Your space.Your choices.
Keila remains usable without an account. An account and syncing are optional. No advertising, audience measurement tools or cross-app tracking are integrated.
Who is responsible
Keila is published by Thomas Cohen, a sole trader, at 8 chemin des Hauts Graviers, 91370 Verrières-le-Buisson, France. He is responsible for the processing described on this page. For questions about your data: thomas@keila.app.
No advertising or tracking
Keila displays no advertising, does not read your iPhone’s advertising identifier and includes no audience analytics, cross-app tracking or crash-reporting tools. Your data is not sold, rented or shared with advertisers or data brokers.
Why is data processed?
Places, saved lists, accounts, syncing, reviews, profiles, group meals and updates provide the services you use. Location, dietary-preference syncing, iPhone alerts and learned preferences depend on your consent, which you can withdraw at any time. Moderation, feedback review and protection against abuse serve the legitimate interest of maintaining a reliable catalogue and a safe service.
Minimum age
Keila is intended for people aged 15 and over. If you are under 15, do not create an account, publish reviews or enable a public profile without a parent’s consent.
Sign-in and your private account
Supabase manages your sign-in session and account identifier. Email sign-in uses your address and a one-time code. With Apple, Apple provides an identifier specific to Keila, your email or a relay address if you hide yours, and, on your first sign-in, the first name you agree to share. That name is stored in your account so it can be suggested; it remains optional and editable. Signing in alone does not activate data syncing. Your synced Notebook is private and unavailable to other users.
Synced favourites and preferences
Your favourites and their public summaries remain available on your device. Once enabled in Account and backup, their identifiers and saved dates are synced together with your first name, cuisines, indicative budget and usual neighbourhood. Restaurant summaries come from places published by Keila. Offline changes may remain pending; their status appears in Account and backup. Adding places saved without an account to your account is an explicit choice.
Optional personalisation
Dietary preferences may reveal beliefs. Keila does not ask your religion. Using them on this device requires your consent. Saving them in your private Supabase account then requires separate consent through Include my requirements in Account and backup. You can stop this syncing without deleting your choices on this phone, or delete your requirements under My preferences, Dietary requirements. Your favourites remain independent.
Preference storage
On iPhone, dietary preferences and the discovery profile are stored locally in the iOS Keychain with device-bound protection. Guest and account spaces are separate. A local marker prevents an old profile from being automatically restored after a normal reinstall. The web preview uses browser local storage. If you enable syncing, a copy of the selected data is also saved in your private Supabase account. Your requirements are not sent to map providers or included in feedback sent to the team.
Learned preferences
Disabled until you enable it in My preferences, Learn from what I view records listings opened for more than a few seconds, with a capped duration, and menus viewed, alongside your favourites, Notebook and reviews you write. Keila derives cuisines, neighbourhoods and price ranges that only move places up the list, never your requirements or filters. This history remains in local storage on this device, separated by account and limited to 500 views less than six months old. It is neither synced nor sent. Forget my history deletes it immediately.
Group meals
A meal records its organiser, title, suggested places, responses and participants’ optional first names. Dietary criteria you use to suggest three places directly stay on your device. When you first ask the group about their needs, the meal is saved in Supabase with its area, date, budget and the organiser’s search filters, including any dietary criteria; each participant specifies their diet, kosher requirements, accepted organisations, cooking requirements, budget and an optional first name. People with the link see first names and the response count; only the organiser receives detailed needs, without knowing who gave each answer. With an account, a participant can find their response across devices. Without an account, a private random token lets them edit their response from the same browser or device; it does not prove identity and may be lost when storage is cleared.
Public reviews and moderation
If you publish a review, Supabase stores your rating, comment, optional criteria, confirmed public first name, agreement to the rules and dates. You can add a dish, your budget per person and up to four photos. Photos are resized, re-encoded and stored privately; they follow the review’s moderation. An already loaded link may remain valid for five minutes after removal. A review is published on submission. An automatic filter detects insults and hate speech in the first name, comment and dish: the affected review remains visible only to you until it is reviewed, with the filter reason retained. Held reviews and photos are first checked by artificial intelligence (Anthropic): three independent assessments, with the majority deciding. If they disagree, or if the review discusses kashrut, the team reviews it itself. Each AI decision is logged with its reasons and can be reversed by the team. After the team removes a review, any new version for that address, even after deletion, is also reviewed before becoming public. Other users receive neither your email nor your sign-in identifier. A separate author identifier lets them hide your reviews. You can find, edit and delete your reviews in your profile under My reviews.
Profiles and shared lists
The social profile is optional. Its name, introduction and photo appear to anyone opening your link or scanning your code; your lists and reviews appear only if you share them. Visible from your reviews allows your profile to be opened from your reviews. Existing favourites are not automatically published. Following is stored in Supabase; no contact list is imported. Your follower and following counts are visible on your profile; their lists are visible only to you. On a profile, Keila may show which people you follow also follow it. Scanning a code uses the camera with your permission only to read the code: no image is taken or kept. Your email address, dietary requirements and location are not shown on the profile. Profiles can be reported and people blocked. Private means invisible to other users, not to the Keila team: when needed for moderation, support or service improvement, the team can view your profile, reviews, followers and following, your lists including private ones, meals you join and the neighbourhoods these reveal. Its administration screens never display your email address.
Your profile photo
You choose a photo from your photo library when you wish. It is resized and re-encoded before being uploaded to private Supabase storage. Access uses a temporary five-minute link. If you hide your profile, an existing link may remain valid until it expires. An old photo is deleted after replacement when the network allows; remaining photos are removed before the account is deleted.
Menu photos
During a meal, the Take a photo of the menu game uses the camera with your permission. A dish is selected at random on your phone: Keila does not read the photo, and it does not leave your device until you choose Send to Keila. Sending requires an account and your explicit agreement: you confirm that no faces appear and authorise Keila to display the photo to present the restaurant’s menu. Before upload, the photo is reduced and re-encoded as JPEG, without its location or other metadata. It is stored privately in Supabase with the place, your account identifier and the date, then checked before publication, first by artificial intelligence (Anthropic), then by the team if there is doubt. AI may transcribe an accepted photo into a list of dishes and prices, kept as a draft until reviewed by the team. It says nothing about the place’s kosher status and cannot change a listing on its own. Uploads are limited to six per day. A rejected photo is deleted during review. If you delete your account, a submitted photo remains because you authorised its display, but it is no longer linked to you.
Reports and blocked people
A report’s reason and details are private and accessible to the team to resolve the issue. A report is first examined by artificial intelligence (Anthropic), together with the review and its photos; the team decides when AI is uncertain and can overturn its decision. Hiding an author applies to your account and can be undone from your profile under Settings and help. Repeated requests are limited through account-linked counters, without recording location. External ratings do not involve importing review text or the profiles of their authors.
News and notifications
Group responses and new activity made visible by people you follow may appear in Your news. You can turn off each category. The after-meal reminder stays disabled until you choose it; it is scheduled for 7 pm Paris time the next day after a visit recorded in the Notebook. Writing a review cancels it. iPhone alerts require separate agreement and iOS permission. They use the notification token your iPhone receives from Apple, stored in Supabase with a randomly generated installation identifier, and are delivered through Apple’s notification service. They may include the displayed first name of someone you follow or who follows you, a place name or a meal title; never your requirements or a postal address. Deliveries are limited to five per day, including two social updates, between 9 am and 10 pm Paris time; only group-meal alerts (voting open, votes, chosen table) are also sent at night.
Search and location
Search text and filters are processed in the app. At your request and with permission, location is used to sort nearby places or suggest a usual neighbourhood. Precise location is not recorded in the Notebook or sent to Supabase. Only the neighbourhood you choose may be saved in your profile and synced if you enable this feature. To offer games when you are at the table, Keila keeps, on your phone for three hours, listings you opened and places you called from Keila (the place and time, nothing else); if you already allowed location access, your location is read on the phone when you open Explore at a mealtime, and never leaves it. You can withdraw location permission in iOS settings.
Around you: zones on your iPhone
Around you remains off until you enable it under Profile, Notifications: three separate switches, At the table, After a meal and To try nearby. When enabled, it requests Always location permission on your iPhone. Keila does not follow your route: your iPhone only monitors zones of 100 to 150 metres around up to 20 places you selected (a listing opened or place called from Keila in the last three hours, or your To try list), and wakes Keila when you enter or leave. Your phone stores the list of these places with their names, coordinates and hours, the time you entered a zone while you remain there, and the times of the latest scheduled notifications to maintain the intervals between them. The phone schedules notifications itself. None of this is sent to Keila, Supabase or another provider: neither your location, your arrivals and departures, nor whether a notification was displayed. Turning off all three switches stops monitoring and cancels scheduled notifications; you can also withdraw Always location permission in your iPhone settings.
Maps and links
The map uses MapLibre and OpenFreeMap tiles on iPhone and the web, based on OpenStreetMap data. Loading it involves technical exchanges with the map provider, including your network address and the displayed area. Your dietary profile is not shared with it. If you open directions, a website or a call, the chosen application receives the information needed for that action and applies its own privacy rules.
Loading photographs
Photos of places are hosted in particular on Supabase. Other images may come from the hosting provider specified by their source. The host receives necessary technical data, such as your network address and the requested image address. Your preference profile is not part of this image request. Official menus and galleries opened at your request are also governed by the rules of the website you visit.
Suggestions and corrections
Feedback contains your message, the place’s details, an optional link and, only if you provide it, your email address. The Keila team accesses it to review your feedback and reply if needed. The content is not public. The feedback anti-abuse system uses a fingerprint of your network address and frequency counters, separate from your message.
Providers and transfers
Keila relies on four providers. Supabase hosts places, accounts, synced Notebooks, reviews and their photos, menu photos, profiles, group choices, news and feedback in its London region in the United Kingdom. The United Kingdom benefits from a European Commission adequacy decision: its level of protection is recognised as equivalent to that of the European Union. Supabase may also access this data from the United States and Singapore to operate its service; these transfers are governed by the European Commission’s standard contractual clauses. Apple provides Sign in with Apple and delivery of iPhone alerts; Apple processes this data under its own privacy commitments. OpenFreeMap provides map tiles. Anthropic provides AI that assists moderation: it receives only what needs to be checked (the text of a held or reported review, the displayed first name if relevant, report details, review and menu photos, and the place name), never your email or account identifier. Anthropic processes this data in the United States under the European Commission’s standard contractual clauses and does not use it to train its models. Each provider receives only what is necessary for its role and undertakes through its terms to protect this data. These providers also retain technical logs under their own rules.
How long we keep your data
Your account, first name, synced Notebook and tastes, synced dietary preferences, profile, follows, reviews and their photos are kept until you erase them or delete your account. An accepted menu photo is kept as long as it serves to present the place’s menu; a rejected photo is deleted during review. An account with no sign-in for three years is deleted together with everything linked to it; you can also write to us to delete an unused account sooner. A meal stops accepting responses after seven days. The meal is then automatically deleted, together with its responses, votes, first names and related news, 30 days after its date; if it has no date, 30 days after it closes, or 37 days after creation. Deleting the organiser’s account removes it earlier, and a signed-in participant’s response also disappears with their account. News expires after 30 days and reminders after seven days, then they are deleted within the following week. A notification token is no longer used after 60 days without an update and is deleted after 90 days. Feedback is deleted 90 days after closure. Anti-abuse fingerprints and counters are deleted after two days. Moderation AI votes and reasons are deleted 180 days after the decision. Deleting your account also deletes your contributions, reports and related moderation data.
Exercising your rights
You can access your data, have it corrected or erased, receive a copy in a machine-readable format, object to processing or request its restriction, and withdraw consent at any time. From your profile, you can already change your first name and preferences, turn off backup, erase your dietary requirements or Notebook, delete your reviews and delete your account. For anything else, write to thomas@keila.app with a feedback reference if you have one: you will receive a response within one month. You can also lodge a complaint with the CNIL at cnil.fr.
A question, an error, a place?
Write to us. We read your messages.
thomas@keila.appHelp & contactOur methodLegal noticeUpdated on 13 October 2026