Privacy policy

Who we are

BlueFort Labs LLC runs LilNom and is responsible for your data. Email hello@lilnom.com or write to 335 E Albertoni St Ste 200-515, Carson, CA 90746.

What we collect

If you subscribe

• Your email address.
• When and where you signed up (the page, which may be a city page), the version of the signup wording you saw, and when you confirmed.
• Whether you're subscribed, and a random token that makes your unsubscribe and delete links work.
• We don't store your IP address with your subscription, and we never ask about medication, doses or weight.

When you browse

• Page counts without cookies: our own script adds to daily totals, such as visits, which site sent the visit, phone or desktop, and copies or shares per chain. The totals hold no IP address, browser details or IDs.
• Your browser keeps a few things in its own storage: orders you save, whether you closed the top bar, whether this tab's visit was already counted, and the first page and referring site of your first visit. That last one goes into the signup form when you subscribe and is counted only in totals; it isn't stored with your subscription.
• Pick for me: if you let the site use your location, it stays in your browser. To find stores near you, your browser downloads the store list for your general area (a box about 30 miles across), so we never receive or store your exact location. If you don't share it, the page asks Cloudflare which city your connection is in, rounded to about 7 miles, and we don't store that either. How hungry you said you are, where you want to eat, and the orders you mark as tried or skip stay in your browser's storage. We count picks shown and tapped in totals, such as Directions taps per chain or how many times an order was marked as tried, with no location and no IDs. Once 10 or more readers have marked an order as tried, that total shows on it.
• Cookies: one, sub=1, after you confirm your email, so the site stops showing signup prompts. It holds no ID. Our editors also use a sign-in cookie on the admin pages. There are no other cookies.
• Cloudflare, our host, processes your IP address and browser details to serve pages, block abuse and rate-limit signups. Our request logs, which can include these, are kept for up to 7 days.
• When bot protection is on, Cloudflare Turnstile checks the signup form in your browser when you start filling it in.
• Searches that find nothing: the words typed, with a count and the date last searched. They're never linked to you, your IP address or a cookie. We automatically drop searches that look like they contain an email address, phone number, username, link or long number, that mention a medication dose, weight, symptom or a health condition such as pregnancy, diabetes or pancreatitis, or that talk about the person searching or their family. The filter works by keyword and can't catch every phrasing, so please leave health details out of searches. Our research team sees only the ones searched at least 3 times, so it knows what to add.

If you email us

Your message and address, to answer you. If you send an order or a tip, we may publish the food details in our own words, never your name, address or anything about your health. There's no need to mention medication, doses or your health. We delete messages within 90 days of handling them, unless you ask us to keep a correction thread open.

If you share an order

The restaurant, store or brand, what you order, and the city and numbers if you add them. Nothing else: no name, email address or IP address is stored with it, and Cloudflare uses your IP address only to rate-limit the form. The form turns away doses, weight and health details. We check the items on the chain's or brand's own page and may publish them as a community pick, in our own words and never with your name.

People in the posts we link

We link to public posts and articles. We store the link, the publication or community name and the order in our own words, never usernames. A short excerpt kept for our reviewers is deleted within 30 days. An AI model (Anthropic's Claude) reads public posts and articles to pull out the food details; subscriber data is never sent to it.

How we use it

• To send the email you asked for, and the confirmation that starts it.
• To keep the site and the list free of abuse.
• To count, in totals, what readers use and search for, so we know what to add.
• To answer you.
• To consider orders and tips you send or share for the site, published without your name.

Who processes it for us

• Cloudflare: hosting, our database, request logs, bot protection, and forwarding mail sent to our addresses.
• Microsoft 365: the inbox where we read the email you send us.
• Resend: sending the email. Open and click tracking are off. Links in the email go through our own redirect, which counts clicks per find in daily totals, never per person.

They process data only to provide these services to us.

Sharing

We never sell, rent or share the email list or any part of it, with sponsors or anyone else. Sponsors see totals only, such as how many times a placement was seen or clicked. We'd disclose data only if the law required it. If the site ever changes hands, the new owner must keep this policy or ask for your consent again.

Ads and tracking

No ad pixels, no retargeting, no third-party analytics, and no embedded social media posts, which load their own trackers.

When you click through to a sponsor or a source, that site's own privacy practices and trackers apply. We don't send it the page you came from, and sponsor links carry only a neutral campaign tag.

Do Not Track and Global Privacy Control: we don't track you across sites or sell your data, so these signals have nothing to turn off. Everyone gets the same privacy, whether or not the browser sends them.

How long we keep it

• Subscribed: until you unsubscribe or delete your data.
• Signups you never confirm: deleted after 7 days.
• Unsubscribed: deleted 30 days after you unsubscribe.
• “Delete my data”, a link in every email, deletes your record from our list right away. Copies of past emails at Resend, our email provider, expire within 30 days.
• Emails we've sent you: Resend, our email provider, keeps a copy of each one, with your address, for up to 30 days, then deletes it. Deleting your data doesn't remove those copies sooner.
• If an email to you bounces or is reported as spam, Resend keeps the address on our do-not-send list so it isn't emailed again. Email us and we'll remove it.
• Our database's point-in-time backups expire within 30 days, so deleted data is gone from them within 30 days.
• Messages you email us: deleted within 90 days of handling.
• Searches that found nothing: deleted 90 days after anyone last ran them.
• Page-count totals contain no personal data and are kept.

Your choices and rights

• Unsubscribe, or delete your data, from the links in any email.
• Ask what we hold about you, ask us to correct it, or ask us to delete it, by emailing hello@lilnom.com. We answer within 45 days.
• We'll confirm the request comes from you by replying to the subscribed address.
• Using these rights costs nothing and doesn't change how we treat you.

Residents of Washington, Nevada and Connecticut have more rights over health-related data; we give them to everyone. See our consumer health data privacy policy.

Children

The site isn't meant for children, and the email is for adults 18 and over. If a child has subscribed, email us and we'll delete the record.

Security

Pages and email links use HTTPS. Only our editors can reach the admin pages and the database, and unsubscribe and delete links work only with your own random token.

Changes

We'll post any change here and update the date at the top. If a change affects how we use subscriber data, we'll tell subscribers by email first.