Privacy Policy
What we collect, what everyone else can see, and what we will never do with any of it.
Your display name, your handle, your profile page, and every take you publish are public.
Anyone on the internet can read them, signed in or not, and search engines will index them. That is the deal that makes this site trustworthy — no anonymous drive-bys in either direction — but it means you should pick a display name you are comfortable being seen under, and write every take knowing your name is on it permanently.
A plain-language summary of how we handle data, published so you can actually read it. It is not legal advice and no attorney has reviewed it on your behalf.
- Account information. Your email address, display name, and handle. Optionally a short bio and your home town. Passwords are handled by our authentication provider and stored hashed — we never see them.
- What you post. Your takes, the ten forced-choice answers behind them, your would-you-go-back votes, restaurants you add, saved lists, and reports you file.
- Messages you send us. If you use the contact form, we keep your name, email, subject, and message so we can answer and keep a record of corrections.
- Basic analytics and logs. Aggregate page views, referrers, approximate region, browser and device type, and standard server logs including IP address. We use these to keep the site up, spot vote manipulation, and decide which area opens next.
There is no paid tier, no subscription, and no billing on this site, so there is no card number, no billing address, and no payment processor holding anything of yours. Advertisers pay us directly and never receive member data as part of it.
- Your display name and your handle.
- Your profile page at /u/your-handle, including your standing.
- Every take you publish, its text, its visit date, and when you added it.
- Replies posted from a claimed restaurant account.
- Your email address.
- How you voted on whether you would go back.
- Your individual answers to the ten statements, which only ever appear pooled.
- Reports you file, including that you filed them.
- Messages you send through the contact form.
- What is on your saved lists.
Deleting a take removes it from public view. Backups may hold a copy for a limited period, and anything others have already quoted or archived elsewhere is beyond our reach.
- To run the service: publishing takes, computing scores, counting votes.
- To moderate: investigating reports, catching sockpuppets, enforcing the content policy.
- To answer you when you write to us.
- To send service email — password resets and security notices, plus anything you explicitly opt into.
- To understand aggregate usage so we can improve the site and plan where to expand.
- We do not sell personal information. Not to data brokers, not to advertisers, not to restaurants.
- We do not give a restaurant your email address, your IP address, or any identifying detail beyond what you chose to publish yourself.
- We do not tell a restaurant how any individual voted on whether they would go back, or which regular wrote which answer.
- We do not run third-party advertising trackers on this site.
- We do not sell or trade the contents of contact-form messages.
We use cookies and browser storage for one main purpose: keeping you signed in. Our authentication provider sets a session cookie and stores a token so you are not logging in on every page. There are a few small preference values too, like a dismissed notice. No advertising cookies. Blocking cookies is fine if you only read — you just will not stay signed in.
Supabase handles the database, authentication, and file storage — account records, takes, votes, and contact messages live there. Vercel handles hosting and content delivery, which includes standard request logs. That is the list. These providers process data on our behalf under their own terms; we share only what the job needs and we do not authorise them to sell any of it.
We may also disclose information if legally required, to respond to valid legal process, or where necessary to protect the safety of people using the service. If a subpoena seeks the identity behind a take, we will tell the account holder unless we are legally barred from doing so.
Account data lasts as long as your account. Published takes stay until you delete them or they come down under the content policy. Contact messages and moderation records are kept up to three years, because questions about a take resurface years later. Server logs roll off within about ninety days. Backups are on a rolling schedule and are eventually overwritten.
Ask us through the contact form and a person handles it. Deleting removes your profile, your email address, and your saved lists.
You choose what happens to your takes: delete them with the account, or leave them published with the author shown as a removed account. We keep a minimal record that an account existed, and why it closed if it closed for violations, so a banned account cannot be quietly recreated.
Depending on where you live you may have the right to access a copy of your personal information, correct it, delete it, object to or restrict certain processing, and receive it in a portable format. We extend the same handling to everyone regardless of location. To exercise any of it, write to us from the email address on the account through our contact page. We respond within 30 days, we never charge for a request, and we never degrade your experience for making one.
Sour Grapes is for adults. You must be 18 or older to hold an account, and we do not knowingly collect information from anyone under 18. If we learn that we have, we delete it. If you believe a minor has an account here, tell us.
Connections are encrypted in transit, passwords are hashed by our authentication provider, and access to production data is limited to the people who need it to run the service. No system is perfect. If a breach affects your information, we notify affected accounts and any regulator as required.
Sour Grapes is operated from the United States and data is processed here. If you use the service from outside the US, you are sending your information to the US, where privacy law differs from your home country’s.
When this policy changes materially we update the date at the top and give notice in the service. Continuing to use Sour Grapes after a change means the updated policy applies to you.
Privacy questions, access requests, and deletion requests all go through our contact page. Put “Privacy” in the subject line.
Last updated: August 21, 2026. See also the terms and the content policy.