Privacy Policy
BigBack is operated by [Operator name] ("we", "us") in Waterloo, Ontario, Canada. This policy explains what we collect, why, who we share it with and what you control. Questions: support@bigback.app. Our privacy officer is [Privacy officer name].
The short version
- We collect what the app needs to work: your UW email, your profile, what you post and who you follow.
- Your posts are seen by the people you choose: your followers, or anyone signed in if your profile is public.
- We use your location to find places near you. We don't keep a history of where you've been, and nobody else sees your live location.
- We don't sell your data, show ads, or track you across other apps.
- You can delete your account and everything in it from the app, at any time.
What we collect
| What | Why |
|---|---|
| Account: your @uwaterloo.ca email, name, username, optional photo and bio, privacy setting, when you accepted our Terms | To sign you in, confirm you're a UW student and show your profile |
| What you post: photos (front and back camera), captions and notes, ratings and rankings, comparisons, dish tags, comments, reactions, optional voice clips, plans, invites and RSVPs, saved places | This is the app: showing your meals and rankings to the people you choose |
| Social: who you follow, who follows you, people you block, friends you tag, your crews | To build your feed and keep blocked people away from you |
| Location, only while you use features that need it (Tonight, the map, starting a meal). Optional background location for arrival reminders, only if you turn it on | To find places near you and suggest where you are. Coordinates are used for that request and not stored as a history. The places you rate are stored, and your followers can see them |
| Contacts (optional) | To help you find friends. Phone numbers and emails are hashed on your phone before matching and never stored or messaged |
| Device and app data: push notification token, app version, crash reports, basic usage events | To send the notifications you allow, fix bugs and improve the app. Not used for advertising |
| Ask BigBack (optional AI feature): the text you type and the places being considered | To generate suggestions. See "Who we share it with" |
Who can see your content
- Public profile: any signed-in BigBack user can see your posts and rankings.
- Private profile: only followers you approve can see them.
- Tagged meals and plans: the people in that meal or plan see it. Anyone with an invite link can see that plan's details.
- Campus scores: your ratings count toward a place's anonymous UW score. Your name isn't shown with it.
- People you block can't see your profile or content, and you won't see theirs.
Who we share it with
We use these service providers to run BigBack. They process data only on our instructions:
| Provider | For | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in and photo storage | United States |
| [Email provider, e.g. Resend] | Sending sign-in codes | United States |
| Apple | Push notifications, maps and place search | Per Apple's privacy policy |
| Anthropic | Ask BigBack suggestions (only when you use it). Under Anthropic's commercial terms, this data isn't used to train its models | United States |
| [Crash reporting, e.g. Sentry] and [analytics, e.g. PostHog] | Crash reports and usage statistics, not linked to advertising | [United States or EU] |
Your information is stored and processed in the United States, so it may be accessed by courts and authorities there under US law. We may also disclose information when the law requires it, or to protect someone's safety.
We never sell your personal information, share it for advertising, or use data brokers.
How long we keep it
- While your account is open.
- When you delete your account, your profile, posts, photos and rankings are deleted immediately. Copies in backups are gone within [30] days.
- Server logs are kept for up to [90] days.
- Reports about other users may be kept longer when we need them to keep the community safe.
Your choices and rights
- Delete: You → Account → Delete account.
- Access, correct or download your data: edit your profile in the app, or email us for a copy of your data.
- Withdraw consent: turn off location, contacts or notifications in iOS Settings at any time. The rest of the app keeps working.
- Control who sees you: make your profile private, block people, and report anything that breaks our Community Guidelines.
- Depending on where you live (for example Quebec or California), you may have more rights. Email us and we'll help.
- If you're unhappy with how we handled your information, you can contact the Office of the Privacy Commissioner of Canada.
Age
BigBack is for university students aged 16 and over. We don't knowingly collect information from anyone younger. If you think we have, email us and we'll delete it.
Security
Data is encrypted in transit. Access to your data is limited by strict per-user rules in our database, and sign-in uses one-time email codes, not passwords. No system is perfectly secure. If we learn of a breach that puts you at real risk, we'll tell you and the Privacy Commissioner as the law requires.
Changes
If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.