Menu Goat

Menu Goat — Privacy Policy

Last updated: 5 September 2026

Menu Goat is built so that there is very little to say here. This page describes what actually happens, and the architecture is arranged so that it could not easily happen any other way.

The short version

Your menu photos are processed as they pass through and are never stored. There is no account and no tracking. Recent scans are kept on your phone for 30 days so you can look one up again — the dish cards only, never the photographs, and never sent to us.

What happens to a photo

When you scan a menu:

1. The photo is resized on your phone and sent to our server.
2. Our server forwards it to Google's Gemini API, which reads it and returns a

description of the dishes.

1. The result is sent back to your phone and the photo is discarded.

The photo exists only for the length of that one request — a few seconds. It is not written to any disk, database, or file store, on our servers or anywhere else. The only things our server can write are described under "What our server keeps" below, and none of them has a field a photograph could go in.

We ask Google not to retain the request either (store: false), and Menu Goat uses the Gemini API on a paid plan, under which Google does not use prompts or responses to improve its products and retains them only briefly for abuse detection and legal compliance. Google's handling of API data is covered by the Gemini API terms.

What travels with the photo

A few small things go with it, so that the answer fits the person reading it:

• The language you want the dishes explained in.
• Your phone's region setting — a two-letter country code such as GB or

TR. This is a setting, not your whereabouts. It is sent so the explanations know which food is already familiar to you, rather than recommending your own everyday dish to you as a local discovery.

• The "what are you after" chips you tapped, if you tapped any — a drink,

something light, dessert. They are a fixed short list of choices, not anything you type.

• A coarse location, but only if you allow it. If you say yes to the

location prompt, a coordinate rounded to about a city block goes with that scan. It is used once, on the spot, to look up the *public reviews* of the restaurants nearest you, so that "worth ordering" can be the thing regulars come back for instead of a guess. Then it is gone: the coordinate is not stored, not logged, and never attached to you or to your scan. Saying no costs you nothing — the app never asks before your first scan, and every other part of a scan works exactly the same without it.

They are used for that one scan and nothing else. They are not stored, not logged, and not attached to anything that identifies you.

We keep the reviews we look up for a week, so that the next person to scan a menu on that street does not send us looking again. **That cache remembers venues, not people**: it is filed under the rounded coordinate itself, it holds nothing but restaurant names and the public reviews already visible to anyone on Google, and there is no field in it for a user, a device, or a menu. Nothing you sent is written to it.

When you scan a QR code instead of photographing the menu, the link inside it is sent to our server, which fetches the page or PDF it points at so that it can read the menu there — and what comes back is handled exactly as a photograph is: held for the length of that one request, never stored, never logged.

What we don't collect

• No account. There is nothing to sign up for. We never ask for your name,

email address, or phone number.

• No photo history. Photographs are never kept — not by us, and not by the

app on your phone. The recent-menus list holds only the text of the dish cards, and it is deleted automatically after 30 days. You can clear it at any time in Settings, and deleting the app removes it immediately.

• No IP address logging. Our server does not record the IP address a request

came from.

• No request logging. We do not log the contents of requests — not the

photos, not the text extracted from them, not the results. See "Technical records" below for the content-free record we do keep.

• No analytics SDK. There is no Google Analytics, no Facebook SDK, no

advertising identifier, and no third-party tracker in this app.

What our server keeps

Two numbers about you, and nothing else about you:

• How many free scans have been used.
• How many scans have run today.

They are stored against a one-way hash of the anonymous identifier below, so the value we hold cannot be turned back into that identifier, let alone into you. Both expire on their own — the daily count within two days.

This exists so that free scans mean something and so that the service cannot be used as an open pipe to someone else's expense. It holds no photographs, no text from your menus, and nothing about what you scanned.

The only other thing our server keeps is the week-long cache of public restaurant reviews described above, which is filed under a place rather than under a person.

Technical records

We keep a content-free record of each request so that the service can be kept working: what kind of request it was, whether it succeeded or which error it hit, how long it took, how many pages and dishes were involved, and a rough estimate of what it cost us to answer. These are counts and categories — the things you would see on a dashboard.

**What is not in them, ever: your photographs, your menus, the text read off them, a link from a QR code, your location, the language-and-region settings tied to any identifier, anything you typed, your IP address, or the anonymous identifier itself.** There is no field in these records for any of it, and no way to trace one back to a person or a device. They exist to answer questions like "are scans failing this morning" and "is today's bill normal", and they cannot answer any question about you.

What is stored on your phone

Three things, all local to your device and never sent anywhere:

• The dish cards from your recent scans, for 30 days.
• How many free scans you have used.
• Whether you have seen the introduction.

Deleting the app deletes all of them, and the recent-menus list can be cleared on its own in Settings.

Anonymous identifier

The app generates a random identifier the first time it runs. It is not derived from your device, your phone number, or anything about you, and it is not linked to any personal information.

It is used for three things: to let RevenueCat associate a purchase with the device that made it, so you can restore it later; to ask RevenueCat whether that purchase is still active, which is how the app knows you are a subscriber without you ever creating an account; and — as a one-way hash, so that even the original random value never reaches our server in readable form — to count the two numbers above and to space out requests.

Purchases

Purchases are handled by Apple and by RevenueCat, which manages subscription state. We never see your payment details; Apple does not share them with us. RevenueCat receives the anonymous identifier above and the purchase record, and nothing else.

Allergen information

Dish explanations and allergen tags are generated by an AI model reading a photograph of a menu. They can be wrong, and they can be incomplete.

If you have a food allergy, confirm with restaurant staff before ordering. Menu Goat is a translation aid, not a medical or dietary safety tool.

Children

Menu Goat is not directed at children and does not knowingly collect any information from anyone, of any age.

Changes

If this policy changes, the date at the top changes with it, and the updated version appears here.

Contact

Questions about privacy: hello@menugoat.app