Privacy Policy

What stays on your device

• Goal settings, body stats (age, height, weight, sex, activity), and targets you set in Pro.
• Saved dishes, recently viewed dishes, saved meal plans, and meals you log.
• Photos of menus and nutrition labels you scan. They're read on your iPhone with Apple's on-device text recognition and never uploaded. (A local restaurant's menu text is shared, as described below.)
• Foods you describe (“2 eggs and toast”) are estimated on your iPhone from a built-in copy of USDA FoodData Central.
• Recipes you save in the Private Recipe Vault, including their screenshots and photos. Screenshots are read on your iPhone with Apple's on-device text recognition; recipes are never uploaded or shared.
• When you import a recipe from a link, your iPhone downloads that web page directly from the site you chose, the same way Safari would. We don't receive the link or the page.
• Planning requests you type. On supported iPhones they're interpreted by Apple's on-device model; the text isn't sent to us.

Meal photo estimates and recipe clean-up (optional)

• Photo estimates. When you ask for a photo estimate, the photo is resized and re-saved without its location or other metadata, then sent over an encrypted connection to our server and on to OpenAI's GPT-4o model, through OpenRouter, to identify the foods and portions. The calories are then checked against USDA data on your iPhone. We don't store your photo.
• Recipe clean-up. When you tap Tidy it up, the recipe's text (not your screenshots) is sent the same way to DeepSeek's model through OpenRouter. We don't store the text.
• We ask OpenRouter to route these requests only to providers that don't store them or use them for training.
• Allowances and abuse prevention. To count free estimates and stop automated abuse, our server keeps: a random identifier your app creates on install (not linked to you, your Apple Account, or other apps), the date and type of each request, whether it used Pro (checked with Apple's signed purchase data, including the transaction ID), and a hash of your IP address that changes every day. The app uses Apple's App Attest to show requests come from a genuine copy of My Fit Menu.

Menus for local restaurants

• Finding menus. To show menus for local restaurants near a search, the app sends our server the names and map locations of the restaurants Apple Maps found. That reveals the general area you searched, but it carries nothing that identifies you and isn't stored with any identifier. The menus themselves come from each restaurant's own website, read by our crawler, MyFitMenuBot.
• Shared menu scans. When you scan a local restaurant's menu, the menu's text (never the photo) is sent to our server and turned into that restaurant's menu for everyone. Nothing about you is attached.

Counting active users

Once a day the app sends an anonymous check-in: the random identifier it created on install, the app version, and whether Pro is active. We use it only to count how many people use My Fit Menu. It isn't linked to you, and it isn't used for advertising or shared.

Apple Health (optional)

If you turn on Apple Health sync in Pro, meals you log are saved to Health as calories, protein, carbs, and fat, and your weight is read to show your weekly trend. This happens on your iPhone; we never receive your Health data, and it isn't used for advertising.

Location

If you choose “Use my current location,” your iPhone's location is used to search Apple Maps for nearby restaurants. That search is handled by Apple under Apple's Privacy Policy. We don't receive or store your location. You can search by city or ZIP instead, or turn location off at any time.

What we receive

• Menu reports you choose to send: the dish, the kind of problem, an optional note you write, and the app version. No name, email, device identifier, or location is attached.
• Photo estimates and recipe clean-up you ask for: processed as described above; only the anonymous usage records are kept.
• Restaurant lookups, shared menu scans, and daily check-ins: as described above, with nothing that identifies you.
• Menu catalog updates: the app downloads the latest menu file from our hosting provider (Supabase). Like any web request, the provider may briefly log standard technical data such as IP address for security and reliability.

Purchases

My Fit Menu Pro is sold through the App Store, and Apple processes payment. When you use a Pro feature that runs on our server, the app includes Apple's signed record of your subscription (the product, its expiry, and a transaction ID) so we can confirm it. We never see your payment details, name, or Apple Account.

What we don't do

• No accounts or sign-in.
• No advertising or ad tracking, and no third-party analytics SDKs.
• No selling or sharing of personal data.

Children

My Fit Menu isn't directed to children under 13 and doesn't knowingly collect their personal information.

Deleting your data

You can delete any saved recipe, and the screenshots kept with it, from the Recipe Vault at any time. Deleting the app removes everything stored on your device. Anonymous menu reports and usage records can't be linked back to you.

Changes

If this policy changes, we'll update the date above and describe material changes in the app's release notes.

Contact

Questions or requests about your data: privacy@myfitmenu.health.