Terms, privacy and attributions

Effective 7 October 2026. This page is part of the 531™ application and applies to the website at 531.menu and 531.info, the installable web app and any store edition.

Ownership

531™ was created by JohnDavid Whalen and is owned by SYF Consulting LLC. The application, its source code, visual design, copy, logo, the 5·3·1 mark and the five-three-one selection sequence as expressed in this product are protected by copyright, trademark and unfair-competition law. © 2026 SYF Consulting LLC. All rights reserved.

531™ and the 5·3·1 mark are trademarks of SYF Consulting LLC. Use of the name, the mark or a confusingly similar name for a restaurant-selection product or service is not permitted without written consent.

Licence to use

You may use 531™ for personal, non-commercial purposes. You may not copy, modify, reverse engineer, scrape, frame, resell, white-label or create derivative works from the application or its interface without written permission. Automated access to the application's API endpoints other than through the application itself is prohibited.

Licence to use (accounts)

An account is optional. The game plays without one. With an account you can link one other person, invite one friend at a time for a single game, play across two devices and receive notices when the other player moves. You must be 16 or older to create an account. You are responsible for the email address you register. We may suspend accounts used to abuse the service or other people.

Privacy policy

Version 2026-10-12b. What changed since 2026-10-10 is listed under Changes. Applies to 531.menu, 531.info, the installable web app and the API behind them.

Who is responsible

The controller is SYF Consulting LLC, a Wyoming limited liability company, 1603 Capitol Ave Ste 415 #932262, Cheyenne, WY 82007, USA. Contact for any privacy matter: [email protected]. For people in the EU and UK this is also the contact for exercising your rights.

EU representative under Article 27 GDPR: JohnDavid Whalen, Lisbon, Portugal, [email protected]. You may contact the representative, in addition to or instead of the controller, about any matter relating to the processing of your data, and you may lodge a complaint with the supervisory authority in your EU member state; in Portugal that is the Comissão Nacional de Proteção de Dados (CNPD).

What we collect, why, and on what legal basis

No account: nothing is stored about you on any server. Your last city and settings stay in your own browser storage. Lookups pass through our API, which forwards only the place name and map radius to the data sources below; it keeps no log of your searches beyond what Cloudflare records for a short period to protect against abuse (IP address, request time), which is Cloudflare's legitimate interest and ours.
Account: your email address, an optional display name, the time you accepted these terms and this policy, a hash (not the value) of your IP address and your browser description at that moment, and a sign-in record. Basis: performance of a contract (Art. 6(1)(b) GDPR). Without this data the account cannot exist.
Linking and games: the email you invite, the link between the two accounts, each game's city, neighbourhood, date, time, diet and budget settings, the cuisines each player chose, and the restaurant named at the end. Basis: performance of a contract. This is the product.
Friends (guest seats): the email and optional name of a friend you invite for one game, whether they accepted, and the game you played together. A friend who has a 531 account gets a notice in 531; others get one invitation email. The seat ends when that game ends. Your last 7 friends are listed for you so you can invite them again. Basis: performance of a contract.
Your Google Maps and Apple Maps places (optional): only if you upload them. From the Google Takeout file you choose, from Google's own approval screen, and from Apple Maps places you share to the 531 iPhone app, we keep each place's name, position and the map's place id. When you upload the whole .zip file from Google, our server opens it once, in memory, reads only the saved lists and starred places, and does not store the file; notes, dates, labelled places such as Home and Work, and everything else in it are never kept. Your places become more likely in your own draws. Basis: consent (Art. 6(1)(a) GDPR), given by uploading. Remove them all at any time from the account panel.
Your places and your linked partner: if you have a linked partner, the places you uploaded also become more likely in your partner's draws, and theirs in yours, so every game favours the places you both like, whoever starts it. Neither of you is shown the other's list, but a partner may notice which places come up more often. This starts only after you accept policy version 2026-10-12b, and it is on unless you switch it off ("Share my places with my partner", next to your places on the website and under Account in the app). Friends in guest seats never get your places. Basis: legitimate interest (Art. 6(1)(f) GDPR) in a game two linked players play together; you can object at any time by switching it off, and it stops at once.
Community ratings (optional): only if you tick the box, the Google Maps places you uploaded are counted with other players' places. A place counts once enough players saved it (a share of everyone taking part, never fewer than 3 people), and it then becomes more likely in everyone's draws. Nobody is shown who saved a place, and only the count is used. Basis: consent. Untick it any time and your places stop counting.
Where did we go that one night? each finished game you play while signed in, on one phone or two: city, neighbourhood, date, the five, three and one, the restaurant, who you played with, and any note you add ("Again" or "Never again"). Only you see it. "Never again" keeps that place out of your own draws. Basis: performance of a contract. You can switch history off, remove single entries or clear it all from the account panel.
Tailored draws (optional): only if you tick the box, places you marked "Again" become more likely in your draws. Nothing else about you is inferred. Basis: consent (Art. 6(1)(a) GDPR). Untick it any time.
Anonymous statistics (optional): only if you tick the box, your games are counted in combined figures about how people choose where to eat, such as which cuisines are chosen in a neighbourhood. Figures are published or shared only in aggregate, for groups of at least 50 people, never as individual records, and never with your email or name. Basis: consent. Untick it any time and your games are left out of future figures.
Notices: by default, moves appear only on the 531 page. If you turn them on, push notifications to your device and notification emails tell you the other player moved; both are off until you choose them, and the only email sent without your request is the sign-in link you ask for (and, if a friend invites you, their invitation). Push messages carry no content; your device fetches the notice from our API with your session. Basis: performance of a contract. You can turn push off per device at any time.
News emails: only if you tick the separate box. Basis: consent (Art. 6(1)(a) GDPR; CAN-SPAM for US recipients). Every such email has a one-click unsubscribe. Game notification emails are a separate setting, off by default.
Consent and preference log: what you agreed to, which version, and when, so we can show it if asked. Basis: legal obligation (Art. 7(1) GDPR).

Location: "Near me" asks your device for its location once, when you tap it, and turns it into a city and area on your device. The map may show your position if you already allowed location. We store only the city and areas, never your position or any trace of it.

Booking links: the "Reservation" button opens a booking site that can book the restaurant; when several can, it opens the one that pays 531 a referral fee, and all other sites stay listed so you can use the account you already have. When referral fees apply, the page says so. The booking site may know you came from 531; we send it nothing about you.

We do not collect payment data, stored location, contacts, or anything from your device beyond what you type or upload. Apart from tailored draws if you opt in, we do not profile you, make automated decisions with legal effect, or use your data to train models. We do not sell or share personal information for cross-context behavioural advertising, and have not done so in the preceding twelve months.

Where it is processed

Cloudflare, Inc. (hosting, database, edge network). Data may be processed in the EU and the United States under Cloudflare's Data Processing Addendum with the EU Standard Contractual Clauses.
Resend, Inc. (transactional email). Your email address and the message content are processed in the United States under Resend's DPA with Standard Contractual Clauses.
Google (Places API) and OpenStreetMap (Overpass, Nominatim) receive only place names and coordinates, never your identity. Apple receives only the Apple Maps links you paste, when we open them to read the place.
Map and restaurant lookups (place names and areas, no personal data) are stored in Cloudflare R2 so that later players get them faster.
Your browser's push service (Apple, Google or Mozilla) receives an anonymous endpoint for your device, not your identity.

How long we keep it

Where did we go that one night? (your game history): until you remove it, clear it, or delete the account. Account data: until you delete the account, or after 24 months without a sign-in, when we delete it. Sign-in links: 20 minutes. Partner invitations: 7 days. Friend invitations: until the friend's one game ends, the invitation is cancelled, or 12 months pass. Your Google Maps and Apple Maps places: until you remove them or delete the account. Sessions: 90 days. Abuse logs at the edge: up to 30 days. Consent records: as long as the account exists plus the limitation period required by law. Deleted accounts are erased from the live database at once; backups roll off within 30 days.

Your rights

You can download everything we hold about you and delete your account yourself from the account panel in the app, at any time, without asking. You also have the right to rectification, restriction, objection and portability, and to lodge a complaint with a supervisory authority: in Portugal the CNPD (cnpd.pt), or the authority where you live. We answer requests within one month.

United States residents

Residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with privacy laws have the right to know, access, correct, delete and port their personal information, to opt out of sale, sharing and targeted advertising, and not to be discriminated against for exercising these rights. We do not sell or share personal information and do not use sensitive personal information beyond providing the service, so there is nothing to opt out of; the "Download my data" and "Delete my account" controls in the app fulfil access and deletion requests immediately. You may also write to [email protected] or authorise an agent to do so. We honour Global Privacy Control signals as an opt-out of any future sale or sharing. We do not knowingly collect data from children under 13 (COPPA) and remove any such account on notice.

Security

No passwords exist to steal: sign-in is by single-use email link. Session and link tokens are stored only as SHA-256 hashes. All traffic is TLS with HSTS; the site runs a strict content security policy; the API accepts requests only from the site itself, rate-limits every client, and is additionally protected by Cloudflare's firewall. Access to the database is limited to the controller. If a breach affecting your data occurs we notify the authority within 72 hours and you without undue delay where required.

Cookies

One strictly necessary cookie, s, keeps you signed in; it is HttpOnly, Secure and SameSite, expires after 90 days, and is set only after you sign in. There are no analytics, advertising or third-party cookies, so no cookie banner is required under the ePrivacy rules.

Changes

If this policy changes in a way that affects you, we email every account holder, ask you to accept the new version at your next sign-in, and keep the dated versions on file. Optional permissions based on your consent are always off until you turn them on.

2026-10-12b: your uploaded places also favour your linked partner's draws, and theirs yours, unless you switch it off; the Google .zip file can be uploaded whole and is read once on our server without being stored. No optional permission was switched on.

2026-10-12: added friends (guest seats) for one game; Google Maps and Apple Maps places you can upload; the optional community ratings permission; how location is used on "Near me" and on the map; booking referral fees; the shared store for map lookups; updated how long friend invitations last. No existing setting was changed and no optional permission was switched on.

Data sources and attributions

Additional restaurant listings from Overture Maps Foundation places data, available under CDLA Permissive 2.0. 531 keeps an index of names, locations, types, websites and phone numbers from that data so searches answer quickly.
Ratings, price levels, opening status and place details are provided by Google under the Google Maps Platform Terms. Google and Google Maps are trademarks of Google LLC.
TheFork, OpenTable and Michelin are trademarks of their respective owners. 531™ links to their public pages and is not affiliated with or endorsed by them.

Accuracy

Restaurant details are shown live from third-party sources at the moment you play. Hours, menus and availability change. Confirm with the restaurant before you travel or book. 531™ provides the information as is, without warranty.

Contact

Rights, licensing and partnership enquiries: SYF Consulting LLC, 1603 Capitol Ave Ste 415 #932262, Cheyenne, WY 82007, USA. [email protected]