Home › Blog › Why we built a food guide that doesn't track you

Why we built a food guide that doesn't track you

Most travel apps quietly track you. We chose not to. Here's the engineering that backs the claim, and why the economics of an honest free travel app actually work.

By Sadettin Köseoğlu · 6 May 2026 · 6-minute read

Illustrated editor's desk in an Istanbul apartment at golden hour: an open notebook with hand-drawn dish sketches, a tulip glass of çay, a paper map weighted down by red chillies, a basil pot, and a view of Istanbul rooftops with mosque silhouettes through the window

The default setting of travel apps is surveillance

Open the App Store, search for any major travel-guide brand, scroll to the privacy label. The pattern is almost universal: Data Linked to You includes Identifiers, Location, Usage Data, Diagnostics, and often Contact Info, Browsing History, Purchases, and Search History. Data Used to Track You includes most of the same. The list is not a side effect. It is the business model.

The unspoken trade is straightforward: the app is free because you are the product. Your location, your in-app behaviour, the restaurants you searched but didn't book, the dates of your trip — all of it gets bundled, sometimes anonymised, sometimes not, and sold or used to sell. A sponsored result moves three places higher. An ad finds you on Instagram a week later. A hotel partner gets your trip dates before your sister-in-law does.

Most travellers know this. Most travellers also use these apps because the alternative — a paper guidebook that's nine months out of date — has been worse than the surveillance, on net. We thought it didn't have to be.

What "no tracking" actually means here

"Privacy-first" is a marketing phrase that has been almost completely defanged by overuse. So instead of repeating it, here is the precise list of what Taste Istanbul does and does not do.

The app does not

Ask you to create an account or sign in. There is no account at all. There is nothing for us to lose.
Collect your name, email address, phone number, device identifier, advertising identifier, or any other direct identifier.
Contain any analytics SDK — no Firebase Analytics, no Google Analytics, no Mixpanel, no Amplitude, no Segment, no Kochava, no Adjust, no AppsFlyer, no Branch, no Singular, no Heap. The string Analytics does not appear in the compiled binary.
Contain any crash reporter or session replay tool. Apple's own opt-in App Analytics aggregate data, which is the only telemetry stream we have access to, contains no individual-user information.
Use Apple's App Tracking Transparency framework. There is nothing it would be useful for, because nothing in the app tracks anything.
Request your location. Map views are display-only and centred on each venue's published address.

The app does

Store your favourites, your tour progress, and any tours you've explicitly downloaded for offline use, on your device, in Apple's standard UserDefaults and the app's own sandboxed Documents directory. None of it leaves the device. Deleting the app removes all of it.
Fetch its tour catalogue and venue data over HTTPS from our hosting provider, and venue photography from Google's image servers. Both requests reveal your IP address to the respective server, in the same way that loading any web page reveals your IP to that website. We don't and can't associate those requests with any user identity, because we don't have one.

Apple has audited it

The App Store privacy label for Taste Istanbul reads "Data Not Collected." Apple does not award that label on the developer's word: the Privacy Manifest file inside the binary is machine-checked at submission time, and any third-party SDK that performs tracking is automatically detected and reported. Fewer than 5% of free apps in the App Store qualify for the "Data Not Collected" badge.

Our manifest is short enough to read in one breath:

NSPrivacyTracking          = false
NSPrivacyTrackingDomains   = []
NSPrivacyCollectedDataTypes = []
NSPrivacyAccessedAPITypes  = [UserDefaults, FileTimestamp]

The two API categories we declare are UserDefaults (for favourites, tour progress, and the onboarding-seen flag) and FileTimestamp (for showing you the on-disk size of your downloaded tours, computed via Apple's standard file-attribute APIs). Both declarations are strictly required by Apple's API rules for any app that uses those frameworks. Neither represents tracking.

Why bother?

Three reasons, in increasing order of importance.

One: it's the right product. A food guide should answer one question well — where should I eat tonight? — and then leave you alone. The instant the app starts profiling you, the incentives bend toward keeping you in-app, ranking by revenue, nudging you toward partner restaurants. Every feature stops being for you and starts being for someone else. Removing the surveillance removes the temptation.

Two: it's the right defaults. A free traveller deserves the same default privacy posture as a paying customer of a privacy-first browser. The technology to deliver this exists. The reason it isn't the default is that almost nobody charges for it yet, and almost nobody builds it free. We picked the second option.

Three: it's a recommendable product. The single best growth channel for a small app is word-of-mouth — but quietly tracking apps are increasingly hard to recommend without guilt to friends who ask. A friend who knows you don't want to be tracked, and recommends you anyway, is the best distribution any indie app can have. We've optimised for it.

The economics

The reasonable next question is: but how do you pay for it? Three answers, all honest.

The hosting cost is small. Tour content, venue data, and photography are static JSON and image files served from Google Firebase Hosting. Bandwidth at the volume of an early-stage app is measured in dollars a month, not hundreds. The Data Not Collected label costs us nothing to keep.

The product itself is sponsorable, on legible terms. When Taste Istanbul has the audience to be worth a venue's marketing budget, we will sell sponsorships — but not the way an ad network sells. Three SKUs only: a venue can pay for a "Featured" badge in its category, a tour operator can sponsor a full walking tour, a tourism board can sponsor a district. All three are clearly labelled. None of them require a single byte of user data to operate, because they're priced on placement, not on impression-level targeting. We can sell legibility without selling surveillance.

The newsletter and the press it earns. Our owned channels — newsletter, blog, the long-form district guides on this site — are how this business grows, and they cost roughly the same to operate whether ten people read them or ten thousand.

The wider claim

There is a story we have all been told about consumer apps for the last fifteen years, which is that surveillance is the unavoidable cost of "free." It isn't. It's a default. Defaults are not laws of physics; they are decisions, and the decision is cheaper to reverse than most people think.

Taste Istanbul is one app, in one city, in one category. But if a one-person team can ship a competitive free travel guide with no analytics SDK, no tracker, and no sign-in — and have Apple independently verify the claim — then a great deal of what every other app on your phone is doing is no longer reasonable to call necessary. It is just what they have chosen.

Try the app that backs the claim.

Sixteen walking food tours and 230+ vetted venues across ten historic districts of Istanbul. Free, offline-ready, no sign-in. Open the App Store privacy label and see for yourself.

Download free on the App Store