MenuRight Privacy Policy

Version 1.1 · Last updated 29 October 2026

This policy explains what personal data MenuRight handles, why, who receives it, how long it is kept, and what you can do about it. It covers the MenuRight app for iPhone, its Apple Watch app, widgets and shortcuts, the website menuright.app, and e-mails you send us.

The short version

• Your food diary lives on your iPhone. Your food log, meal photos, weight history, progress photos and receipts are stored on your phone. Our servers see a meal only when you ask for an analysis, or when you report it to us. They keep what an analysis said for 30 days, and a report until you delete your account.
• Your account and your profile are stored on our servers. The profile includes body data, goals, allergies and food preferences. We use it to personalise menus and to restore your profile on a new phone.
• AI analyses what you send. Photos and text you submit go through our servers to AI providers (Google, OpenAI and Perplexity). Reports you send us can go to Anthropic, when our team asks it to sort them. We do not give them your name, e-mail address or account ID, and they are not allowed to train their models on your content.
• We ask first. When you create your account, you tick a box to agree that we store your health information and send what you submit to AI providers for analysis. You can withdraw your consent at any time by writing to us.
• Menus you scan are shared. The dishes and prices read from a restaurant's menu become visible to other people who use MenuRight. Your photos and your identity do not.
• No ads. No sale of your data. We do not track you across other companies' apps or websites.
• Usage statistics are on unless you turn them off. They say which features are used, never what you eat, photograph or type.
• Crash reports go to Google's Firebase. They say where the app failed, never what you entered.
• You can delete your account in the app at any time.

1. Who is responsible

The controller of your personal data is COMPLEXITY SOFTWARE Ltd. (in Bulgarian: „КОМПЛЕКСИТИ СОФТУЕР“ ЕООД), a company registered in Bulgaria under company number (UIC) 206802895, with its registered office at Hristo Smirnenski, bl. 49, entr. A, fl. 7, apt. 21, Slatina district, 1574 Sofia, Bulgaria ("MenuRight", "we", "us").

For any question about privacy, or to use your rights, write to support@menuright.app. We have not appointed a data protection officer.

2. Data that stays on your iPhone

MenuRight keeps most of what you record on your phone. We cannot see this data and we do not copy it to our servers:

• your food log: meals, ingredients, amounts, nutrition values and meal photos;
• meals you saved, and the ingredients the app remembers from your earlier meals;
• your weight entries, your progress photos and your profile photo;
• receipts you scanned: the photo, the shop's name, the date, the receipt number, and the items and prices;
• menu photos you took, and the location of your phone at the moment you opened a restaurant's menu;
• restaurants found near you;
• your reminder settings.

A few things to know about this data:

• Backups. If you back up your iPhone (for example with iCloud Backup), this data is part of your backup. Apple handles backups under its own terms. MenuRight itself does not sync anything to iCloud.
• Old photos. To save space, the app removes the photo of a logged meal after about 30 days, unless you saved that meal. The meal's details stay.
• Signing out and deleting your account do not erase it. Data on your phone stays there until you delete it in the app or remove the app from your phone.
• It belongs to the phone, not to the account. If someone else signs in to MenuRight on your phone, they can see what is stored in the app. Remove the app first if you pass your phone on.
• Apple Watch and widgets. Today's totals and the names of today's meals are shared with MenuRight's widgets and its Apple Watch app on your own devices.

The phone also holds a copy of your profile (section 3.2). Parts of the data above leave your phone only when you ask for an analysis, as section 4 explains.

3. Data we store on our servers

3.1 Your account

• A random account ID.
• Which service you signed in with (Apple or Google), and the identifier that service gives us for you.
• Your e-mail address and your name, if Apple or Google passes them to us. If you choose "Hide My Email" with Apple, we receive a relay address instead of your real one.
• When your account was created.
• Your sign-in sessions. We store a fingerprint (hash) of each session token, not the token itself.

We do not have a password for you. Signing in is handled by Apple or Google.

3.2 Your profile

What you tell MenuRight about yourself during setup and in Profile:

• first name and last name, if you enter them;
• sex and date of birth;
• height, starting weight and current weight (updated when you log a weigh-in), and activity level;
• your goal, target weight, pace and target date, and your daily calorie and macro targets;
• dietary preferences (for example vegan or keto);
• allergies and intolerances;
• restrictions such as sugar, sodium or gluten;
• foods and cuisines you like or avoid, including ones you typed yourself;
• your answers to the setup questions about eating out, such as what you find hardest and how you choose what to order;
• your units, the access code you entered, and technical details of your setup, such as when you started it.

Some of this is information about your health, such as your weight, your allergies and your dietary restrictions. The app asks for your explicit consent before it sends it to our servers. Section 8 explains how it asks and how we use it.

3.3 Things we keep so the Service works

• Settings: whether you share usage statistics.
• Notifications: the push tokens of your iPhone and Apple Watch, with the app's version, language and platform. While a menu is being analysed, also a token for its Live Activity.
• Access code: which code your account used and when, with the note we wrote on that code when we issued it.
• Menus you scanned: the photos (for 7 days), a record that the scan ran, and the dishes read from it. A menu scanned without choosing a restaurant is private to your account. Section 6 covers menus scanned for a restaurant.
• Your consent: each time you give or withdraw it, which consent it is, whether it was given or withdrawn, and when. For consent given in the app, also which version of the wording the app showed, the date of this policy, a random ID the app gives the request, and, for analysis, the AI providers it covers (section 8). The app also remembers on your iPhone which account each consent was confirmed for, so that it does not have to ask our servers each time.
• Limits and cost: how many analyses your account ran (to apply usage limits), and a record of each AI call with its type, model, size, cost and duration. These records contain no content.

3.3a Reports you send us

When you report a logged meal (Report Food) or a restaurant's dish or menu (Report dish, Report menu), we keep:

• the reason you chose and the note you wrote, if any;
• for a meal: the meal as your phone shows it (its name, the foods, amounts and nutrition values) and, if it has one, its photo;
• for a dish or a menu: which menu and dish you reported, and the dish as it was shown to you;
• for a dish or a menu: the diets, food restrictions and allergies in your profile at that moment, so that we can see why the dish was wrong for you;
• the version of the app.

We use reports to find and fix wrong analyses and wrong menus. Our team reads them, and can ask an AI model, from our own admin tool, to sort the open ones for us (section 5). We keep a report until you delete your account; a meal's photo is deleted 30 days after the report.

Thank-you messages. When we fix something you reported, we thank you with a message in the app (Profile → Messages) and a notification. The message says what you reported (the dish and the restaurant, the menu's restaurant, or your meal's name), the reason you chose, the note you wrote, if any, and the day you reported it, and we record when you read it. Tapping it shows you all of this, with the day we fixed it. You can turn the notification off in Profile → Tracking Reminders → Report updates; the message is still kept in the app. We keep your messages until you delete your account.

3.4 Analysis records

Each time you ask MenuRight to analyse something, we keep a record of the request and its result so that we can investigate errors, prevent abuse and measure cost. A record can contain:

• the text you typed or dictated;
• your "usual meals" (section 4.2) and technical details of a photo;
• the foods, amounts and nutrition values that were detected;
• for a receipt: the shop's name, the date, the receipt number, and the items and prices;
• for a nutrition label: the product's name and the printed values;
• the AI model's raw answer, and any error.

A record never contains the photo itself. Thirty days after the request we empty it: what it said is deleted, and only technical details remain, such as its type, status, timing and cost (section 3.3).

3.5 Technical logs

Our servers and our hosting provider log each request: the time, your IP address, your device's user agent, the path and the result. A path can contain an internal ID, such as the ID of a menu. We use logs to keep the Service running and secure.

3.6 The website and e-mails you send us

The website menuright.app does not use cookies or analytics. Like any website, the company that hosts it processes your IP address and browser details to deliver the pages and keep the site secure. If you e-mail us, we receive your e-mail address and whatever you write.

Reviews from people who use MenuRight. The website has one form, at menuright.app/review, where people who use MenuRight can send us a review. It asks for your review and your name and, if you choose, a photo of you and your e-mail address. Before we store a JPEG photo, which is what phones send, we remove the details the camera adds to it, such as where and when it was taken, and keep only which way up it goes. We read every review. We show a review on menuright.app or in the app only if you ticked the box that allows it, and we choose which ones to show. To have your review deleted or taken down, write to support@menuright.app.

4. Data we use to answer a request

4.1 What you send

When you ask for an analysis, the app sends our servers what is needed for it:

• A meal photo, with technical details of the shot (distance, frame size, resolution, lens data) that help estimate portion sizes.
• Text you typed or dictated. On your iPhone, speech is turned into text by Apple's speech recognition on the device. MenuRight never receives your voice, only the text.
• A photo of a nutrition label or of a receipt.
• Menu photos, with the restaurant's name, address and map position.
• The names and amounts of ingredients, to estimate nutrition.
• For ranking a menu: your food preferences, allergies and goal from your profile, and how many calories and macros you have left today.
• What you open on a menu: when you open a dish or tap a filter, the app tells our servers, using internal IDs for the menu, the dish and the filter, never their names. Our servers log each of these events: the time and the menu's ID, and they may log with it your account ID, the kind of event, and the IDs of the ranking, the dish or the filter. These logs hold no names, no text and no photos. We use them to see how menus are used and to find problems, and we keep them as long as other server logs (section 11). They do not depend on the usage-statistics switch (section 7).

We do not store meal, label or receipt photos. They pass through our servers to the AI provider and are then discarded. The app re-creates each photo before sending it, and it does not read or attach the place where a photo was taken.

4.2 Your usual meals

To recognise a plate you eat often, the app sends up to 12 of your meals from the last 60 days with a meal photo or a meal description. For each meal it sends the name, how often and how recently you logged it, and its ingredients with amounts. This list is part of the analysis record (section 3.4).

4.3 Logging from Apple Watch or with Siri

A meal you describe on your Apple Watch or to Siri is sent as text, in the same way. When a meal is logged from the Watch, the meal's name, calories and macros are sent to your devices as a notification through Apple's push service.

4.4 Location

If you allow it, MenuRight uses your location while the app is open to find restaurants near you. Restaurant search and walking times are provided by Apple Maps, so your location goes to Apple under Apple's privacy policy. We do not send your location to our servers. The app stores it on your phone with the menu you opened (section 2).

5. How AI is used

MenuRight's analysis is done by AI models that other companies run for us. These are the companies and what each one receives:

• We ask first. The app asks for your consent before it sends anything you submit for analysis to Google, OpenAI or Perplexity (section 8). Your Apple Watch and Siri cannot ask: without your consent they send nothing.
• What they do not receive from us: your name, e-mail address, account ID, device identifiers or IP address. Your profile (weight, date of birth, allergies, goals) is never sent to an AI model, with one exception: when you report a dish or a menu, Anthropic receives counts of the reporters' diets and allergies, never whose they are. A note you write in a report is sent as you wrote it, so do not put your name or contact details in it. Menu ranking and allergy warnings are calculated on our own servers.
• No training. We do not use your photos or text to train AI models. Our agreements with these providers do not allow them to train their models on what we send.
• How long they keep it. Google keeps requests and answers for up to 55 days, and OpenAI and Anthropic for up to 30 days, only to detect abuse of their services. Perplexity receives only the name of a food, and keeps it as its own API terms say.
• No human check. Results are produced automatically.
• A shared food list. When you ask for the nutrition of a food by name, the name and the estimate may be kept in a shared list, without any link to you, so that the next lookup is faster.
• AI on your iPhone. Some suggestions on the dashboard are worded by Apple's language model that runs on your phone. Nothing leaves your phone for this.

Please do not put personal information, yours or anyone else's, into a meal description, and avoid photographing people.

6. Shared restaurant menus

When you scan a menu for a restaurant:

• The dishes, descriptions, prices and our nutrition estimates join the shared menu for that restaurant. Other people who use MenuRight can see it. A shared menu shows how many scans built it, not who made them.
• Your photos are not shown to anyone. We keep them for 7 days, so that a page can be read again if reading failed, and then delete them from our database. A technical record of the photo (its fingerprint, size and time) remains.
• On our servers, the record of the scan carries your account ID until you delete your account.
• Shared menu information stays after you delete your account. It is information about the restaurant, not about you.

A menu scanned without choosing a restaurant is private to your account.

7. Usage statistics and crash reports

We use PostHog, hosted in the European Union, to understand which features are used and how reliable they are.

What is sent:

• events such as "opened a screen", "started a scan" or "an analysis failed", with counts, durations, on/off values, random IDs and fixed codes;
• the app's version, your iPhone's model and iOS version, screen size, language, time zone and connection type;
• an identifier: a random one before you sign in, and your MenuRight account ID after you sign in;
• a few facts about your setup: units, your goal as one of three codes (lose weight, build muscle, other), whether camera, notification and location access are allowed, whether reminders are on, whether you have an Apple Watch, and the state of your access;
• from our servers, for accounts that share: that an AI request or a menu scan finished, how long it took, which model ran and what it cost.

What is never sent: the name of a meal, dish, ingredient, restaurant or shop; anything you typed; a photo; a nutrition value; your weight; your location; a price. An event can show that you used an allergy or diet feature (for example, that a dish carried an allergy warning), but never which allergy or which food.

PostHog receives your IP address when the app connects to it, as any internet service does. The app and our servers tell PostHog not to derive a location from an IP address. We do not use these statistics for advertising.

Your choice. Usage statistics are on by default, from the first time you open the app. You can turn them off at any time under Profile → Preferences → Share usage data. When you turn them off, the analytics component is shut down, what it stored on your phone is deleted, and nothing more is sent. The choice belongs to your account, so it follows you to a new phone.

The switch controls what goes to PostHog. It does not affect what stays on our own servers: the records we need to run the Service, such as usage limits and cost records (section 3.3), and the menu events in our server logs (section 4.1).

Crash reports and update checks. These go to Google's Firebase, and they do not depend on the switch.

• Crash reports (Firebase Crashlytics). When the app crashes, it sends a report the next time you open it: where in the app's code the crash happened, your iPhone's model, the iOS version, the app's version and build, and random IDs for this installation of the app. A crash report contains nothing you entered in the app and is not linked to your account. We use crash reports to find and fix errors.
• Update check (Firebase Remote Config). When you open the app, it asks Firebase whether its version can still be used, so that we can ask you to update a version that no longer works. The request carries a random ID for this installation of the app and a token for it, the app's identifiers, version and build, the version of Firebase's software in the app, the iOS version, and your phone's language, region setting and time zone.

8. Why we use your data, and our legal bases

If the EU or UK General Data Protection Regulation (GDPR) applies to you, we rely on these legal bases:

Health information and your consent. Some of your profile is information about your health, such as your weight, your allergies and your dietary restrictions. You enter it yourself, during setup or in Profile, and we use it only for the purposes in this table. Before the app sends your profile to our servers, or anything you submit to an AI provider, it asks for your explicit consent: a box you tick yourself when you create your account, or, if your account is older than this box, a screen with the same box the next time you open the app. One box covers both, and section 5 names the providers. In setup, the Apple and Google buttons work only once you have ticked it, and setup goes on only once your answer is recorded. On the screen for an older account, you can go on only by ticking it or by signing out. Every personalised feature and every analysis needs it. We keep a record of your consent (section 3.3). Test versions of the app made before the box was added, on 27 October 2026, do not ask for it, and our servers do not yet refuse a request without it.

You can withdraw your consent at any time by writing to support@menuright.app. We handle the request by hand. You can also remove individual details in Profile, or delete your account (section 11). Withdrawing your consent does not affect what was done before.

Do you have to give us data? No. But MenuRight cannot calculate targets or personalise a menu without a profile, and it cannot analyse a meal without the photo or text.

Automated decisions. MenuRight ranks dishes and calculates targets automatically from your profile. These are suggestions. We make no decision about you that has a legal effect or a similarly significant effect.

9. Who receives your data

We do not sell your personal data, and we do not share it for advertising. We share it only as follows.

Companies that process data for us

We also use an e-mail provider to receive your messages.

We pass data to these companies only so that they can provide their service to us.

Apple and Google, for their own services. When you sign in with Apple or Google, search for restaurants through Apple Maps, use Siri, or back up your iPhone, those companies handle your data under their own privacy policies.

Other people who use MenuRight see shared menu information (section 6). They never see your profile, your meals or your photos.

Authorities and others, when the law requires it, or when it is necessary to protect someone's safety or our legal rights.

A successor. If MenuRight is merged, sold or reorganised, your data may pass to the company that takes over, under this policy. We will tell you first.

10. Where your data is processed

Our servers are in the United States. The AI providers, Google's Firebase and Cloudflare also process data in the United States and in other countries. If you live in the European Economic Area, the United Kingdom or Switzerland, your data therefore leaves your region.

11. How long we keep data

When you delete your account (Profile → Delete Account):

• We delete at once: your account, your sign-in identifiers and sessions, your profile, your push tokens, the records of your consent, your private menus with their photos, your reports, the thank-you messages for them, and your usage-limit records.
• Analysis records lose their link to your account at once, and what they say is deleted 30 days after each request.
• We ask PostHog to delete your usage statistics 24 hours later. PostHog usually completes this within two weeks.
• Backups that still contain your data are overwritten within 35 days.
• Server logs are not searched for your entries. They expire on their own within 90 days.
• What we keep cannot be linked to you: cost records, the record that a menu scan ran, the fact that an access code was used, and shared menu information.
• Crash reports and the installation ID at Firebase are not linked to your account, so they are not deleted with it. Crash reports expire after 90 days.
• Data on your iPhone is not deleted. Remove the app to erase it.
• If you signed in with Apple, you can also remove MenuRight from the list of apps that use your Apple Account in your iPhone's Settings.

12. Your choices

• Profile: change or remove details in Profile.
• Permissions: turn camera, microphone, speech recognition, location and notifications on or off in your iPhone's Settings. MenuRight asks before it uses each one. A feature that needs a permission does not work without it; the rest of the app does.
• Consent: to withdraw it, write to support@menuright.app (section 8).
• Notifications: choose your reminders under Profile → Tracking Reminders.
• Usage statistics: Profile → Preferences → Share usage data.
• Your food log: export it as a PDF or CSV file under Profile → Export meal history.
• Marketing: we do not send marketing e-mails. If that changes, we will ask you first.

13. Your rights

Depending on where you live, you have the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it, or object to uses based on legitimate interest;
• receive the data you gave us in a portable format (portability);
• withdraw consent at any time;
• not be treated worse for using these rights.

Much of this you can do yourself in the app: edit your profile, export your food log, turn usage statistics off, and delete your account. For anything else, write to support@menuright.app from the e-mail address of your account, or tell us which sign-in method you use, so that we can confirm who you are. We answer within one month. Using your rights is free.

Complaints. You can complain to a data protection authority. Ours is the Commission for Personal Data Protection of Bulgaria (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, kzld@cpdp.bg). If you live elsewhere in the EU, the EEA, the UK or Switzerland, you can also contact the authority of your own country. We would appreciate the chance to help first.

14. Security

• Data travels between the app and our servers over encrypted connections (HTTPS).
• Session tokens are kept in the iOS Keychain on your phone and only as fingerprints (hashes) on our servers.
• AI providers receive no identifiers of yours from us.
• Access to our production systems is limited to the people who need it to run the Service.

No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the authorities as the law requires.

15. Children

MenuRight is for adults. You must be 18 or older to use it. The app's date wheel, in setup and in Profile, does not offer a date of birth under 18. We do not knowingly collect data from anyone under 18. If you believe a child or teenager has given us data, write to us and we will delete it.

16. Additional information for residents of the United States

This section applies if a US state privacy law covers you.

Categories we collect. Identifiers (account ID, e-mail address, name, push tokens, IP address in server logs, random installation IDs for crash reports and the update check). Characteristics such as age and sex. Sensitive personal information: the health information described below. Internet or app activity (usage statistics). Photos you submit. Inferences we calculate for you, such as targets and dish rankings. We do not collect precise location on our servers.

Sale and sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising or targeted advertising. We use sensitive personal information only to provide the Service.

Your rights. You can ask to know, access, correct or delete your personal information, and to receive a portable copy. You can use the in-app tools or write to support@menuright.app. You may use an authorised agent, whose authority we will verify. If we refuse a request, you can appeal by replying to our decision. We will not discriminate against you for using your rights.

Consumer health data

Some states, including Washington and Nevada, give special protection to consumer health data.

• What we collect: body data (sex, date of birth, height, weight), goals and targets, dietary preferences, allergies and intolerances, dietary restrictions, and what you eat, as far as you send it to us for analysis.
• Where it comes from: from you. The app asks for your consent before it sends it to our servers (section 8).
• Why: to provide the features you ask for: targets, personalised menu rankings, warnings about foods you avoid, and nutrition estimates. We use it for nothing else without your consent.
• Who receives it: only companies that process it for us (section 9), such as our hosting provider and AI providers. Your profile is not sent to AI providers. We do not sell consumer health data and we have no affiliates that receive it.
• Your rights: you can ask us to confirm whether we hold your consumer health data, to give you access to it, and to delete it, and you can withdraw consent. Write to support@menuright.app or delete your account in the app. You can appeal a refusal by replying to our decision. If your appeal fails, you may contact your state's Attorney General.

17. Changes to this policy

We will update this policy when the Service or the law changes. We publish the new version at menuright.app/privacy with a new date, and we keep earlier versions available on request. If a change is important, we will tell you in the app or by e-mail before it applies. If it needs your consent, we will ask for it.

18. Contact

COMPLEXITY SOFTWARE Ltd. („КОМПЛЕКСИТИ СОФТУЕР“ ЕООД)
Hristo Smirnenski, bl. 49, entr. A, fl. 7, apt. 21, Slatina district, 1574 Sofia, Bulgaria
Company number (UIC): 206802895
E-mail: support@menuright.app