothing you do is used for advertising or shared with advertisers. The app cannot access your location — it asks for no location permission at all. What we do collect is anonymous product analytics and — if you use the tracker — the foods you log. One switch in About turns both off.
What stays on your device, always
- Favorites — the foods you star, stored locally with Apple's SwiftData framework.
- Your meal log — everything you add to your plate. The device copy is the real one; the app works fully offline and the copy we receive is a mirror, not the source.
- Your name, if you give one during the tour. It is optional, it is used only to greet you inside the app, and it is never transmitted anywhere.
- Goals, if you set calorie or macro targets.
- Filter, sort and view preferences — macro goals, dietary preferences, avoided allergens, sort order, and card density, stored in iOS
UserDefaults. - Interface state — whether you have seen the tour, and which stations you collapsed.
Deleting the app deletes all of it, including the anonymous identifier described below.
The anonymous identifier
The first time the app runs it generates a random UUID. It is not derived from your device, your hardware, or anything about you — it is a random number, and two installs on the same phone produce different ones. It is stored in UserDefaults, which means deleting the app destroys it permanently; reinstalling makes you a new, unconnected person to us.
We deliberately do not store it in the Keychain, which would survive reinstalls. We do not use Apple's advertising identifier (IDFA) and do not ask for tracking permission, because we do not track you across other companies' apps or websites.
What we collect
Usage analytics — processor: PostHog
Which actions you take and which features you use: opening a hall, changing the date or meal, applying a filter, logging a food, rating one, viewing the receipt. Each event carries the anonymous identifier and the app version. The app does not record which screens you view — automatic screen tracking is switched off, and no screen-view event is ever sent.
Purpose: to understand which parts of the app are used and worth keeping. Under Apple's App Privacy definitions this is Usage Data → Product Interaction and Identifiers, collected for Analytics, and not used for tracking.
Our analytics processor is PostHog, on their US infrastructure. Location lookup is explicitly disabled on every event the app sends, so no city, region or country is derived from your IP address. PostHog processes this data on our instructions and provides equivalent protection to that described in this policy; they do not sell it and do not combine it with data from other companies' apps to target advertising.
Your meal log — our own database
If you add foods to your plate, each change is sent to our own Supabase database as an append-only record: the food, how many servings, the date, the meal, the dining hall, and the anonymous identifier. Nothing identifies you personally, and there is no way for us to connect a log to a real person.
Purpose: to see what students actually eat, so the app can be improved.
The app can only insert these records. It has no permission to read anyone's records — including your own — so no one holding the app's public key can retrieve another person's meal history. Corrections work by adding a new record rather than editing an old one.
Food ratings
A thumbs up or down is sent with the same anonymous identifier, the food, and the dining hall.
What we never collect
Your name, email address, phone number, postal address, contacts, photos, health or fitness data from Apple Health, financial information, your location, or your advertising identifier. The app requests no location permission, links no location framework, and has no way to find out where you are. The app contains no advertising SDK, no social media SDK, and no crash-reporting SDK.
How to switch it off
About → Share anonymous usage data. Turning it off stops the analytics events and stops the meal log leaving the phone. The tracker keeps working; it simply stays local.
The switch takes effect immediately. Records already sent cannot be linked back to you by us, because we hold no identity to match them against — if you want them gone, contact us with the timeframe and we will delete records for that window.
What the app sends to load a menu
The app makes anonymous, read-only requests to the same public database to fetch menus, opening hours and nutrition information — the venue, the date, and, when favorite alerts are on, the recipe numbers of your starred foods so upcoming menus can be matched. All traffic uses HTTPS.
The weather
The home screen shows the current temperature and conditions for Chapel Hill. It comes from Open-Meteo, a free weather service that needs no account and no API key.
The app asks for no location permission, so there is nothing it could use even if it wanted to. The request contains one thing: a fixed pair of coordinates for Chapel Hill, compiled into the app — the same question from anywhere in the world gets the same answer. As with any request over the internet, Open-Meteo can see the IP address it came from; nothing else about you is sent, and no identifier of ours goes with it.
Checking for updates
Every time the app comes to the foreground, it asks Apple's own App Store lookup service (itunes.apple.com/lookup) which version of Eat UNC is currently for sale, so it can tell you if the one you have is out of date. The request carries the app's bundle ID and your device's storefront region — read from iOS's Locale, not from location services — as a query parameter. As with any request over the internet, Apple's servers see the device's IP address along with it.
Nothing about you is sent: no identifier, no name, nothing tied to your usage of the app. The response — a version number and when we saw it — is kept only in UserDefaults and is overwritten the next time the app checks. This check runs regardless of the analytics switch in About; it keeps the app working rather than collecting anything about you.
Notifications
Favorite alerts are local notifications, created and scheduled on your own device with Apple's UNUserNotificationCenter. There is no push server and no APNs token. They are only scheduled if you enable alerts and grant permission, which you can revoke at any time in iOS Settings.
The app also registers a background refresh task so those alerts stay accurate when menus change. It performs the same anonymous menu lookup and nothing else.
Retention
Analytics events are retained by PostHog under our account's retention settings. Meal log and rating records are kept indefinitely in aggregate, as they have no personal identity attached. Everything on your device is kept until you delete the app.
Children
The app is rated 4+. It is intended for university students and does not knowingly collect data from children under 13. No collected data identifies anyone.
Third parties
| Who | What they get | Why |
|---|---|---|
| PostHog | Anonymous usage events and the random identifier | Product analytics |
| Supabase | Menu and hours requests, and your meal log and ratings if enabled | Hosting our database |
| Open-Meteo | A fixed Chapel Hill coordinate — nothing about you | The temperature on the home screen |
| Apple | The app's bundle ID and your device's storefront region — nothing else | Checking whether a newer version is available |
PostHog and Supabase process data on our instructions and provide equivalent protection to that described here. Open-Meteo and Apple receive no data about you at all, so they process nothing on our behalf. None of them is a data broker. Nothing about you is sold.
Affiliation
Eat UNC is an unofficial, independently developed app. It is not affiliated with, endorsed by, or sponsored by the University of North Carolina at Chapel Hill or Carolina Dining Services. Menu and nutrition information is published by UNC Dining and may change without notice; if you have a food allergy, always confirm allergen information posted at the dining hall.
Changes
If this policy changes, the “Last updated” date above will change with it. Material changes will be noted in the app's release notes.
Contact
Questions, or a deletion request: eatunc.com/feedback.