Privacy Policy

Last updated: 27 March 2026

What Cora Collects

Cora collects the minimum data needed to give you personalised restaurant, bar, and cafe recommendations. This includes:

  • Account information — email address and name (via Sign in with Apple, Google, or email)
  • Taste profile — cuisine preferences, vibe preferences, and dietary requirements from onboarding
  • Reviews — ratings, occasion tags, noise levels, and optional notes you submit
  • Saved places — venues you bookmark
  • Search queries — what you search for (used to improve recommendations)
  • Location — approximate city-level location to show relevant venues (only when you grant permission)
  • Photos — venue photos you upload (stored securely, moderated before publishing)

How Cora Uses Your Data

  • To personalise your venue recommendations based on your taste profile and behaviour
  • To find “taste twins” — users with similar preferences whose reviews inform your results
  • To improve the recommendation algorithm over time
  • To detect your city and show relevant venues

Cora does not sell your data to third parties, use it for advertising, or share it with anyone outside the service.

Third-Party Services

  • Supabase — database and authentication (EU-hosted)
  • Anthropic (Claude) — natural language search parsing (queries sent, not personal data)
  • Google Places — venue photos, ratings, and opening hours
  • DeepL — translation of review content (text only, no personal data)
  • Apple / Google — authentication only

Data Storage & Security

All data is stored in Supabase (PostgreSQL) with row-level security policies. Authentication uses industry-standard OAuth 2.0 with PKCE. Photos are stored in Supabase Storage with access controls. All connections use HTTPS/TLS.

Your Rights

  • Delete your account — available in the app under Profile > Account. This permanently deletes all your data including reviews, saved places, taste profile, and photos.
  • Export your data — contact us at privacy@askcora.london
  • Opt out of location — deny location permission; the app still works with manual city selection

Children

Cora is not directed at children under 13. We do not knowingly collect data from children.

Contact

For privacy questions or data requests: privacy@askcora.london