Privacy Policy

Onymous is an AI answer engine visibility service for independent restaurants. This policy covers our public website, the free check on the homepage, and the owner application you sign into.

The company responsible for your data, the data controller in the language of European law, is [ENTITY TO BE CONFIRMED], called “Onymous”, “we” or “us” below.

This policy is part of the Terms of Service.

We hold what you type about your restaurant, what we observe about it, and enough about your account to sign you in and bill you. We send your restaurant name, city and state to Anthropic as part of the questions we ask their assistant. We fetch your website from our own servers and read it. We do not sell data, we do not run ads, and we do not track you across the internet.

The rest of this page is the detail behind those five sentences.

Grouped by what it is for. This list is written from the database schema, so it is the whole of it rather than a summary.

About the fingerprint, because it is the one that sounds worse than it is.

We do not store raw IP addresses for rate limiting. We take the IP address of the request, add a secret salt that never leaves our environment, hash the result with SHA-256, and keep the first 32 characters of that hash. The output is a meaningless string. We use it only to count how many sign-ups, failed sign-ins or free checks came from the same place in a short window. We cannot turn it back into an IP address, and we do not use it to build a profile of anyone.

Our hosting provider keeps its own server logs at the network level, and those do contain IP addresses. That is standard for any website and is covered in section 10.

To find out what assistants say about your restaurant, we have to ask them. There is no way around this and it is worth being exact about what leaves our systems.

Each question we ask goes to Anthropic’s commercial API. The question is a normal dining question, of the kind a diner would type. It contains your restaurant’s city and state, and depending on the question, its cuisine, one of its attributes, its signature dish or a nearby landmark you gave us. Questions about your restaurant by name contain your restaurant’s name.

We do not send Anthropic:

• Your email address, your name or your password hash.
• Your phone number, your street address or your postcode.
• Any billing information.
• Your findings, your scores, your activity log or anything else we have concluded about you.
• Anything at all about any other customer.

Some of the engines have web search enabled, because an assistant that can search is measuring something different from one answering from memory. When an engine searches, the search terms it chooses go to Anthropic’s search provider as part of that call.

Anthropic is a subprocessor. What they do with API traffic is governed by their own terms and privacy policy, not by this one. As at the effective date of this policy, Anthropic’s commercial terms state that inputs and outputs from commercial API traffic are not used to train their models. We rely on that, we do not control it, and if it changes we will update this section and tell customers.

For counsel: The sentence about Anthropic not training on commercial API traffic needs to be checked against their terms as they stand on the day this publishes, and ideally softened into a reference rather than a restatement. It is the one claim on this page about someone else’s behaviour.

The product supports other providers, and if we ever enable one for your account we will name it here first. Today the only assistant provider we send anything to is Anthropic.

When you give us your website address, our servers request that page and parse its HTML. This is how the product knows your menu is published as a picture, or that your site carries no structured data, instead of guessing from what you typed.

• We identify ourselves as OnymousBot, with a contact address in the request.
• We read only what any public visitor could read. We do not sign in and we do not submit forms.
• We follow at most three redirects and re-check each one.
• We refuse addresses that resolve to private or internal networks.
• We store what we found, the address we ended up at, and a plain-language note on how each conclusion was reached, so you can see why we think what we think.

If you would rather we did not do this, leave the website field empty. The product still works and simply produces fewer findings.

Your reports contain the names of other restaurants. Those names are in our database because an AI assistant said them in an answer to a public question that anyone could ask.

That is observed public output. It is not scraped from private systems, not bought from a data broker, and not taken from any other Onymous customer. If a restaurant near you is also a customer, nothing from their account reaches yours and nothing from yours reaches theirs.

We hold nothing about those businesses beyond a name, the week it was named, and how many times. If you run one of them and would like that record removed from our system, email us and we will remove it.

The check on the homepage runs without an account. When you use it we store the restaurant name, city, state and cuisine you typed, the results we got, and a hashed client fingerprint for rate limiting. The result gets a shareable link, so treat that link as public.

If you then enter an email address to receive the result, we store that address against the check. Today that records interest and nothing more: no email is sent, and you are not subscribed to anything.

You can ask us to delete a free check and its email at any time. Send us the link, or the restaurant name and city, at hello@useonymous.com.

• We do not sell your data. Not to data brokers, not to platforms, not to anybody, for money or for anything else.
• We do not share your data with anyone else for their own marketing.
• We do not run advertising anywhere in this product, and we carry no advertising or social tracking pixels.
• We do not use third-party analytics that follow you around the internet. There are none embedded in this site.
• We do not use one customer's data to inform another customer's report.
• We do not read your email, your point of sale, your bookings or anything we have not asked you for.

Under California law, sharing data for cross-context behavioural advertising counts as a “sale” even when no money changes hands. We do not do that either, so there is nothing for you to opt out of.

We use one cookie. It is called oh_session, it holds a signed session identifier, it is set only when you sign in, and it lasts thirty days or until you sign out. It is httpOnly, which means scripts on the page cannot read it, and it is signed so it cannot be forged.

There are no advertising cookies, no analytics cookies and no third-party cookies. That is why this site has no cookie banner: a cookie strictly necessary to sign you in does not need consent, and we do not set any other kind.

These are the companies that touch your data in order for the service to work. We will update this list before adding another one.

For counsel: Data processing agreements are not yet in place with any of these providers beyond accepting their standard terms. If any customer is in the EU or the UK, that gap matters and should be closed before launch.

Our database and our application run in the United States. If you are outside the United States, using Onymous means your data is transferred to and processed in the United States, where privacy law differs from your own.

The product is built and sold for restaurants in the United States. If we begin selling elsewhere, this section and the section on your rights will be rewritten properly rather than stretched.

• Your account and everything attached to it: for as long as the account exists.
• After you ask us to delete your account: we delete it, and everything that belongs to it, within thirty days.
• Billing records: we keep the minimum needed for tax and accounting after an account closes. That period is set by law and is longer than thirty days.
• Free checks run without an account: we intend to keep these for twelve months and then remove them.
• Rate limiting records and hashed fingerprints: these are short-lived counters and are only useful for hours.

To be straight with you: automatic expiry of old free checks and old rate limiting rows is not built yet, so those rows currently sit in the database until someone removes them. If you want yours gone before then, ask and we will remove them. We would rather write that down than describe a cleanup job that does not exist.

For counsel: The retention schedule above is a commitment the product cannot yet keep automatically. Either the purge job ships before launch or this section stays worded as an intention plus an on-request guarantee, as it is now. The statutory billing retention period needs a real number from an accountant.

Wherever you live, we will honour all of the following. We are not going to make you prove you live somewhere with good privacy law.

• Access: ask us what we hold about you, and we will tell you.
• Export: ask for a copy of your account data in a machine-readable file, and we will send you one.
• Correction: tell us something is wrong and we will fix it. Most of it you can also edit yourself in settings.
• Deletion: close your account yourself in Settings, under Your account. Everything belonging to it comes out of the running product immediately and out of the backups within thirty days. We keep only the billing records the law requires.
• Objection and restriction: tell us to stop a particular use of your data, and we will stop it or explain why we cannot.
• No retaliation: exercising any of these rights will never get you worse service or a worse price.

To exercise any of them, email hello@useonymous.com from the address on the account. We will confirm within a few days and finish within thirty. There is no charge, and we will not ask you to fill in a form to make it tedious.

Deletion is self-serve: Settings, Your account, Close your account. It asks for your password, cancels your subscription first so nothing keeps being charged, and then removes your restaurants, your questions, every weekly result, your score history and every finding. Export is still handled by a person, so email us for that one.

For counsel: Self-serve deletion ships in this build and cancels the subscription before deleting, refusing the deletion if the cancellation fails. Export is still a manual process with no endpoint behind it. The thirty day backup window and the response deadlines here should be checked against CCPA and GDPR before this is published.

If you are in the European Economic Area or the United Kingdom, our legal bases are: performing our contract with you, for everything needed to run the service; our legitimate interests, for security, abuse prevention and keeping the service working; and your consent, for the free check email. You also have the right to complain to your data protection authority, though we would rather you told us first and gave us the chance to fix it.

If you are in California, you have the right to know, to delete, to correct, and to opt out of the sale or sharing of personal information. We do not sell or share it, so there is nothing to opt out of, and the other three are covered above.

• Passwords are stored as salted scrypt hashes, never as text, and cannot be read back by us or by anyone who obtained the database.
• Session cookies are httpOnly and cryptographically signed, and the application refuses to run in production without a real signing secret.
• Sign-in attempts are rate limited per account and per caller, and error messages never reveal whether an email address has an account.
• Every database query is scoped to the owner, so one account cannot read another's data.
• Server-side fetches of customer-supplied addresses are blocked from reaching private networks, checked on the resolved address and re-checked on every redirect.
• Traffic is encrypted in transit, and the database connection is encrypted too.

No system is perfectly secure and anyone who tells you otherwise is selling something. If we ever have a breach that affects your data, we will tell you what happened, what was affected and what we are doing about it, without undue delay and without waiting for a lawyer to make it sound better than it was.

Onymous is a business service. It is not for children, it is not directed at them, and we do not knowingly collect anything about anyone under 18. If you believe a child has created an account, tell us and we will delete it.

We can update this policy. When we do, the revised date at the top of this page changes.

For a change that materially affects how we handle your data, we will post a notice in the app and at the top of this page at least fourteen days before it takes effect, and where email delivery is enabled for your account we will email you too. Adding a subprocessor counts as a material change and will be announced the same way.

Email hello@useonymous.com. A person reads it. That is the address for data requests, for questions about anything on this page, and for telling us we have described the product wrongly.

Written notice can also go to [NOTICE ADDRESS] once the entity is confirmed.