Effective November 4, 2026
Privacy policy
more plz is operated by Makeshft Inc. This is the whole policy, in plain words.
- We don’t sell your data.
- We don’t run ads, and we won’t use your name or content to promote more plz without asking you first.
- We don’t train AI on your content, and neither does the AI provider we use.
- Download or delete your data anytime.
- Questions: privacy@moreplz.com
1 What we collect
You give us some of it. We pick up the rest as you use more plz.
From you
- Account. Your first and full name, email address and handle. If you sign up with a password, we store only a hash.
- Taste. Your ratings, reviews, lists, follows and preferences. Dietary choices like vegetarian or gluten-free are optional. They’re stored on your account, shown only to you, and kept out of analytics.
- Location. Your city. We use your city to show you places and people near you, and to tailor our emails to your area. When you ask for a nearby search, your browser shares your location with us for that search. We save only coordinates rounded to an area about 11 km wide, so we never hold your exact spot. A location hint also goes to Google when you search for a place.
From your device
- Usage. Pages you view and features you use, with your device, browser and approximate location from your IP address. When you save a place from a recommendation, we record which kind of recommendation it was, and the person it led with if they show their ratings publicly, so we can tell whether recommendations work. We record this only while analytics is on.
- Errors. Reports that tell us when something breaks.
- Security logs. Sign in attempts and suspicious activity, with IP addresses.
- Support email. If you write to us, the message goes to our team inbox.
We don’t collect your contacts, your precise location, or anything from other apps.
2 What other people can see
more plz is social by design. Here is what other people can see, signed in or not.
Public to everyone
- Your profile. First name, handle, avatar, city, bio, tagline, taste card and the month you joined. Also your archetype, the sentence explaining it, and your favorite cuisines, even when you keep your ratings private.
- Your people. Who follows you, who you follow, and who invited you.
- Your recent activity. Who followed you lately, and, while you show your ratings publicly, your top matches by first name with a match percentage.
- Your public lists. Lists you make public, and the places on them.
- Your ratings and reviews, and how many you have, unless you keep them private. A review appears on the restaurant’s page.
- Your first name in other people’s reads. It can appear in the “people like you” reads, on map pins and in “From your people” on other people’s screens, but only while your ratings are public and your match with that person is earned.
When you add a public rating, your followers get a notification naming the place and score, or a count if you rate several at once. This happens only while you show your ratings publicly. Private ratings are never announced.
Two ways to hold back
- Mark one rating Private. It’s hidden from everyone and left out of matching.
- Turn off Show my ratings publicly in Settings. People can’t browse a list of your ratings. They still shape your matches, and a match sees how closely your tastes agree. Someone you match with who watches their own match numbers change as they rate could work out that you rated a place, and roughly how close your score was to theirs. They can’t see the score itself.
We ask AI crawlers to skip people’s profile pages through robots.txt. They can still read restaurant pages, which show public reviews, and our public marketing pages. Search engines can still index public pages, and we can’t recall copies once they exist.
3 Who we share it with
These companies process data only on our instructions, under a contract, to run more plz. Some get your IP address and device details simply because your browser loads their code. We don’t use advertising or cross-site tracking. more plz is built for people in the United States and isn’t offered in the EU, EEA or UK. Your data is processed here and by these companies in the United States.
| Company | What it does | What it receives |
|---|---|---|
| Supabase | What it doesDatabase, sign in and a cache of place photos | What it receivesEverything in your account: profile, ratings, lists, follows, preferences |
| Vercel | What it doesHosting, cookieless page analytics and speed measurements | What it receivesIP address, device and browser details, pages visited, page speed |
| PostHog | What it doesProduct analytics and error reports | What it receivesPages and features used, device and browser details, error reports. IP addresses are discarded |
| Resend | What it doesSending our emails, and receiving the ones you write to us | What it receivesYour email address, the message, and delivery status. Mail you send to our addresses passes through Resend on its way to our team inbox |
| What it doesMaps and Places: restaurant search, place details, photos and map display | What it receivesIP address and device details when a map or place photo loads; your search text when you search for a place | |
| Anthropic | What it doesTags restaurants with moods, like cozy or lively, from public reviews | What it receivesThe text of public reviews, without names. Under their commercial terms, they don’t train on it |
| GitHub | What it doesStores our encrypted nightly database backups | What it receivesAn encrypted copy of the database. The stored copy is encrypted and only we hold the key |
| Cloudflare | What it doesTurnstile, which checks that sign in and signup forms are used by a person | What it receivesIP address, TLS fingerprint and user agent when a form loads |
We may also disclose data when the law requires it, or to protect people from harm. If we are ever sold or merged, your data goes with the service and this policy keeps applying.
4 Cookies and analytics
Cookies we need
Cookies keep you signed in, remember that you finished onboarding, remember your privacy choice, and protect forms. Without them more plz doesn’t work.
Analytics
We measure how more plz is used with PostHog and Vercel. PostHog loads only after you sign in, and stores an ID in your browser. Vercel’s analytics run for everyone unless you opt out, and use no cookies. Before you sign in, no other analytics code loads. Our own server counts a few anonymous actions, like which sections you view, under a random ID in a cookie that is never linked to an account, and passes them to PostHog without your IP address or location. We use this to fix things and decide what to build.
Session replay
We don’t record session replays of your screen. If we ever turn them on, we’ll update this policy and tell you first.
Do Not Track and Global Privacy Control
If your browser sends Global Privacy Control or Do Not Track, we turn analytics off. Security logs, rate limiting and the logs our host keeps run regardless, because they protect the service.
Privacy choices
You can turn analytics off yourself. Use the “Analytics and session replay” switch in Settings, or the Privacy choices link here, at the bottom of our public pages and in Settings. No account needed.
5 How long we keep it
We keep data only as long as it’s useful. Here is the schedule.
| Data | Kept for | Then |
|---|---|---|
| Account data: profile, ratings, lists, follows, preferences, matches | Kept forUntil you delete your account | ThenDeleted immediately when you delete your account |
| Emails we sent you | Kept for90 days | ThenThe address, subject and contents are removed. A record of which emails were sent (type, status, dates) stays with your account so nothing is sent twice |
| IP address and device details saved with a click on a restaurant’s reserve link | Kept for90 days | ThenThe IP address, device details and session ID are removed. The click itself stays, as a count |
| Product analytics in our database | Kept for13 months | ThenDeleted |
| Security logs (IP address, account ID, what happened) | Kept for90 days | ThenDeleted. Kept up to 90 days after you delete your account, for security |
| Security alerts we resolved | Kept for90 days | ThenDeleted. Open alerts stay until we resolve them |
| Rate limit counters | Kept forWhile the limit window runs | ThenDeleted 1 hour after the limit window ends |
| Verification codes and download records | Kept forUp to 2 days | ThenDeleted. A code works for 10 minutes; the record of a download only enforces the daily limit |
| PostHog events | Kept for12 months | ThenDeleted automatically |
| Your PostHog data after you delete your account | Kept forUp to 30 days | ThenWe ask PostHog to erase it. They do it in a batch |
| Encrypted database backups | Kept forUp to 7 days | ThenDeleted on schedule, so a deleted account can sit in a backup for up to a week |
| Logs at Resend and Vercel | Kept forTheir own schedules | ThenDeleted by them |
Group picks
If you use a group pick link, the group and everything in it, including everyone’s picks, is deleted 30 days after the group closes. If you delete your account, we remove you from your groups right away. Guests who join a group without an account can’t export their picks. When a group locks in a result, the result card keeps the first names of the people it named until the group is deleted (up to about 37 days), even if one of them deletes their account.
6 Your rights
Everyone gets these, wherever you live.
- Download. Settings, then Your data, then Download my data. You get your account as one JSON file. Security and safety records, short-lived counters, and caches we can rebuild aren’t in it.
- Correct. Change your handle in Settings. For your name or anything else, email privacy@moreplz.com.
- Delete. Delete your account in Settings. Deletion is immediate and can’t be undone. There’s no grace period.
- Your profile, ratings, lists and matches are deleted right away.
- We ask PostHog to erase your analytics data. They finish within 30 days.
- Places you added stay, with no name attached.
- We keep a record that an account was deleted, with no name or email on it, so the erasure sticks. You get an email to confirm the deletion.
- Backups and vendor copies clear on the schedule above.
- Opt out. Turn analytics off, as described above. Optional emails have an unsubscribe link where you choose what you get. Service emails, like sign in codes and security notices, always send.
You can also email privacy@moreplz.com with any request. We verify it comes from your account’s email address, and answer within 30 days. We don’t treat you differently for using any of these rights.
Appeals
If we turn down a request, reply to our answer and ask us to look again. We answer within 45 days. If you still disagree, you can contact your state attorney general.
California
We do not sell or share personal information, as California defines those terms. In the last 12 months we collected these categories:
- Identifiers, like your name, email address, handle and IP address.
- Internet activity, like the pages you view and features you use.
- Geolocation, rounded to an area about 11 km wide.
- Inferences, like your taste archetype and your matches.
- Dietary preferences, if you choose to add them.
Authorized agents
You can ask someone to make a request for you. We’ll ask for your signed permission and confirm with you.
7 Security and children
Security
We protect your data with encryption in transit, access controls and encrypted backups. If a breach affects you, we’ll tell you as the law requires.
Children
more plz is for people 16 and older. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 16. If we learn we have, we delete the account and its data. Parents can email privacy@moreplz.com.
8 Changes and contact
If we change this policy in a way that matters, we’ll tell you by email or in the app before it takes effect. The date at the top always shows the current version.
Questions or requests: privacy@moreplz.com.
more plz is operated by Makeshft Inc.
Makeshft Inc
447 Sutter St, Ste 506 - 1383
San Francisco, CA 94108