Privacy Policy

Effective date: 11 October 2026

Pardine is a small app for noting where each thing you eat comes from, made and run by Paral LLC. This policy covers the app and the site at pardine.app.

The short version

Pardine works without an account. Without one, everything you log stays on this device (in the browser on the web, in the app’s own storage in the iPhone, iPad and Mac apps), and nothing you log is sent to us or to anyone else. The one request you can start yourself is asking us to read a short map link you share or paste (section 4).
Pardine never asks for your device’s location. Where you live is something you type or pick.
There is no analytics, telemetry, error reporting or advertising in Pardine, and it sets no cookies of its own. Cloudflare, in front of the site, may set operational cookies under its own policy.
Sync is optional. If you sign in to sync, what you log is kept on our server so your other devices can get it. It is encrypted on the way and in our backups, but it is not end-to-end encrypted: our server, and Cloudflare, which carries the connection, could read it.
Friends is optional too, and off until you turn it on. Only people you have accepted as friends see anything, and only what section 5 lists.
We do not sell personal data. We share it only as you direct it (with the friends you accept) and with the services in section 9 that help run Pardine. We do not use what you log to train anything.

1. Who we are

Controller: Paral LLC
Registered address: 30 N Gould St, Sheridan, Wyoming 82801, USA
Contact: support@pardine.app

Write with any question about this policy and a person will answer it.

2. Without an account

On the web, Pardine is a page that runs in your browser. Until you open sign-in, it only fetches its own files from pardine.app: the app itself, the map, the place names and the fonts. None of those requests carries anything you logged. The one other request is the one you start when you share or paste a short Google Maps or Apple Maps link: Pardine asks pardine.app where that link points (section 4). The iPhone, iPad and Mac apps carry the app, the map, the place names and the fonts inside the app itself, so without an account they make no network requests apart from that one. If you leave a tip in an app, the payment goes through Apple, not through us (section 9).

On your device, Pardine keeps:

In IndexedDB: your entries (what you ate, where it comes from, the words you typed for where and notes, the date and a time of day if you gave one, and where you were living then), the places you have saved and the things you want to eat (section 4), the timeline of places you have lived, how you live, any near-and-far choices you have made for a place, and your settings.
In localStorage: display preferences only (language, appearance, map layer and similar). Every key starts with dl_.
In Cache Storage: a copy of the app and the map data, so it works offline. Nothing you log is written there. When you share something to the web version of Pardine from another app (on browsers that allow it), what you shared waits there, on your device, until Pardine opens and files it; it is not sent to a server.

In the iPhone, iPad and Mac apps, the same things (your entries, your saved places and wants, the timeline of places you have lived, how you live, your near-and-far choices and your settings) are kept in a database file in the app’s own storage on the device, and display preferences in the app’s preferences. After you sign in, the app also keeps its sign-in token in the device’s Keychain. The app does not ask for your location, camera or microphone, and it does not read your contacts: friends are people who accept an invitation link from you. It has no access to your photo library; if you choose a picture for your profile, the system’s picker hands the app only that one picture.

When you share a place to Pardine from another app, the share extension keeps what you shared in a small file that only Pardine and its extension can read, until Pardine next opens and files it. The extension sends nothing anywhere.

Exporting makes a file on your device and hands it to you; it goes where you send it. Importing reads a file you choose, on the device, and that includes a Google Takeout file (section 4). Neither reaches us.

Browsers can clear a site’s data when space runs very low, and clearing site data yourself erases everything Pardine keeps. In the apps, deleting the app erases what is on the device. Exporting now and then is the safest habit.

3. If you sign in to sync

Sync needs a Paral account. It is not offered to people who live in the European Economic Area, the United Kingdom or Switzerland, and making an account means you confirm that you don’t live there. Where a connection appears to come from one of those places, you are asked once to confirm this before an account is made. We don’t keep that confirmation, or the country the check saw, with your account. Pardine itself works everywhere without an account.

Once you sign in, our server keeps:

Each entry: dishes and ingredients, the words you typed for where and notes, the date and time of day, where you were living at the time, and, if you marked a friend as having eaten with you, that friend’s Pardine friend ID and the name they had when you marked them.
Each saved place and each thing you want to eat (section 4): the name you gave, other names, the address and notes you typed, a link to the place if you shared one, the region it is in, and coordinates rounded to about a kilometre if the link had them.
When each entry was added and last changed, to the millisecond, and when this account last synced. Taken together, these are a record of when you log what you eat.
The timeline of places you have lived, which is a location history, and how you live (settled in one place, or on the move).
Any near-and-far choices you have made for a place.
Your email address.
A name and a picture, if you set them (section 8).

What people eat can say something about their religion or their health. We treat all of it as personal data that deserves care, and we don’t look at it except to keep the service running, to show your friends what you chose to share (section 5), and to look into a report (section 5).

Your language, appearance, map and other display settings are not uploaded, signed in or not. They stay with each device. So does the choice of which maps app Open in Maps uses.

4. Saved places and Want to eat

Pardine lets you save a place you ate at (a restaurant, a café, a bar) and keep a list of dishes or places you want to eat. They are your data, like your entries: they live on your device; they are synced only if you sign in; they are in your export; and they are deleted with everything else. A saved place is not a place on the map and does not change any count on it.

Short map links. When you share or paste a short Google Maps or Apple Maps link, Pardine asks pardine.app to read where the link points. Our server asks Google or Apple once, reads only the redirect, and keeps nothing: no record of the link and no cache. The link travels in the body of the request, not in the web address. To stop abuse we count requests per connection address, in memory, for about a minute; nothing is written to disk. Google or Apple sees our server, not your device. Long links are read on your device and are not sent to anyone.
Opening in Maps. When you tap Open in Maps, Pardine hands the place’s name and address, or its link, to Google Maps or Apple Maps (for a restaurant saved with only a name, the name plus the area it is in or the city you were based in at the time), and what happens next is under their privacy policies. Pardine does not include their map software and never calls their services itself.
Google Takeout. If you import a Google Takeout file, it is read on your device and nothing in it is sent anywhere. Only the places you choose in the preview are imported, and none of them is imported as something you ate.
The rough location of a place (its region, and coordinates rounded to about a kilometre when the link has them) is worked out on your device from what you shared or imported. Pardine still never reads your device’s location.

5. Friends

Friends lets you and the people you choose see what each other ate. It is optional. It needs a Paral account with sync on, it is off until you turn it on, and it is not offered where sync is not (section 3). Before you turn it on you agree once to the Terms of Use; we keep the version number of the terms you accepted, and nothing else about that. Your friends are people who have accepted an invitation link from you, or whose invitation you accepted. There is no search and no suggestion of people, Pardine does not read your contacts, and it sends no notifications.

What a friend can see. For each entry of yours that you have not hidden: the date, the time or time of day, the dishes and ingredients and where they come from, whether you cooked it yourself, the name of the place you wrote for where you ate and, if you saved it, the place’s name, region and map identifier. Your friends also see your Paral name and picture, and so does anyone who opens an invitation you made, before accepting it.

What a friend never sees. Your notes, where you live or have lived, your near-and-far choices, how an entry was added, when it was added, who else you ate with, the address, coordinates, link and notes of a saved place, and your Want to eat list.

Your controls. You can mark any entry Only me, pause sharing, or share only from a date you choose. Changes, deletions and unfriending take effect the next time a friend opens your page; we can’t take back what is already on a friend’s screen or in a screenshot.

How it works. Our server reads the entries you sync and picks what a friend may see at the moment the friend looks; it does not keep a second copy. Your friend’s device keeps a temporary copy of what they looked at, apart from their own records. It is cleared when they sign out, turn friends off or stop being your friend. Your friends are identified by a Pardine friend ID, never by your email address or account number, and your friends never see your email address. When a friend’s page is put together, our server also checks names and place and dish names against a short list of words and shows a friend “hidden” in place of anything that matches.

Invitations. An invitation is a link with a secret in it. The secret works once and expires after seven days. Our server keeps only a fingerprint of it, not the secret.

Eating together. If you mark a friend on an entry, that friend sees the entry’s ticket on that day and is asked whether to add it to their own entries. We keep that request until it is answered or withdrawn. You are not told the answer. An entry marked Only me sends nothing.

Want to eat. Saving something a friend ate to your Want to eat is private. The friend is not told, our server has no record of it, and Pardine does not keep which friend it came from.

Unfriending and blocking are silent: the other person is not told. After a block, neither person’s invitations to the other work.

Reports. You can report a friend’s name or picture or one of their entries. We receive which of three reasons you chose, the number of the entry, which account reported it and when. We do not take free text. A person at Paral looks at it, and may hide the content or turn friends off for an account. The email that tells us a report has arrived holds only a report number, the reason and the time. Reporting can block the person in the same step.

When you stop. Turning friends off removes your friend links, your invitations and the eating-together requests from our server; it keeps your friend ID and the list of people you blocked, so a block stays a block. Deleting the synced copy removes your entries, so friends stop seeing them next time they look. Deleting the Paral account removes everything about friends that we hold for you. A name you were saved under in a friend’s own entry stays in that entry, because it is their record.

6. How it is protected, and who can read it

Everything travels over encrypted connections (TLS).
Our database backups are encrypted.
The server’s disk itself is not encrypted, and the data is not end-to-end encrypted. Our server can read what you sync, and so could we.
Cloudflare sits in front of pardine.app and terminates the encrypted connection for us, so what you sync passes through Cloudflare in readable form on its way to our server.

Synced data is used to keep your devices the same and, if you turn on friends, to show the friends you accepted what you have chosen to share with them (section 5). We use it for nothing else.

7. Deleting

An entry, a saved place or a want: when you delete one, we keep a copy of its contents on the server for 30 days, so that Recently deleted can bring it back on any of your devices. After 30 days only its ID and the time are kept, permanently, so your other devices know to delete it. Friends stop seeing a deleted entry the next time they look.
The synced copy: Settings, Account and sync, Delete the synced copy empties everything this account holds on our server at once, including the 30-day copies. Old copies inside the database file are overwritten after its automatic clean-up, usually within hours. Encrypted backups roll off within 30 days; if we ever restore from a backup, we replay the deletions made after that backup before the service comes back.
The Paral account: deleting it from Pardine deletes the account and everything it holds across Pardine, Parote and Paral News.

What is on your devices is yours to keep or erase; deleting on the server never reaches into a device.

8. Accounts

One Paral account covers Pardine, Parote and Paral News. There are no passwords: you give an email address, we email a six-digit code, and you type it back. Opening the sign-in page loads Cloudflare’s bot check (Turnstile), which sees the check and the address your connection comes from. In the apps, signing in opens Paral’s sign-in page (on pardine.app) in a browser window that the system provides, and the bot check runs on that page; the apps themselves do not load any web page or anything from third parties.

If you set a name or a picture, it is kept with the Paral account and shared by Pardine, Parote and Paral News, so one set in any of them shows in all three, and your Pardine friends see it too; the picture is one you choose, shrunk to 128 pixels on your device before it is sent (otherwise the app draws the first letter of your name), and nothing is fetched from anywhere else.

To stop the code-sending endpoints from being abused, we count requests per email address and per connection address. Those counters hold the address in readable form for up to two hours. Our logs record counts and sizes of sync requests, never their contents.

9. Who else is involved

Cloudflare: Carries every connection to pardine.app (see section 6), works out which country a connection comes from for the region check, runs the bot check on the sign-in page, and stores our encrypted backups (R2).
BinaryLane, in Sydney, Australia: Hosts the server that runs sync and holds the database.
Plunk and Amazon SES: Send the sign-in and account emails. They see your email address and the message.
Apple: Delivers the iPhone, iPad and Mac apps and takes payment for tips in them. When an invitation link opens the app, Apple’s servers have fetched a small file from pardine.app that says which links the app may open; that file holds no data about anyone.
Google and Apple, for maps: Only when a short map link is expanded by our server (section 4), or when you tap Open in Maps (section 4).

Sync and friends cost nothing. In the iPhone, iPad and Mac apps you can leave a tip. Apple takes that payment under its own terms and doesn’t tell us who you are; we only see totals. Pardine on the web takes no payments.

10. Your data, your choices

To get a copy of your data: Settings, Data, Export.
To delete it: delete the synced copy, or delete the Paral account (section 7).
For anything else, including a question about what we hold, write to the contact above.

11. Changes

When this policy changes, this page changes with it and carries a new effective date.

Back to Pardine