Last updated November 5, 2026
Your meals, notes and photos are yours. Without a profile they live on your phone and in your own iCloud, and what reaches us is small and anonymous. With a profile, your places are kept with it, privately. Everything is described below.
Your restaurants, visits, dishes, ratings, notes and receipt photos are stored on your phone and backed up to your own iCloud account (Apple's private iCloud database, which only you can access). We can't see them. Apple's handling of iCloud data is covered by Apple's privacy policy.
Without a profile, deleting the app and its iCloud data (iPhone Settings → your name → iCloud) removes it.
A profile is optional. You create one with Sign in with Apple in Sottos → Settings. Apple gives us a random identifier for you, not your Apple ID. Your name (first and last, as you set it in your profile) and profile photo reach us only so your friends can see them (see Friends, below), and are deleted with your profile. If a friend is in your phone's contacts, Sottos shows them by the name you saved; that happens on your phone and nothing about your contacts reaches us beyond the scrambled numbers described below.
What we keep with your profile: your restaurants, visits and dates, the dishes and prices from your receipts, your ratings, and your notes. Receipt photos stay on your phone. If you turn on "Email me Sottos news", we also keep the email Apple shares (which may be a private relay address), only while that's on.
How we use it: to keep your places with your profile on any phone; to learn what you like and recommend places; and, combined with everyone else's, to rank dishes, understand restaurants and improve Sottos, including reading notes with automated tools to find common themes. We may share insights built this way with restaurants and partners, only as totals across many people, never your own ratings, notes or identity.
Friends: with a profile you can add friends, by sending your invite link, sending or accepting a request, finding them by name, or finding each other through phone contacts. Friendships are mutual and you can remove one any time; the other person isn't told. Friends see how you rate dishes (Must, Liked, Skip), your notes on dishes, the month (never the day), the restaurant, your name as you set it in your profile and your profile photo if you set one. They also see which of those places you're a regular at, but never how many times you've been. Friends never see your notes on visits or places, exact dates, prices, totals, receipt photos, or anything about your places that you haven't rated a dish at. No one else sees any of it. Your friends' favorite places are kept on your phone so they show quickly, and deleted from it when you sign out.
Finding people by name: other Sottos users can search for you by name and see only your name, your profile photo and how many friends you have in common, until you accept their request. You can turn this off in Friends ("Let people find me by name"); your link and your contacts work either way. Anyone with your invite link sees your first name, photo and how many places you'd share before they join.
Cheers: after a meal at a place a friend recommended or loves, you can send them a cheers: the restaurant's name, the day, an emoji and the line you write. Nothing else from your visit. They can send one emoji back. Cheers are kept on our server so your friend can see them, and deleted with your profile.
Blocking and reporting: you can block anyone, from their page or a friend request. You stop being friends, any requests and cheers between you are deleted, and they can no longer find you, send you requests or join through your link. They aren't told. Reporting someone blocks them too and tells us, so we can look into it; we keep who reported whom, and when, until we've dealt with it. You can unblock people in Friends.
Shared meals: you can send a meal to whoever you ate with, as a link. It holds the place, the day, the dishes, their prices, how you rated them and the total, and your visit note only if you turn it on; never your receipt photo. It's stored on our server so the link works, anyone with the link can see it, and it's deleted with your profile. Whoever opens it can add the meal to their own Sottos, with their own ratings.
Shared lists: with a profile you can make a list of places to send someone (a guide to your town, say). A list holds only what you put on it: the places, a dish, the kind of place, a price range and the lines you write for it. Never your notes, receipts, prices you paid or dates. It's stored on our server so its link works, and anyone with the link can read it. Editing a list updates the same link; deleting it, or your account, deletes it and the link stops working. To help you build a list, Sottos can interview you: what you type or say, the list, the places in your notebook for that town and the names and favorite dishes of places your friends love (never who they are) are sent to Anthropic, which provides the AI, only to write the list. We don't keep what you said, and Anthropic doesn't use it to train its models. How many times a list's page has been opened is counted.
Finding friends by phone: adding your phone number is optional. It's scrambled on your phone before it's sent, and we store only a further scrambled version, so friends who have your number can find you. When you look for friends in your contacts, your contacts' numbers are scrambled on your phone the same way and compared; we never receive or keep your address book. If you add a contact who isn't on Sottos yet, we keep only their scrambled number, for up to 30 days, so your request reaches them if they join. Once you've allowed access to your contacts, Sottos repeats this check at most once a day, so friends show under the names you saved for them.
Delete it any time in Settings → Delete Account: your profile and everything stored with it are deleted from Sottos. Your places stay on your phone.
1. Reading a receipt
When you add a receipt, the photo is sent through our service (hosted by Cloudflare) to Anthropic, whose AI model Claude reads the dishes, prices and totals. We don't store the photo. Anthropic processes it for us under its commercial terms, does not use it to train its models, and may keep it for a short period for safety monitoring as its terms describe.
To work out which restaurant a receipt is from, the app looks up the address printed on it in Apple Maps. If you allow location access, the phone may also use your location for this; it goes to Apple, not to us.
2. Anonymous usage counts
So we know whether Sottos is working, the app sends small counts: the app was opened, a receipt was added (how long it took, whether it added up, how many dishes, the currency), a dish was rated (only which of Must, Liked or Skip), a card was shared, a note was written, how you reached a place (search, the list or the map), and how friends features are used (an invite was shared or opened, a request was accepted, friends' dishes or a friend's page were viewed, and how many dishes on a receipt a friend had rated). They carry a random code created on your phone for this purpose, not linked to your name, Apple ID, device or anything you wrote. They never include restaurant names, dishes, notes or photos.
3. Contributed ratings
Sottos becomes more useful as more people rate: it can show the dishes people keep coming back for at a restaurant. For that, each dish you rate is also sent anonymously:
Never sent: your notes, photos, visit dates, other restaurants you've been to, your location, or anything that identifies you.
We use contributed ratings to show top dishes in the app and to understand restaurants and dishes (for example, which dishes are ordered again, and how prices change). We may share insights built from them with restaurants and other partners, only as totals across many people, never individual ratings.
The "Help Sottos improve insights" switch (Sottos → Settings → Privacy & Data) controls this. On: your ratings count towards top dishes and restaurant insights, never with your name. Off: nothing more is sent, and if you have a profile it's left out of rankings and insights too; you don't lose anything in the app. Anonymous ratings sent before you turned it off stay, because we can't tell which ones are yours.
4. Saving a place from another app
When you share a place to Sottos from Google Maps, Apple Maps or another app, Sottos reads the link on your phone and may open it to find the place's name. What you save stays on your phone until Sottos adds it to your places; nothing about it reaches us unless you have a profile.
Everything we receive is stored with Cloudflare in Western Europe. Usage counts are kept for up to 24 months. Contributed ratings are kept for as long as Sottos runs, since top dishes depend on them. Profiles, and what's kept with them (friends, cheers, shared meals and lists), are kept until you delete them. Scrambled numbers of contacts you invited are kept for up to 30 days, and reports until we've dealt with them.
We use a few providers, each only for what's described here, under contracts that require them to protect it: Cloudflare (hosting and storage), Anthropic (reading receipts and, if you use it, building lists) and Apple (Sign in with Apple, iCloud, Maps and app distribution). Some of them are based in the United States. Where data leaves the European Economic Area, it's covered by the safeguards the GDPR requires, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. We don't sell your data, and we don't use it for advertising or share it to track you across other apps or websites.
Data is encrypted on its way to us and stored with access limited to what Sottos needs to run. Phone numbers are stored only scrambled. No system is perfectly secure; if something went wrong that affected your data, we'd tell you and the authorities as the law requires.
Reading your receipts, and keeping your profile, are needed to provide what you asked for. Recommendations, combining data across people and sharing insights as totals rely on your agreement when you create a profile. Usage counts and anonymous contributed ratings rely on our legitimate interest in running and improving Sottos, with the anonymity and the off switch described above. You can withdraw your agreement at any time by deleting your profile. Sottos makes no decisions about you that have legal or similarly significant effects.
If the company behind Sottos or the Sottos business is sold or merged, the data described here, including profiles, may transfer to the new owner, who must keep to this notice. What's only in your iCloud doesn't move.
Under the GDPR you can ask to access, correct or delete your data, to receive a copy in a common format, to limit or object to its use, or to withdraw your agreement, and you can complain to the Spanish data protection authority (AEPD, aepd.es). With a profile, you can delete everything in Settings, or write to us for a copy. Anonymous contributions can't be traced back to you, so we can't find which are yours; the off switch in Settings stops them. Write to us at sottos@sanseadvisory.com and we'll answer within a month. If you live in the United States, you have the same choices: you can see, correct or delete your data the same way, and we don't sell or share it for advertising.
Sottos isn't meant for children under 16, and we don't knowingly collect data from them. If you think a child has created a profile, tell us and we'll delete it.
If this notice changes in a way that matters, we'll say so in the app before it takes effect. Using Sottos is also covered by our Terms of Use.