This page describes what Halulu collects, why, who else receives it, and how long it is kept. It describes what the software actually does.
Halulu needs your location to find restaurants near you, and your craving text to rank them. It stores both. It sends your coordinates to Google to find nearby places, and the craving text and the review text to Google for analysis. It does not sell your data, and it shows no advertising.
Halulu is operated by Osama Khalil. Write to eat@halulu.food with any question about this page.
Your account. Your email address, your name, your chosen language, and optionally a username, a short bio, and a gender marker that lets the Arabic emails use the right pronouns. If you sign in with Google, Halulu receives your email address and your name from Google. Passwords are hashed by the authentication provider and are never written to a log.
Your searches. Every search stores the craving text exactly as you typed it, the precise latitude and longitude your browser reported, the city and country derived from your IP address, the filters you chose, how long the search took, and which restaurants were shown to you and at what rank. Halulu uses this to measure whether the ranking is any good and what each search costs to run.
What you save. Saved restaurants, the collections you organise them into, any note you attach, and any share link you create. A share link is public by design, so anyone holding the URL can open it. A collection is private until you change it.
What you choose to publish. Claiming a username publishes your username, your display name and your bio at a public web address that anyone can open without signing in. If you never set a display name it defaults to the part of your email address before the @ sign, so change it before you claim a handle if that matters to you. Collections you mark public appear there too. Everything else stays private.
What you send us. A message through the contact form is emailed to Halulu and is not stored in the database. A feature request is stored with your account and emailed to Halulu as well.
Payments. Halulu never sees or stores your card. Payment runs through Lemon Squeezy, which is the merchant of record. Halulu stores the subscription record it sends back, which contains your email address and the state of your plan.
Product analytics. Halulu measures how the product is used, through Google Analytics and the hosting provider’s analytics. This is more than page views. The events carry the first 50 characters of your craving, the name of a restaurant you opened, saved or shared, the rank that restaurant held in the results, which plan you are on, and how you signed in.
Error reports. When the site throws an error, an error-tracking service receives the error together with your account identifier, the search you were running and the filters you had set.
Referral links. If you arrive through a referral link, Halulu builds a fingerprint of your browser, stores it in your browser AND sends it to the server, along with your browser’s user agent and the address of the page that linked you. It uses this to count one referral once and to credit the right referrer. If you later sign up, that record is linked to your new account.
Other people’s reviews. To rank restaurants, Halulu caches Google Maps review text and the reviewer display name that Google publishes with it. This is other people’s data, cached for at most 28 days at a time, which is inside the limit Google’s terms allow.
These providers process data on Halulu’s behalf. Halulu does not sell your data to anyone, and nobody can pay to influence a ranking.
Your account, your searches, your saved restaurants and your collections are kept for as long as your account exists. Cached Google review data expires after 28 days. A password-reset link expires after one hour, and an email-confirmation link after 24 hours.
A location pin shared with an AI assistant stops being used after one hour, and you can erase it at any time by asking the assistant to forget your location.
Halulu keeps your sign-in session, your language, your last known location, your search preferences and any referral code in your browser’s local storage. Google Analytics sets its own cookies. Halulu sets no advertising cookies and runs no advertising network. Clearing site data in your browser removes everything Halulu stored locally, and signs you out.
Halulu is not built for children and does not knowingly collect data from anyone under 13. If you believe a child has an account, write to the address above and it will be removed.
When this page changes materially, the date below changes with it. Last updated 22 August 2026. Questions, corrections and deletion requests go to eat@halulu.food.