Privacy

Last updated: 27 October 2026

client.food is a beta tool that recommends Toronto venues for coffee, breakfast, lunch and dinner meetings. This page explains what information the tool handles and what we do with it. We aim to follow the principles of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

No accounts or saved search history

client.food does not require an account, does not use a database, and does not keep a history of your searches. Searches are processed in server memory. IP rate-limiting records and error logs are described below.

What you enter and where it goes

To generate recommendations, you enter two starting locations — yours and your client’s — along with meeting preferences such as meal type, budget, travel mode, cuisine and dietary preferences. Location information may include a selected place ID and coordinates. This information is sent to our server. In live mode, the server uses location, meal type, cuisine and travel mode for Google Maps Platform calls (the Places API, Routes API and Geocoding API) to find and evaluate venues.

When address suggestions are enabled, your browser loads Google’s Maps JavaScript API and Places services when the form opens. The characters you type in a location field are sent directly to Google to produce suggestions before you submit a search. Selecting a suggestion also requests its place ID, name, address and coordinates from Google.

Device location

We only request your device’s location if you press “Use my device location.” Your browser controls permission to provide it. This fills in your own starting point only — never your client’s. The coordinates are held in page memory and sent to our server when you submit a search; in live mode they are sent to Google to calculate travel times.

IP address and rate limiting

We use your IP address to limit how many searches can be made in a short period, which protects the service from abuse. The address, request count and window expiry are held in server memory. Expired entries are removed during later requests that trigger cleanup, or when the server instance ends; they can remain in memory while it is idle. Our hosting provider, Vercel, may retain request and application error logs under its own policies.

Server logs

Our server logs error details to help us debug problems. When a location lookup fails, the log records which field failed, not the text you entered. Other errors may include mapping-provider error text or exception details.

Cookies, analytics and advertising

Our application code does not include analytics or use advertising. During the private beta it sets one cookie, after you enter the beta password, so you stay signed in. It holds an expiry time and a signature, nothing about you, and lasts at most 30 days. We do not sell your information. Google’s services, when they load in your browser or when we call them from our server, are governed by Google’s own privacy policy.

Venue information

In normal operation, venue information shown in results comes from Google Maps Platform. A development mode uses a small fixed sample of Toronto venues instead, and says so under the results.

Retention

There is no application database or saved search history. IP rate-limiting records and error logs are exceptions to transient search processing, as described above. Google and Vercel may retain information they receive under their own policies.

Contact us

If you have questions about this privacy notice, contact us at contact@client.food.