Effective September 22, 2026. Published by Victor Li, New Jersey, USA. Questions: support@menupicks.app.
MenuPicks photographs a restaurant menu and tells you which dishes fit what you eat. There are only two things of yours that it handles — the photographs and your diet — and this page is about what happens to each.
Two things are worth knowing before the details.
Your menu photographs never leave your phone unless you turn on sharing. The app reads the menu and scores it on the device itself. There is no server in a scan and no photograph is uploaded to be read. It works in airplane mode, which is the plainest demonstration that nothing is being sent anywhere.
You do not need an account. The app works fully without one. Signing in is optional and exists only so your diet follows you to another device.
They stay on your phone. When you scan, the app finds the text on the photograph, works out what each dish is likely made of, and scores it against your diet — all of it on the device, using models and a dish knowledge base that ship inside the app. That knowledge is fixed: your scans do not add to it, and scanning a dish creates no record of it anywhere.
Saved scans live in the app's private storage, most recent 200. The 201st pushes out the oldest, photograph and all, and you can delete any of them from the Library at any time. Deleting MenuPicks deletes all of it.
While you are scanning, the app also writes temporary files. The camera's original frame is deleted as soon as the app has cropped it. The one file that lingers is the cropped still the app just read: it sits in your phone's cache folder, which iOS clears on its own schedule, and a copy of it is what goes into your Library if you keep the scan.
Saying you have a nut allergy, that you are coeliac, that you are managing diabetes or your blood pressure — that is information about your health, and it deserves to be named as such rather than filed under "preferences".
It is stored on your phone and used there. The scoring runs on the device, so your diet is not sent anywhere in order to read a menu. If you sign in, it is also stored on our server so it can follow you to another device, and that is the only reason it ever leaves your phone.
It is never used for advertising, never sold, and never shared with anyone. If you have not signed in, it is not on our server at all.
Nothing, when you scan. Three things can leave, and each of them is something you switched on:
| Sent | When | Carries |
|---|---|---|
| A shared scan | Only if you signed in and turned sharing on | The menu photograph, re-encoded, and the dish names read from it |
| Your sign-in | Only if you sign in with Apple | The identifier Apple gives us for you, and your email address if Apple tells us it is verified |
| Your diet | Only if you are signed in | The diets you picked, so they follow you to another device |
No advertising identifier and no device identifier is attached to any of it. The app contains no analytics, no crash reporting and no advertising code of any kind, so nothing is sent in the background and nothing is sent on a schedule. Your photographs and the text read from them are not sent to any third-party AI provider — if that ever changes, this page will say so before it happens rather than after.
There is a setting that lets you share your scans with us, including the menu photographs, so we can make the app better at reading menus. It is off. It stays off unless you turn it on yourself, and the app works exactly the same either way — no feature is withheld, no nagging, no reduced accuracy.
Sharing requires an account, because we have to be able to erase what you shared if you ask us to.
Please read this part before turning it on, because a photograph of a menu is rarely only a menu:
What is kept: the photograph, and the dishes and ingredients the app read from it. The server validates that list and stores only those fields, so nothing else can be attached to a photograph even by a modified app. The photograph is re-encoded before it is saved, which strips camera metadata including any location tag — so a shared scan carries no record of where it was taken, and that is enforced by the server rather than by the app.
What is not kept: your diet, the verdicts, your email, or anything else that names you.
Where: a private Cloudflare R2 bucket. There is no public address for it, and nothing serves a stored photograph to a browser.
We do not sell these photographs, do not use them for advertising, and do not publish them. They have no automatic expiry: they stay until you delete them, or until you delete your account, which takes them with it. You can turn sharing off at any time in Settings and it stops immediately — the server checks the setting on every single upload, so there is no window where an old "yes" still applies. We keep a record of when you turned sharing on and off and which version of this wording you agreed to, which is what lets us show we had your permission; it is deleted with everything else when you delete your account.
Sign in with Apple exists so your diet can follow you to a new phone, and so shared scans can be erased when you ask. The app is fully usable without it, and scanning behaves identically either way.
What we store when you sign in:
We do not keep your name. The app sends it if Apple offers it at first sign-in, and our server discards it.
Your saved scans stay on your device. Signing in does not upload them; only the sharing setting does that.
One company, and only one: Cloudflare, which runs the only server this app has. It handles signing in, the diet of people who signed in, and the storage that holds the photographs of people who turned sharing on. If you never sign in and never turn sharing on, nothing of yours ever reaches it.
There is no analytics provider, no crash-reporting service, no advertising network and no AI vendor.
Scans are not logged anywhere, because they never reach us. What is logged is the small number of requests that do — signing in, changing your sharing setting, uploading a shared scan, deleting your account — and those lines record the time and the kind of request, alongside the network address Cloudflare records. Your diet is health information, so it is deliberately never written next to anything that names you.
One thing deletion does not reach: log lines already written. They age out on the server's normal schedule, and they do not name you.
MenuPicks is not aimed at children and we do not knowingly collect anything from a child under 13.
If we change what we collect or what we do with it, this page changes first, the effective date at the top moves, and a material change is shown in the app. If it affects scan sharing, your existing choice is not carried over: you will be asked again.
support@menupicks.app — Victor Li, New Jersey, USA. Published at https://menupicks.app/privacy.