Privacy Policy

1. Introduction

Netbay Pty Ltd ("we", "us", "CHOW") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) of South Africa. This policy explains what information we collect, how we use it, and your rights.

CHOW is intended for users aged 16 and older. By using CHOW you confirm you meet this age requirement.

2. Information We Collect

• Email address — used for authentication and account management
• Username — chosen by you, displayed publicly within CHOW
• Location data — city-level, used to show relevant food spots near you (only when you grant permission)
• User-generated content — reviews, photos, Chow Loop posts, beacons you create
• Device push token — used to send you app notifications (only when you grant permission)
• Usage analytics — event data (screens viewed, features used), linked to a pseudonymous user ID rather than your name or email, to improve the product
• Bug reports (optional) — if you submit one: the title and description you write, an optional screenshot, your user ID, and technical details (app version, device model, OS version). Used only to diagnose and fix problems. Reports are kept until resolved and are removed or anonymised, and screenshots deleted, when you delete your account. The report text and technical details (never your user ID or screenshot) are also copied to our private issue tracker so our developers can fix the problem.

3. How We Use Your Information

• To authenticate you and maintain your account
• To provide personalised food discovery based on your location
• To send you notifications about activity relevant to you (beacons, responses)
• To display your content (reviews, posts) to other CHOW users
• To improve CHOW's features and performance

4. Sharing Your Information

We do not sell your personal information. We share data only with:

• Supabase — our database and authentication provider (data hosted in EU-West)
• Resend — our email delivery provider (used for authentication emails only)
• Mixpanel — analytics (US datacenter; events are linked to a pseudonymous user ID, never your name or email)
• Expo / Google Firebase — push notification delivery

5. Your Rights (POPIA)

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and all associated data
• Object to the processing of your personal information
• Withdraw consent at any time

To exercise any of these rights, visit our account deletion page or contact us.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, all personal information is permanently deleted within 30 days. Anonymised analytics data may be retained indefinitely.

7. Contact

To exercise your rights or raise a privacy concern, contact our Information Officer:

Jurisdiction: Republic of South Africa. Governed by POPIA (Act 4 of 2013).