Restaurants you can trust, with privacy by design.
Effective September 17, 2026
This Privacy Policy applies globally to all users of Sterling: Dine with Confidence, on both Android and iOS, regardless of country of residence. Sterling is published by STERLING DINE LLC. The app shows public health-inspection data for restaurants in supported cities. This policy explains exactly what we do — and don't — with information when you use it.
Where a clause applies to only one of the two apps it is marked Android or iOS. Everything unmarked applies to both.
1. We do not require an account
Sterling has no sign-up, no sign-in, and no user accounts. We do not collect your name, email address, phone number, contacts, or social-media identity.
No account creation is required to use any feature, including Sterling Pro.
No email verification, no SMS verification, no OAuth providers.
Sterling Pro entitlement is held by the app store you bought it from. We never see your store account, your name, or your payment details.
2. Information kept on your device
The following is read or stored on your device to operate the app. Everything in this section stays on your device — none of it is transmitted to us.
Location. Used to sort nearby restaurants by distance and to show your position on the map. The coordinates are used on your device. See section 3 for the one thing derived from them that does reach our backend.
Your watchlist and its per-restaurant alert preferences.
Viewing history — the most recent restaurants you opened.
Recent searches, your home city, and your onboarding selections.
Android Your home city is additionally sealed with a key held in the Android Keystore, so it survives a reinstall without ever being sent anywhere.
iOS Health-filter preferences are stored in the iOS Keychain with after-first-unlock-this-device-only protection.
3. Information our backend receives
When the app loads restaurant data, our backend (Supabase) receives the following request metadata, used solely to operate the service:
Your IP address, as part of the standard HTTPS request.
An anonymous session token, generated by your device and renewed periodically.
The bounding-box coordinates of the map view you are looking at, so we can return the restaurants inside it. When you tap the locate button that box is centred on you — this is the only sense in which your location influences a request, and we store no history of it.
Search-query strings you type, so we can return matching restaurants. Searches are not associated with an identity, because there is no account.
The IDs of restaurants on your watchlist, when the app checks them for changes. We receive the IDs in order to answer the query; we do not store your watchlist.
These signals operate the app. They are not used for advertising and are not shared with advertisers.
4. Alerts about restaurants you watch
The two apps do this differently, and the difference matters:
AndroidAlerts are computed entirely on your device. A periodic background job asks our backend for the current state of the restaurants you watch, compares it with what your device already recorded, and raises a local notification if something you opted into has changed. No push token exists, no notification service is involved, and we hold no subscription record for you. The notification permission the app requests is used only to post these local notifications.
iOS Alerts are delivered by push. Your APNs push token (generated by Apple, scoped to your device and this app), the restaurant IDs, and the alert categories you chose are sent to our backend so we can deliver them. Turning an alert off deletes that subscription row within a day. Delivery uses Apple Push Notification service and no third-party push provider.
We never use either channel for marketing.
5. Analytics
Sterling uses PostHog for product analytics, in release builds only. What that means concretely:
A fixed, short list of product events — which screens are opened, when the paywall is shown, whether a purchase completed. The event vocabulary is fixed in the app's source; it is not an open-ended stream.
An anonymous, randomly generated per-install identifier. The app never calls PostHog's identify function and never creates a user profile, so the identifier is not linked to a person, an email address, or an account — there is no account to link it to.
No advertising ID is collected. The Android app does not declare the advertising-ID permission at all.
Analytics are not used for advertising, are not sold, and are not shared with advertisers.
Deleting and reinstalling the app generates a new identifier, which is the practical way to reset it.
Sterling runs no advertising SDKs, no attribution SDKs, and no fingerprinting libraries.
6. Crash and performance diagnostics
Android Google Play collects crash and ANR reports from Android devices as part of the platform (Android vitals). This is Google's collection, governed by Google's privacy policy, and we see only aggregated reports.
iOS Apple provides aggregated crash and performance diagnostics to developers, where the user has opted in to sharing them with developers in iOS Settings.
Sterling itself ships no crash-reporting SDK.
7. Inspection data and restaurant information
Restaurant names, addresses, inspection dates, violation descriptions, and severity codes are fetched from each city's official open-data portal — for example the City of Chicago Department of Public Health, the NYC Department of Health and Mental Hygiene, and Public Health — Seattle & King County, together with the equivalent agencies in the other supported jurisdictions.
Sterling does not inspect restaurants. We process and present the public records that cities themselves publish.
Sterling computes a 0–100 score and a five-tier label (exceptional / strong / fair / concerning / poor) from those records using a documented, deterministic algorithm. No rating is decided by an AI model. AI assists with two narrow jobs only: sorting raw violation text into categories, and writing the plain-English summaries.
8. Subscriptions and payments
Sterling Pro is an auto-renewable subscription sold at $6.99 per month or $19.99 per year, each with a 7-day free trial. Prices shown in the app are the store's own and may differ by country.
Android Purchases are processed by Google Play Billing. Manage or cancel at any time in the Google Play Store under Payments & subscriptions.
iOS Purchases are processed by Apple In-App Purchase. Manage or cancel at any time in iOS Settings under your Apple Account, or from the app's Settings tab.
We do not see or store your card number, store account, billing address, or transaction details. The store tells the app only whether a subscription is active or in trial.
9. Backups
Android Android's Auto Backup may copy the app's data to your own Google Drive, under your Google account and your Drive quota, if you have device backup enabled. That backup belongs to you; we have no access to it. Material sealed with an Android Keystore key is never included, because Keystore keys themselves are not backed up.
Disable it at any time in your device's backup settings.
10. What we do not do
We do not sell your personal information.
We do not track you across other apps or websites.
We do not use cookies in the apps. Sterling is native on both platforms and does not run a webview that could read them.
We do not collect health data, contacts, photos, microphone, or camera.
We have no business relationship — financial or otherwise — with any rated restaurant. Restaurants do not pay to appear, do not pay for higher scores, and have no influence over the rating algorithm.
11. Data sharing
Supabase (backend hosting): processes the request metadata in section 3 so the app can return inspection data to your device.
PostHog (product analytics): processes the anonymous events in section 5.
Google (Google Play, Google Play Billing, Google Maps on Android) and Apple (App Store, In-App Purchase, MapKit, APNs on iOS): process data on your device or through their own services under their own privacy policies.
We do not share your data with any other third party.
If we are ever required by law to disclose data we hold, we will use reasonable efforts to notify you unless legally prohibited.
12. Your rights
You have the rights below, exercisable by emailing support@sterlingdine.com from the address you would like us to act on. Because Sterling has no accounts, we will usually need additional information to locate anything at all.
Access the data we hold. In practice this is limited to an iOS push-subscription row, if you enabled alerts on iOS, and anonymous analytics events that are not linked to you.
Deletion. We will delete any push-subscription rows associated with a confirmed token within 30 days. Everything else described in section 2 is deleted by deleting the app.
Opt out of any sale or sharing — Sterling does not sell or share personal information, so the opt-out is the default.
California residents have additional rights under the CCPA / CPRA.
Residents of the EEA, the UK, and Switzerland have rights under the GDPR: access, rectification, erasure, restriction, portability, and objection.
13. Restaurant data corrections
Restaurant operators, or anyone else who believes a Sterling rating misrepresents a restaurant's actual record, can email support@sterlingdine.com. Include the restaurant's name and city and what looks wrong. We aim to respond within 14 days. Corrections are made by reading the latest published inspection record from the source agency.
14. Retention
Inspection records are public data and are retained as long as the source city publishes them.
Server logs containing IP and session metadata are retained for up to 30 days for security and abuse prevention, then deleted or anonymized.
Analytics events are retained in PostHog under its standard retention, and are never linked to an identity.
iOS Push-subscription rows are retained while an alert is enabled, and removed within a day of you disabling it.
On-device data lives only on your device and is removed when you delete the app.
15. Children's privacy
Sterling's target audience is 18 and over. It is rated Everyone by the ESRB and PEGI 3, and 4+ on the App Store, but it is not directed to children.
We do not knowingly collect personal information from anyone, including children. If you are a parent and believe your child has used the app, this policy describes the full extent of what could exist — in practice, an anonymous analytics identifier, and on iOS a push token if an alert was enabled.
16. Changes to this policy
We may update this Privacy Policy periodically. Material changes will be reflected in the app's Settings > Privacy section and on this page, and the effective date above will be updated. Continued use of the app signifies acceptance of the updated policy.