Privacy

Hungerli · 28 October 2026

Hungerli is a private app for a small group of friends to tell each other where to eat. It is run by one person, not a company, and it makes no money. That shapes everything below: there is no advertising, no analytics, no tracking, and nothing to sell.

What it stores

Only what you type into it:

• Your email address, and a password you choose. Sign-in is handled by Neon's managed authentication service; the password is stored hashed and the app itself never sees it.
• Your handle and display name.
• Your posts — which place, whether you would recommend it, an optional note, an optional photo, and when you posted.
• Your want-to-go list, and any lists you make — their names, your note on each, and which places are in them.
• Who you are friends with, and the invite codes you have made or used.
• Any post you report: which post it was and that it was you who reported it. The person who wrote it is not told.

That is the entire list. There is no address book access, no contact upload, no advertising identifier, and no third-party analytics or crash-reporting service in the app.

Location

If you allow it, the app asks your phone for your location so it can show places near you. The coordinates are sent with that search and used to sort the results. They are not saved — not against your account, not in a log, not anywhere. Refusing the permission costs you the nearby list and nothing else; search by name still works.

Photos

A photo you add to a post is uploaded to Cloudflare R2 storage through a small service that checks you are signed in first. Reading one back needs a signed-in token too, so photos are not public URLs that anyone with the link can open.

Where it lives

The database is Neon Postgres, hosted on AWS in Frankfurt (eu-central-1). Photos are on Cloudflare R2. Authentication is Neon's managed service. Those three companies process this data on Hungerli's behalf and for no other purpose.

Who can see your posts

Your friends, and nobody else. The database enforces this itself with row-level security rather than leaving it to the app to remember — a request for someone else's posts comes back empty even if the app asks for them. You become friends with someone by one of you using the other's invite link. There is no public profile and no search for strangers. The one thing you can put outside this is a list, and only by choosing to — see below.

Sharing a list

Each list has a Share switch, off until you turn it on. Turned on, that one list gets a link — hungerli.com/l/… — and anyone holding the link can read it without an account. Turn the switch off and the link stops working.

A shared list shows its name, your note on it, your display name, and for each place its name, address and location, your note on it, and the order you put them in. It does not show your posts, your photos, your email address, your handle, or who your friends are. Sharing is per list, not per account: your other lists are untouched.

The link holds a random identifier nobody can guess, but it is a link like any other — whoever you send it to can forward it, Hungerli does not record who opened it, and you are not told that they did. The page asks search engines not to index it, which is a request rather than a lock. Treat a shared list as something you have handed out rather than something you still hold. Behind the page the database connects as an account with no access to any table and permission to run exactly one query, which returns nothing unless that list's Share switch is on.

Reporting a post, and removing a friend

The ••• on someone else's post reports it. The post disappears from your feed straight away and we look at it; nobody else's feed changes, and the person who wrote it is not told who reported it. It cannot be undone from inside the app.

The ••• on someone's profile removes them as a friend. It works both ways at once — you stop seeing each other's posts and lists from that moment. The invite code that made the friendship stays spent, so being friends again takes a new one.

Deleting things

You can delete any of your own posts in the app, which removes it from your list and from your friends' feeds immediately.

You can also delete your whole account from the Profile screen. Your profile, posts, photos, want-to-go list and friendships are deleted at once, not queued — the database removes them together, along with your sign-in email and password, so nothing is kept that could identify you or let the account be used again. The one thing that outlives it is a venue you added to the map by hand, which stays, attributed to nobody, because other people's posts point at it.

If any part of that fails the app tells you what was left and privacy@hungerli.com will remove it by hand.

Children

Hungerli is not intended for children. You need an invite from an existing member to get in at all, which is how that is enforced in practice.

Changes

If this policy changes in a way that affects what is collected or who can see it, the app will say so before the change takes effect. The date at the top of this page is when it was last revised.