Privacy Policy

Who operates DriveBite

DriveBite is operated as a UK sole-trader business. The proprietor, Chris Frimley, is the data controller for the information described in this policy. Our service address is:

If you have a privacy question, request or complaint, the quickest way to reach us is through the feedback in the DriveBite app, which is also linked from our Support page. You can also email us at support@drivebite.co.uk.

Location and journey data

DriveBite is a journey utility, so it needs somewhere to search from. Here is what that involves.

• If you allow current location, DriveBite receives your latitude and longitude so it can provide Nearby or On Route. You can refuse this permission and enter a location instead.
• Custom searches, such as a postcode, town, city or destination, are used for geocoding (turning text into a place) and routing (working out the journey).
• If you type a street address or other location text into a DriveBite location field, that text may be sent through DriveBite’s backend to Google Places Autocomplete to return UK address suggestions. This happens only to produce the suggestions you see while typing. DriveBite does not use Google Place Details for the selection flow, and the suggestion you choose is resolved through the same geocoding path as any other search.
• Up to five recent destinations are stored locally in DriveBite app storage on your device, and expire after up to 365 days or until you clear them. DriveBite does not upload the recent-destination list as a stored history.
• Recent destinations are not put into analytics. Analytics never sees where you searched for or where you were going.

First-party analytics

Analytics is optional and off unless you explicitly allow it. If you allow it, DriveBite may store random visitor and session IDs and events such as:

• session start and activation
• Nearby and On Route searches
• restaurant views
• Directions clicks
• Order Ahead clicks
• feedback-submission events
• app version, page, usage context and limited campaign or referrer fields

Analytics does not include precise location, destination or search text, name, email address or feedback message content.

You can turn analytics off again inside the app. That stops future analytics and clears the local analytics identifiers on your device, but records already sent are not automatically erased by the toggle.

DriveBite does not sell analytics data to advertisers.

The DriveBite website itself does not run analytics. When you arrive from a campaign link, the standard campaign labels in that link (for example utm_source and utm_campaign) are kept in your browser’s temporary session storage and passed on when you open DriveBite, so the app can attribute your visit. They contain no personal details and are removed when your browser session ends.

Feedback and reports

If you send feedback or report a problem, it may contain the bug or suggestion type, your free-text message, an optional contact email if you choose to give one, the page you were on, user-agent or device and browser information, and the app version.

Restaurant-data reports can include the restaurant, the problem type and the details you supply.

You can choose to attach a JPEG, PNG or WebP screenshot to a feedback report. Before uploading one, remove or obscure any personal details you do not want to share. DriveBite does not automatically redact screenshots.

An attached screenshot contains whatever you choose to include. It is used to investigate your feedback, stored privately, and accessible only to authorised people maintaining or supporting DriveBite and the relevant hosting provider for that purpose. Screenshots are not posted publicly.

The contact email is optional. If you leave it out, we cannot reply to you personally, but your report still helps.

Providers and services currently used

DriveBite relies on a small number of providers to work. What each is used for:

• Supabase — backend data, the DriveBite routing function, first-party analytics, feedback and private screenshot storage.
• OSRM — road-routing geometry and fallback journey-time calculations.
• Postcodes.io — postcode and place lookup.
• OpenStreetMap Nominatim — fallback place lookup.
• Google Places Autocomplete (New) — UK address suggestions while you type a location. The text you type is sent through DriveBite’s backend to generate those suggestions only. DriveBite does not use Google Place Details for the selection flow; the suggestion you pick is resolved through the existing geocoding lookup.
• Google Maps — the in-app basemap on the web version of DriveBite and on the packaged iOS and Android apps. All three use the hosted Google Maps JavaScript basemap rather than a native Google Maps SDK. Google Maps also provides fallback address geocoding, Google Routes traffic-aware route calculations, and the handoff to external Directions. Route coordinates are sent when needed to calculate the route you request; DriveBite does not use this to create a stored journey history.
• Restaurant operator websites and apps — the external Order Ahead handoff.

When you use Google-backed features — the in-app map, address suggestions, geocoding or traffic-aware journey calculations — the relevant map area, location search text and/or journey coordinates are sent to Google to fulfil your request. Opening or using the in-app map sends the map area you have requested (camera position and zoom) together with normal connection data such as your IP address and browser information, so Google can deliver the map. If you gave DriveBite a custom location instead of allowing current location, Google receives the map area requested, not your GPS position. Google handles information under Google’s Privacy Policy. These features are also subject to the Google Maps / Google Earth Additional Terms of Service. These provider terms supplement this policy and do not replace the privacy choices or data-protection rights described here.

When you leave DriveBite for Google Maps or a restaurant service, that provider’s own privacy terms apply to what happens next.

International data transfers

Some of the providers DriveBite uses may process or make information accessible outside the United Kingdom. Where DriveBite is responsible for a restricted transfer of personal information from the UK, we use a transfer mechanism permitted by UK data-protection law. Depending on the recipient and destination, this may include UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where a safeguard requires it, we also consider the protections available for the information in the destination country.

You can contact us at support@drivebite.co.uk if you want more information about the safeguards relevant to a particular transfer.

Why DriveBite uses information

In plain terms, and deliberately kept cautious rather than legalese:

• Core app, location and routing: to provide the journey and location functionality you request and to operate the service.
• Analytics: only with your explicit choice to allow it.
• Feedback, reports and service security: our legitimate interests in responding to you, keeping restaurant and journey data accurate, preventing misuse and improving DriveBite.

This section is a plain-English summary, not legal advice. It describes how DriveBite handles information; it does not replace your rights under UK law.

How long information is kept

Not everything has a fixed keeping period, so where it does not, we use criteria instead:

• Recent destinations: stored locally on your device, kept for up to 365 days or until you clear them.
• Routing and geocoding caches:short-lived and operational, kept only to keep searches and routes working.
• Analytics: kept only while reasonably needed to understand and improve the service, then deleted or aggregated.
• Feedback, reports and attached screenshots: kept only while needed to investigate and respond, and for a reasonable follow-up period, then deleted when no longer needed.
• Security and operational data: kept only as long as reasonably needed for reliability and abuse prevention.

If fixed retention schedules are adopted, this policy will be updated to say so.

Separately from the optional analytics described above, DriveBite keeps small private abuse-prevention counters on its backend. Each counter holds a one-way hash of the connection's IP address (not the IP address itself), the type of submission (public feedback, an analytics insert or a screenshot upload), a time bucket and a count. They exist only to spot and limit automated abuse. Entries older than two days are deleted when later submissions are processed, so removal happens around that time rather than at a guaranteed exact 48-hour mark.

Choices and rights

What you can choose, and what you are entitled to:

• Refuse the location permission and use a custom location instead.
• Allow or decline analytics, and change that choice later inside the app.
• Clear your recent destinations on your device at any time.
• Leave the contact email out of feedback if you would rather stay anonymous.

Under UK data-protection law you generally have rights to access your information, have it corrected or deleted, restrict or object to certain uses, and take your information with you where that applies. You can exercise these by getting in touch through the DriveBite app or our Support page. To ask for deletion, see how to request deletion of your data.

If you are unhappy with how your information is handled, you can complain to the ICO, the UK’s data-protection regulator.

Children

DriveBite is designed as a journey utility for drivers and is not intended as a child-directed service. Our planned store target audience is 16 and over.

Changes to this policy

This policy was last updated on 26 October 2026. It may change as DriveBite, its providers or its features change. Material changes will be reflected here.