Privacy Policy

1. Scope

This policy applies to the Menu Q pilot offered to people in Canada and the United States. Menu Q is operated as an early-stage service and does not currently offer user accounts.

2. Information we handle

• Menu content: menu photographs or PDF pages you choose to submit, plus the dishes, restaurant name, translations, and other menu details extracted from them.
• Anonymous one-meal activity: party size, occasion, sharing and hunger context; dishes actually visible on screen; add/remove actions and their recommendation source; the final estimated basket quantity and subtotal; additional recommendation rounds; and feedback you explicitly submit. An explicit negative rating freezes the displayed recommendation and basket for restricted founder review; optional comments are stored separately and excluded from external alerts.
• Security information: a Turnstile challenge token, browser and network security signals, request size and timing, and a server-signed anonymous device credential and short-lived one-way keyed device, session, and network partitions for rate limiting.
• Device-local data: captured pages awaiting submission, extracted menus, preferences, and the current meal session stored by your browser.

We do not collect your name, phone number, email, precise location, a hardware device identifier, or a raw IP address for restaurant intelligence. We do not use IP addresses to identify a restaurant or branch. We do not add dietary restrictions, allergy information, or health information to restaurant analytics.

Please avoid submitting menu images that include faces, payment cards, addresses, or other personal information that is not needed to read the menu.

3. Why we use it

We use this information to read and translate menus, rank dishes for the dining context you provide, estimate meal quantity and price, restore your session on the same device, build a structured restaurant-menu library, improve future menu understanding, produce privacy-thresholded restaurant aggregates, prevent abuse, and diagnose service failures. We do not sell personal information or use it for targeted advertising.

4. Service providers

Submitted menu pages are sent to OpenAI to extract structured menu information. OpenAI states that API inputs and outputs are not used to train its models by default. OpenAI may retain abuse-monitoring data for up to 30 days under its standard API data controls.

Cloudflare provides hosting, Turnstile bot protection, and the structured database used for restaurant names and menu results. Upstash stores short-lived rate-limit counters. These providers may process information outside your province, state, or country under their own security and privacy practices.

5. Retention

• Menu Q does not save submitted menu photographs, PDF files, filenames, or their original bytes in application storage or application logs.
• After extraction, Menu Q retains the structured result: restaurant name, menu categories, dishes, prices, translations, confidence information, and a menu-version fingerprint. Repeated copies of the same menu increase an observation count instead of creating duplicate records.
• A transport-sized OCR batch is temporary. It is not a permanent menu version. Menu Q saves a menu only after every successful batch has been combined and the complete result passes validation; incomplete, failed, and expired batch state is deleted.
• Raw anonymous dining sessions and events are scheduled for deletion after 90 days. Each anonymous session ID represents one meal and is not reused to track a person across meals.
• Longer-term restaurant intelligence contains only aggregates. A segment is not returned or retained as a report unless it includes at least 20 independent anonymous sessions. Aggregate results include their sample size.
• Basket subtotal, revenue, incremental-sales, and average-spend figures are estimates unless a future point-of-sale source explicitly confirms them. Menu Q does not describe an estimated basket subtotal as restaurant revenue.
• Structured menu results are retained while they remain useful for operating and improving the restaurant-menu library. They may be corrected or deleted when inaccurate, no longer needed, or subject to a valid request.
• Captured pages waiting to be submitted remain in your browser and are removed after a successful analysis handoff, when you restart, or when you choose “Delete local menu data.”
• Other Menu Q browser data remains until you delete it, clear browser storage, or the browser removes it.
• Rate-limit counters and their pseudonymous keys expire after the active rate-limit window, currently about one hour.
• Our service providers may retain limited information for security, legal, and operational purposes under their policies.

6. Your choices and rights

You can delete Menu Q data stored on your device from the home or capture screen. This local control removes browser-held photos, menus, sessions, and short-term credentials. It does not delete lawfully retained anonymous server aggregates, and we do not imply that it does. Depending on where you live, you may also have rights to request access, correction, deletion, or information about our handling of personal information, and to withdraw consent where applicable. We will not discriminate against you for exercising an applicable privacy right.

To request correction or removal of a stored restaurant menu, identify the restaurant and the relevant menu details in your message.

7. Security and children

We use transport encryption, server-side credentials, request validation, bot protection, and rate limits. No online service can guarantee absolute security. Menu Q is intended for a general dining audience and is not directed to children who cannot consent to this processing under applicable law.

8. Contact and changes

Privacy questions or requests may be sent to menuq0303@gmail.com.

We may update this policy as the pilot changes. A revised effective date will be shown on this page.