Privacy Policy

Last updated: October 3, 2026

MenuVision ("we", "our", or "us") uses the information described below to analyze menus, maintain your account, personalize warnings, and operate and improve the app. Dietary and allergy information can reveal sensitive information about you. This policy explains what the app collects, how it is used and shared, and the choices available to you.

For details about health-related information and Washington health-data rights, see our Consumer Health Data Privacy Policy. Additional health-data disclosures and rights for Nevada and Connecticut are in our Nevada and Connecticut Health Data Supplement.

Information We Collect

Account Information:

• Your email address, account identifier, and authentication information. Email/password sign-in is handled through Supabase.
• If you choose Apple or Google sign-in, authentication tokens and the account information the provider supplies, which may include your email address and profile information. Sign in with Apple requests your email address only; you may use Apple's relay email option.

User Preferences:

• Allergies, ingredient dislikes, custom entries you add, diet type, and dietary restrictions such as halal, kosher, Hindu-Friendly, or Jain. These choices may reveal health or religious information. The app asks for your agreement before it saves them. Your saved preferences are stored on your device and with Supabase, and a separate consent record keeps your choice without copying your preferences. The Consumer Health Data Privacy Policy explains how they are handled.
• App settings, and the warning and filter display settings (which kinds of warnings to show, and how strictly to filter). These display settings do not contain the allergies, diet choices, or dislikes you entered.

Menu Images:

• Photos you choose to upload, the menu text and ingredient information derived from them, and saved menu history
• The names of dishes and ingredients read from your menu photos may also be added to a shared dictionary of explanations that every user's scans draw on, each with its AI-written explanation. The dictionary stores only the name and its explanation, with no link to your account or to the menu it came from. Names that include diet or health words are never added; only names made of common food words are. Any other name is explained for your scan only.
• Images are uploaded for analysis and stored for menu history. Menu images are stored in a publicly readable location so that our analysis service can retrieve them: anyone who has an image's link can view it without signing in. Avoid including people, payment details, or other private information in menu photos.
• Before your first scan, the app asks your permission to send menu photos and the dish text read from them to OpenAI for analysis. Photos are only sent when you tap Analyze Menu, so you can stop sharing at any time by not submitting scans. Withdrawing that permission does not cancel a scan already submitted. To remove photos already uploaded, delete the saved menu or your account in the app, subject to the retention limits below.

Usage and Diagnostic Data:

• The released app does not use usage analytics. Test versions of the app distributed before its public release sent account-linked usage events to Mixpanel when analytics was enabled for the build; contact us about those.
• When crash reporting is enabled, Sentry receives crash and error reports, diagnostic context and breadcrumbs, and app and device information. The released app does not deliberately attach your MenuVision account ID to Sentry reports, and Sentry's software can assign an identifier to the app installation. We limit diagnostic fields and filter common identifiers and sensitive text before sending JavaScript error reports; native crash reports are processed separately. Error messages and diagnostic context can still describe the affected operation. We do not collect performance traces; crash diagnostics can include reports that the app stopped responding or was terminated by iOS.
• Our own service keeps scan-failure records and technical logs (for example, a scan's failure code and progress times) linked to your account or scan, so that we can operate the service and fix problems.
• Service providers also process technical information needed to receive requests, such as network and device information, subject to their service settings and terms. The app does not collect GPS location, and we do not use IP addresses to determine your location; our providers' servers see your IP address when the app connects to them.

Purchases, Notifications, and Abuse Prevention:

• Purchase receipts and transaction/product identifiers, credit amounts and balances, and purchase/credit history. Apple processes payment details; MenuVision receives purchase-verification information rather than your full payment-card number.
• A push-notification token and related menu/job identifiers if you permit notifications. A completion notification carries a fixed message that your scan is ready, never a restaurant name or anything read from your menu.
• Apple DeviceCheck tokens, a hash used to record free-scan eligibility, and free-scan status on your device and account to prevent repeated claims of the introductory offer.

Support Messages: If you send feedback or contact us, we receive your email address and the information you include. The in-app feedback email is filled in with the app version, the operating system and its version, and your device model (for example, iPhone 15 Pro), but not your device's name. You can see and edit this before you send the email.

How We Use Your Information

• To provide our service: Extracting menu text and estimating ingredients, then comparing the results with your preferences to display possible conflicts
• To personalize your experience: Remembering preferences, settings, and saved menus
• To operate and improve our app: Diagnosing and fixing failures, and responding to support requests
• To manage purchases and eligibility: Verifying App Store purchases, maintaining credits, and limiting abuse of free scans
• To communicate with you: Delivering analysis-completion notifications with your permission and responding to messages you send us

Menu analysis can be incomplete or incorrect. A warning, or the absence of one, does not establish whether a meal is safe for you.

Third-Party Services

The app uses the following providers. The information each receives depends on the features you use and the build's configuration. Their linked policies and service terms describe their respective practices; they do not replace this policy.

• OpenAI: Receives uploaded menu images and extracted dish text, including descriptions and sections, through its API to extract menu items and estimate ingredients. Ingredient and menu-item names are also sent to generate explanations. See OpenAI's API data controls. Actual API retention depends on the service and account settings; this policy does not promise zero retention.
• Supabase: Provides account authentication, database storage, file storage, and server-side processing for preferences, menus, analysis jobs, purchases, and credits. See Supabase's Privacy Policy.
• Apple: Provides App Store purchases and receipt verification, optional Sign in with Apple, DeviceCheck eligibility checks, and delivery of iOS push notifications, and has its own obligations for its records of these services. See Apple's Privacy Policy.
• Google: Provides optional Google sign-in through Supabase. Google and Supabase exchange authentication information and permitted account information for this sign-in flow. Our support mailbox is provided by Google Workspace, which processes the messages you send us for us under written data processing terms. If we deliver a data export you asked for through our Google Workspace Drive, Google processes that export under the same terms. Messages to our former support address still pass through consumer Gmail under Google's own service terms before any forwarding into Workspace. See Google's Privacy Policy.
• Sentry: Receives the crash, error, and diagnostic information described above to help identify and fix failures. The released app does not deliberately attach your account identifier to these reports. Sentry keeps them for 30 days. See Sentry's Privacy Policy.
• Mixpanel: Not used by the released app. Test versions distributed before its public release sent account-linked usage events (never your allergies, diet type, or dietary restrictions), from which Mixpanel derived approximate location. See Mixpanel's Privacy Policy.
• Expo: Routes push notifications to Apple and delivers app updates. A notification carries your notification token, a fixed message that your scan is ready, and random menu and scan identifiers, never anything read from your menu. When notifications are on, the app gets its notification token from Expo, which sends Expo device and app identifiers and your device's push token. Update checks send an installation identifier, the app and update versions, and, if the app has stopped because of an error, a short description of that error. Expo handles this information under its own service terms. See Expo's Privacy Policy.

Data Storage and Security

• Account, preference, and menu data, and our scan-failure records and logs, are stored using Supabase; crash and error reports are processed by Sentry. Each account can read only its own saved data.
• The app uses HTTPS connections for its hosted service requests. No storage or transmission method is completely secure.
• The app persists sign-in sessions and other app data locally on your device. This is not a promise that all local data is encrypted or kept in the device's secure key store.
• The current menu-image links are public links, as explained above; account sign-in does not make those image links private.

Data Retention

• Account and menu data: The app stores this information to maintain your account and history. Deleting a saved menu from History removes its saved record and attempts to remove its uploaded images. Image cleanup is best effort, so an image can remain if cleanup fails. Other job records, logs, and provider copies are not necessarily removed by deleting a menu. Photos from a scan that does not produce a saved menu (it fails, you cancel it, or it can't start) are not added to your history. They may be deleted automatically when the scan ends, or remain stored until you delete your account; this cleanup is best effort.
• TestFlight rollout notice: The automatic deletion-request record and its 37-day retention described in the next item take effect once our server rollout is verified. Until then, the deletion service used by current TestFlight builds may not create that record. For a tracked deletion request or follow-up with the services that hold your data during this transition, email support@menuvisionapp.com.
• Account deletion: Account deletion attempts to revoke stored Apple sign-in authorization and remove uploaded photos before deleting your account and linked records, including preferences, saved menus and stored Apple sign-in tokens. If required Apple revocation or photo removal fails, your account is kept so deletion can be retried. Purchase and credit-history records linked to your account are deleted with it, except the limited purchase-claim and Apple refund records described below. The app's deletion steps do not by themselves confirm completion of deletion from every provider or backup. Deleting your account in the app is a complete deletion request: you do not need to email us as well. When you ask, we first record the request (your account's identifier, the email address on the account, and when you asked and when the deletion finished, plus when your first and last scans were, how many there were, and whether a notification token was found on them, never the photos, the menus or the token itself) so that we can follow up if it does not finish, delete your support emails and any data export we sent you, ask the services that may still hold your data to delete it, tell you when it is complete, and apply the deletion again if our database is ever restored from a backup. If our database cannot record a request when it arrives, the app says the account could not be deleted and nothing is deleted; we find that request in our server logs and follow it up by email. We keep the email address only until we finish your request, and we delete the record 37 days after your account is deleted, or 37 days after your last attempt if the deletion did not finish.
• Backups: Supabase keeps automated backups of our database for 7 days and then deletes them. Before a backup is ever used to restore our database, we apply again every account deletion, and every decision to decline or withdraw consent to use your preferences, recorded since that backup was made. If our live database were ever lost entirely, choices made after the last backup could not be applied again this way; we would tell the people affected wherever we can identify them. Database backups do not include stored photos, so a deleted photo is not brought back by a restore.
• Diagnostics and other provider records: The released app does not deliberately attach your MenuVision account ID to Sentry reports and sends nothing to an analytics provider; Sentry can assign an installation identifier, and keeps crash reports for 30 days. Other provider-held data remains under the providers' configured retention and applicable requirements. When you make a privacy request, we assess the diagnostic records within its scope. If you used a test version of the app, contact us about the usage events and crash reports it sent with your account identifier. We handle provider copies as described in the Consumer Health Data Privacy Policy.
• Shared ingredient dictionary: Dish and ingredient names added to the shared dictionary, and their explanations, stay in it after you delete a menu or your account, because they have no link to your account. Names that include diet or health words are never added; only names made of common food words are. If a name could identify you, contact us and we will remove it.
• Free-scan abuse prevention: Device eligibility state and the stored device-token hash can remain after account deletion. The database's account link for that hash is cleared on deletion; this does not make device-related data inherently anonymous.

Purchase records retained after account deletion. When you delete your account we keep one limited purchase-claim record for each App Store purchase, so that the same purchase cannot be credited twice. That record contains the Apple environment, the app bundle identifier, the verified Apple transaction identifier, the product identifier, the credit amount, a client transaction reference, and creation and fulfillment timestamps. The links to your account and to your purchase rows are cleared, and the full App Store receipt is not kept in it. This is limited transaction data retained for fraud prevention and remains potentially linkable; it is not anonymous data. We keep it for as long as it is needed to prevent duplicate credit claims.

Apple refund records. When Apple notifies us of a refund, or of a reversed refund, for an App Store purchase, we keep a limited record of the notice and of its effect on credits: the Apple notification and transaction identifiers, the notification type, the Apple environment, timestamps, the outcome, and any credits removed or restored. We use these records to reconcile refunds and to avoid processing the same notice twice. They do not contain the full App Store receipt. If you delete your account, the direct link from these records to your account is cleared, but the transaction identifiers remain potentially linkable; these records are not anonymous. We keep them for as long as they are needed to reconcile refunds, prevent duplicate processing, and keep our financial records.

Your Rights

You can update your preferences and request account deletion in Settings, delete saved menus from History, and manage notification permissions in your device settings. Depending on applicable law, you may also have rights to access, correct, delete, or obtain a copy of personal data, or to object to certain processing.

• Contact us to request access, correction, deletion, or an export; the current app does not offer a separate self-service export tool.
• Withdraw your agreement to personalized warnings, and delete your saved preferences, in Settings > Privacy > Personalized warnings and preferences or in Settings > Your Preferences. Contact us with questions or requests about crash reports, which have no separate in-app setting.
• Residents of Washington, Nevada, and Connecticut have additional health-data rights, described in the Consumer Health Data Privacy Policy and the Nevada and Connecticut Health Data Supplement.
• We may need information to verify your identity and understand your request, such as a reply with a one-time code we send to your account's email address. The data-retention limitations above also apply to in-app deletion.

Send privacy requests to support@menuvisionapp.com, or use Settings > Privacy > Privacy request in the app.

Children's Privacy

MenuVision is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact us so we can investigate and address it.

Changes to This Policy

When we update this policy, we will post the revised version and its effective date. We will provide additional notice or obtain consent when required by applicable law.

Contact Us

For privacy questions or requests, contact:

Email: support@menuvisionapp.com
Website: menuvisionapp.com