Your dining history is personal data: the case for a private restaurant tracker

September 17, 2026 · 3 min read

Think about what a complete record of your dining life actually contains.

Where you eat reveals where you live and work, down to the block. When you eat reveals your schedule. Who you eat with sketches your relationships; a recurring table for two says more than most text messages. Changes in the pattern — new neighborhood, new dietary restrictions, a sudden run of solo dinners — narrate your life with uncomfortable fidelity.

A restaurant diary is one of the most intimate datasets you can generate. And the default way we generate it is inside social apps whose business depends on collecting it.

The trade you’re offered

To be clear: social dining apps aren’t villains, and the trade they offer is legible. You give them your dining history and your social graph; you get leaderboards, friend feeds, and taste-matching in return. For plenty of people that’s a good trade, made with open eyes.

But it should be a choice, and for a long time it wasn’t — because the alternative barely existed. If you wanted shelves, ratings, and a map for your restaurant life, you accepted an account, a feed, and a server that sees everything. The tracking came bundled with the being-tracked.

What “private by design” means concretely

It’s worth being precise, because “we care about your privacy” appears in every app’s marketing. A privately-designed tracker has structural properties, not promises:

• No account. Nothing to sign up for means no identity to correlate, no email to leak, no password to reuse.
• No server that sees your data. Not “encrypted in transit,” not “we don’t sell it” — no server of the developer’s involved at all. Your data goes from your phone to your own iCloud and back. The developer couldn’t read your list even under subpoena, because they never had it.
• No analytics or tracking SDKs. The app doesn’t phone home about how you use it.
• A full export, any time. Your data as a JSON file, yours to keep, back up, or walk away with. Privacy without portability is just a nicer cage.
• Deletion that means deletion. Remove the app and its iCloud data, and the record ceases to exist — everywhere.

This is GoodEats’ actual architecture, not its aspiration — the app stores your places, ratings, dish notes, and visits on-device and in your personal iCloud database, which only your Apple ID can open. Even the menu scanner runs entirely on-device using Apple’s text recognition; menu photos never leave your phone. The App Store privacy label reads “Data Not Collected” because there is nothing collected.

The quiet benefit: honesty

A private diary changes what you write in it. When notes have an audience — even just friends — every entry is performance: would I publicly three-star the place everyone loves? Would I log the drive-through?

A private tracker gets the truth: the guilty-pleasure chain you actually crave, the acclaimed spot you found mid, the same taqueria eleven Fridays running. And a diary that contains the truth is the only kind that’s useful when you consult it.

Your dining history is a record of your life. You should have it. It’s not obvious anyone else should.

← All posts