Privacy Policy

Effective 19 October 2026

Ketchup is a food diary you share with friends. To run it, we need to know a few things about you. This page explains which data that is, why we have it, who we share it with and how long we keep it.

In short

  • Your visits and ratings are visible only to friends you add yourself. Private visits are visible only to you.
  • We don’t sell your data and don’t use it for advertising or for tracking you across apps.
  • We use your location only while the app is open and only if you allow it. We don’t store your location history.
  • You can delete your account at any time in the app or on the web.

1. Who processes your data

The data controller is:

Eliathos s.r.o.
Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic
Company ID 23402491, registered in the Commercial Register kept by the Municipal Court in Prague, Section C, Insert 426513
Email: podpora@ketchup-app.cz

We have not appointed a Data Protection Officer as we are not required to. For anything related to your data, write to the email above.

This policy covers the Ketchup mobile app for iOS and Android and the website ketchup-app.cz.

2. What data we process and why

Account and profile

What
Name or nickname, email, profile photo, the city you choose to show. If you sign in with Apple or Google, we receive an account identifier and email from them (with Apple, possibly a private relay address).
Why
To create your account, sign you in and show your profile to friends.
Legal basis
Performance of a contract, i.e. the Terms of Use (Art. 6(1)(b) GDPR).
How long
Until you delete your account.

Visits, ratings and photos

What
Places you log, visit dates, ratings for food, service and atmosphere, your answer to “Would you go again?”, texts, photos, comments, reactions, your “Want to try” list and visibility settings.
Why
This is what Ketchup is: your diary, shared with friends.
Legal basis
Performance of a contract (Art. 6(1)(b) GDPR).
How long
Until you delete them or your account.

Friends

What
Friend requests you sent, who accepted them and who you blocked.
Why
So your content is shown only to people you allow.
Legal basis
Performance of a contract (Art. 6(1)(b) GDPR).
How long
Until you remove the connection or delete your account.

Location

What
Your device’s precise location, only while you use the app and only if you allowed location access on your phone.
Why
To show where you are on the map and suggest nearby places when you log a visit. We don’t store your movements. For a visit we store only the place’s address and coordinates.
Legal basis
Your consent, given through your phone’s permission prompt (Art. 6(1)(a) GDPR). You can withdraw it at any time in your phone settings; Ketchup keeps working without location.
How long
Only while the feature is in use.

Camera and photo library

What
Only photos you take or pick from your library. We have no access to your other photos. We don’t need or ask for access to your contacts.
Why
So you can add photos to a visit or your profile.
Legal basis
Performance of a contract (Art. 6(1)(b) GDPR). You grant camera and library access in your phone settings.
How long
Uploaded photos are kept until you delete the visit or your account.

Notifications

What
A device token used to deliver notifications (push token).
Why
To let you know about friend requests or comments on your visits.
Legal basis
Your consent, given by allowing notifications on your phone (Art. 6(1)(a) GDPR).
How long
Until you turn notifications off or delete your account.

Technical and diagnostic data

What
Device model, OS and app version, error and crash reports, IP address and request time in server logs.
Why
To keep the app secure, detect abuse and fix bugs.
Legal basis
Our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).
How long
Up to 90 days.

Reports and moderation

What
Who reported what and why, our decision and any appeal against it.
Why
To remove content that breaks the rules or the law and to document how we handled it.
Legal basis
Compliance with a legal obligation under the Digital Services Act (Art. 6(1)(c) GDPR) and our legitimate interest in a safe community (Art. 6(1)(f)).
How long
Up to 3 years after the case is closed.

Support emails

What
Your email address, your message and our reply.
Why
To handle your question or request.
Legal basis
Performance of a contract and our legitimate interest (Art. 6(1)(b) and (f) GDPR).
How long
While we handle it, then up to 3 years in case of legal claims.

The ketchup-app.cz website

What
IP address, browser type and the page you visited in the hosting provider’s logs. The website uses no cookies and no analytics or advertising tools, and it serves fonts and scripts from its own server.
Why
Security and operation of the website.
Legal basis
Legitimate interest (Art. 6(1)(f) GDPR).
How long
According to the hosting settings, usually a few days and no more than 30 days.

We don’t carry out automated decision-making or profiling that has legal or similarly significant effects on you.

3. Who sees what you share

4. Who we share data with

We don’t sell data. We share it only with providers who help us run Ketchup, and only as much as they need. All of them have a data processing agreement with us or are directly bound by the GDPR.

We’ll send you the current list of specific providers on request. We may also disclose data to public authorities where the law requires it.

5. Transfers outside the EU

Some providers (such as Apple, Google or Vercel) are based in the United States. We transfer data to them only with GDPR safeguards in place, i.e. under the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

6. Deleting your account

Delete your account in the app under Profile → Settings → Delete account, or follow the steps on the Delete your account page. We remove your profile and all your content within 30 days, and from backups within a further 30 days. We keep only what we must by law or to defend legal claims (for example moderation records).

7. Your rights

You have the right to:

Just write to podpora@ketchup-app.cz, ideally from the email linked to your account. We’ll reply within one month.

If you believe we don’t handle your data properly, you can lodge a complaint with the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority in your country. We’d appreciate it if you contacted us first.

8. Age

Ketchup is for people aged 15 and over. If we learn that an account belongs to someone younger, we will delete it.

9. Security

Communication between the app and our servers is encrypted (HTTPS/TLS), access to data is limited to the few people who need it, and passwords are never stored in readable form. If a breach ever put you at risk, we would let you know.

10. Changes to this policy

We may update this policy, for example when we add a new feature. We’ll tell you about significant changes in advance in the app or by email. The effective date is always shown at the top.

This English version is a translation. If it differs from the Czech version, the Czech version prevails.