MenuNativePrivacy and legal notice
Last updated: 19 October 2026
What we collect
When you sign up: your e-mail address, the language of the page, the page you were on, the source of your visit if the link carried one (for example “tiktok”), the date, and the version of the consent text shown under the form.
To limit abuse, a non-reversible fingerprint of your IP address (hashed with a secret key; for IPv6, only the start of the address) is kept for about an hour. We never store your IP itself; Cloudflare, our host, processes it to route your request.
On this site: no cookies, no advertising trackers. Site traffic may be measured with Cloudflare Web Analytics, without cookies or personal identifiers.
Why, and for how long
Only to tell you when MenuNative launches and to invite you to the beta. Legal basis: your consent (GDPR article 6.1.a), given by sending the form. The first e-mail asks you to confirm your address: without confirmation, you receive nothing else.
The address is kept until you unsubscribe, and at most three years after you signed up: after that, it is anonymised. It is never sold, rented or shared.
Where it is stored
In a Cloudflare D1 database (Cloudflare, Inc., processor) created with Cloudflare’s “EU” jurisdiction: the data is stored and processed in the European Union.
Your rights
You can ask to see, correct or delete your address, or withdraw your consent, at any time: every e-mail has an unsubscribe link, and you can write to [email protected]. Deletion removes your address from the list (it is replaced by an anonymous value).
For the app’s data (account, backed-up content, purchase, share links, counters), you can also ask for a copy, a correction or deletion by writing to [email protected]. If you have an account, write from the account’s e-mail address: that is how we find it (the app does not offer an export yet). To delete the account itself, see “Delete your account” below. Without an account, we find what you can point us to, for example a purchase through your store receipt: that data is then anonymised, meaning detached from your device and your purchase. A share link can be turned off directly in the app (“Turn off link”); everything else is erased or anonymised automatically after the periods given on this page.
You can also ask for the restriction of a processing, receive the data you gave us in a machine-readable format (portability), and object at any time to the processing based on our legitimate interest (statistics, logs, feedback, votes, counters), by writing to the same address. We reply within one month.
You can also complain to the French data protection authority, the CNIL: cnil.fr/fr/plaintes.
Your menu photos
When you start reading a menu, the photo is sent to our servers, hosted by Cloudflare, then to Google’s Gemini API (Google LLC), which reads the menu and writes the translations and explanations. That is its only use. Legal basis: performance of the service you request.
If you are not signed in to an account, our servers do not keep the photo. If you are signed in, the photo of each page read is backed up with your account, so you find it on your other devices: see “Account and backup”. Our servers keep it as they receive it, without removing its metadata; today, the app makes a copy of the photo before sending it, and that copy does not contain its GPS position. Signed in or not, for 30 days our servers keep the photo’s fingerprint (a code computed from the image, which cannot be turned back into it) with the result of the reading, so that the same photo is not read twice. Avoid photographing people: only the menu is useful.
Google processes the photo under the Gemini API terms: ai.google.dev/gemini-api/terms. This processing may take place outside the European Union, in particular in the United States, under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
We use the paid tier of the Gemini API: there, Google processes the photo on our behalf, does not use it to improve its products, and keeps a log of it only for a limited time, to detect abuse.
To find the lines of the menu when the phone cannot do it itself (and always on the web), the photo also goes through our line-detection service, hosted by Cloudflare: it only sends back where the lines are and does not keep the photo.
To place each translation on the right line of the menu, the photo, as the app sends it, may also be passed to the Cloud Vision API of Google Cloud (Google, our processor), which reads the printed text and where it sits on the photo. Nothing else goes with it: no account, no device identifier. That is its only use. Legal basis: performance of the service you request. Google states that the image is processed in memory without being stored, that it is not used to train its models, and that only some metadata of the request (its time, its size) is logged temporarily, under the Google Cloud Data Processing Addendum: docs.cloud.google.com/vision/docs/data-usage. This reading takes place in the European Union: we call the European endpoint of Cloud Vision, which processes and stores the data in the European Union only.
What Cloud Vision read is only used to correct where the translations sit, within the result of the reading described above. In our logs, each Cloud Vision call leaves only a cost line (type of call, model, number of billed units, cost, duration), linked to the hashed device identifier (and the account’s, if you are signed in), which is removed after 25 months: never the photo or the text read.
More broadly, every menu reading, dish explanation or cuisine guide leaves a cost line of the same kind in our logs (type of call, model, number of tokens, cost, duration, and whether an ad or the ad-free version paid for it), tied to the device’s hashed identifier, to the account’s if you are signed in, and to internal (random) references of the menu and the page. The device and account identifiers are removed after 25 months; if you delete your account, all these references are removed from its lines straight away. Never the photo, the menu text or the explanation. Legal basis: our legitimate interest in running the service and keeping its cost under control (GDPR article 6(1)(f)).
Account (optional)
The app works without an account. If you sign in (Profile › Account › Sign in), sign-in goes through your Google or Apple account, via Firebase Authentication (Google Ireland Limited and Google LLC, our processor). Firebase receives and keeps your e-mail address, your display name, an account identifier and, to secure sign-in, your IP address. Our servers receive a sign-in proof signed by Google and keep the account identifier only in a hashed, non-reversible form.
On iPhone and Android, you can also sign in with Apple (“Continue with Apple”): Apple confirms your identity and passes your e-mail address to Firebase, or a relay address if you choose to hide yours, never your name; for your Apple ID, Apple acts under its own policies. On Android, Apple’s answer goes through our servers, which hand it straight back to the app without keeping it. When you delete your account, the app asks Apple to remove MenuNative’s access to your Apple ID.
Use: signing you in, backing up your data (next section) and making sure the free photos do not start over on every new device. Legal basis: performance of the service you request (GDPR article 6(1)(b)) and, for the free photos, our legitimate interest in preventing abuse (article 6(1)(f)). The account exists until you delete it. Firebase may process this data outside the European Union, in particular in the United States, under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
Account and backup
When you are signed in, your menus (text read, dishes, prices), your orders, your settings (language, currency, display, statistics choice), your guide preferences and the photos of the pages are backed up with your account, so you find them on your other devices and on the web. Legal basis: performance of the service you request.
They are stored by Cloudflare (Cloudflare, Inc., our processor), in storage created with Cloudflare’s “EU” jurisdiction: stored and processed in the European Union. Our servers encrypt each of these items (AES-256-GCM), on top of Cloudflare’s own encryption, except the page photos: they are kept as received, protected only by Cloudflare’s encryption at rest. This data, linked to you, is never sold, shared or used for advertising. The MenuNative team can view a saved menu and the photos of its pages to handle a message you send us or to fix an error; each view is logged.
The most recent photos are synced to your devices; older ones stay backed up but are no longer sent to your devices. Everything is kept as long as the account exists. If you delete it, your data is no longer linked to you and is kept in anonymous form (see “Delete your account”).
Allergies and diet: health data
Your allergies, your diet (which may reveal a religious belief, for example halal or kosher), your spice tolerance and your tastes stay on your device. They are backed up with your account only if you agree, by answering “Yes, sync” when the app asks you. Without that yes, nothing is sent. Legal basis: your explicit consent (GDPR article 9(2)(a)). We keep the date of your answer and the version of the text shown, as proof.
This data is only used to give it back to you on your other devices, so that the allergen hints and your diet follow you everywhere, for your safety. It is never sent to the translation service, never in statistics (only the quick filters you turn on are counted there, see “App audience measurement”), never in a share, never used for advertising.
The backed-up copy is kept as long as your account exists and sync is on. If you delete your account, it is no longer linked to you and is kept in anonymous form, like the rest of your data (see “Delete your account”).
You can withdraw your consent at any time: Profile › Account › Sync allergies and diet. Your allergies stay on your device; the copy that was backed up is no longer linked to your account or used for you, and is kept in anonymous form. Withdrawing does not affect what was done before.
The app’s allergen hints are AI-generated and can be wrong: always ask the staff.
Delete your account
In the app: Profile › Account › Delete my account. Without the app: write to [email protected] from the account’s e-mail address, with the subject “Account deletion”; we reply within 30 days. The details are on the Delete your account page.
What is erased: your sign-in account at Firebase (e-mail address, display name, identifier) and your consents.
What is kept: your menus, orders, settings, photos and, if you had synced them, your allergies and diet. Your data is no longer linked to you and is kept in anonymous form: filed under a random identifier (allergies under another one, separately), with dates rounded to the day, with no link to your Google account, a device or any other data. It is used to improve the service. Our database’s technical backups keep the old link for at most 30 days. The free-photo counters remain, to prevent abuse, for the periods given below.
The history on your phone stays there: you can erase it in the app. Deleting the account does not cancel a subscription: cancel it in your store. If you sign in again later with the same Google account, you start from an empty account.
Share links
When you share a menu, our server publishes on a link that cannot be guessed the translated menu (dishes, original text, prices) and, where applicable, its photo, with its metadata (GPS position, device, date) removed. Never your order, your profile or an identifier. Anyone who has the link can see the page; it is not indexed by search engines. Legal basis: performance of the service you request.
The link expires after 30 days and its content is then erased. You can turn it off sooner, in the app, on the device that created it (“Turn off link”): the content is erased right away, though a copy may stay visible in a cache for up to 5 minutes.
What remains is a row with no content (date, language, number of pages and dishes), tied to the device’s hashed identifier: that tie is erased by the monthly clean-up that follows the 30th day after the link’s expiry date. To report shared content: [email protected].
Feedback and problem reports
In the app, Profile › Send feedback lets you write to us: a problem, a feature idea or something else. We receive the type you chose, your message and, only if you add them: a screenshot (its metadata, including the GPS position, is removed; the pixels stay, so check it shows nothing personal) and an e-mail address to reply to. If the “Attach technical details” switch is on (it is by default for a problem only): the app version, the system and its version, the language, the last screen visited and a reference to the last menu read (never its photo). Your device is tied to it by its hashed identifier, used to limit the number of messages per day.
Use: only to understand and fix the problem or consider your idea, and to reply to you if you left an address. We never write to you about anything else and never send automatic e-mails. Legal basis: our legitimate interest in fixing and improving the app (Article 6(1)(f) GDPR).
Messages are stored in our Cloudflare D1 database, EU jurisdiction. They are kept until they are handled, then kept in the history of fixes and changes, with no time limit, because the same bug or request can come back. The tie to your device is erased by the monthly clean-up that follows the 90th day, your e-mail by the one that follows the 90th day after the message is handled. To have your e-mail and screenshot erased sooner, write to [email protected].
So that we see it quickly, a copy of the message (with its type and, if attached, the technical details) is sent to us by e-mail at our contact address; never your e-mail address or your screenshot.
Votes on translations
If you mark a translation as right or wrong, our server records your vote with the dish and the language, tied to the device’s hashed identifier: a dish marked wrong by several devices is translated again. Legal basis: our legitimate interest in correcting translations (GDPR article 6(1)(f)). Stored in our Cloudflare D1 database, EU jurisdiction. The tie to the device is erased by the monthly clean-up that follows the 90th day; the vote stays, anonymous.
App audience measurement
The MenuNative app counts usage events (no name, no account), without cookies, for example: scan started, dish opened, order shown. They are tied to a random identifier used only for statistics, renewed every 12 months and separate from any other identifier. Never your photos, menus, orders, IP address or device.
This data is kept for at most 25 months and hosted by Cloudflare. You can opt out at any time in the app: Profile › Privacy › Usage statistics (no name, no account).
With these events, we record the platform, the app version, its language and the country the connection comes from (worked out by Cloudflare, without keeping the IP address). The quick filters of the List that you turn on are counted by their name (for example “Spicy” or “Peanut-free”), never the content of your taste profile. Legal basis: our legitimate interest in measuring and improving the app (GDPR article 6(1)(f)); these statistics are on by default and you can turn them off at any time.
Like all these events, a filter turned on is linked to the random statistics identifier (a pseudonym, renewed every 12 months), never to your account, your device or your allergy profile: it says that a filter was tapped, not that you have an allergy.
Crash and error reports
When the iPhone or Android app crashes, freezes or hits an error, a report goes to Sentry (Functional Software, Inc., our processor): the type of error and its cleaned message (no e-mail address, link or identifier), the stack trace, the device model and system, the app version, the last screen visited, the app’s last steps (for example “sheet opened”) and a random installation identifier specific to Sentry. Never your photo, the text of a menu, your e-mail address, your account or the identifier of your device with us. Nothing is sent if you turn statistics off: Profile › Privacy › Usage statistics (no name, no account). The web version sends nothing to Sentry.
The app also sends our servers a short report of each crash or unexpected error: the type of error, its cleaned message, a shortened stack trace, the app version and build number, the system and its version, the current screen. It is tied to the device’s hashed identifier, to limit the number of reports per day; that tie is replaced by a random value by the monthly clean-up that follows the 90th day, and the report stays, anonymous, in the history of fixes. Stored in our Cloudflare D1 database, EU jurisdiction. Same switch: nothing is sent if you turn statistics off.
When our servers hit an error, they send it to Sentry too: the type of error and its cleaned message, the stack trace, the method and path of the request (identifiers masked) and technical details (model used, step, counters, truncated fingerprints). Never a request header or content, a photo, menu text, an e-mail address, an IP address or a device or account identifier.
Use: finding and fixing bugs. Legal basis: our legitimate interest in running and fixing the app (Article 6(1)(f) GDPR). Reports are hosted in Sentry’s European region (Frankfurt, Germany) and kept for 30 days, the period of the Sentry plan we use (sentry.io/pricing). As Sentry is a US company, access from the United States remains possible, under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
Advertising in the app
The free version of the iPhone and Android app starts with free photos (one photo = one menu page). After that, it shows Google AdMob “rewarded” ads: a short full-screen video, only after you tap “Watch a short ad” to translate a menu; what an ad unlocks is shown in the app. Never at launch, never over a menu that is already translated, never on the order screen.
Before that first tap, the app does not start Google’s advertising module and requests no ad. On the first tap, where required (for example in the EU), Google shows its consent form: you accept or decline before any ad.
After your first ad, so that an ad starts without waiting, the app may load one in advance, without showing it, when you are about to need one (free photos used up, or an ad already offered the same day): Google then receives an ad request, even if you watch none. Never in the ad-free version.
Ads are always non-personalised: they are chosen from the context (the app, the language, approximate location), not from a profile of your interests. On iPhone, the app does not ask for tracking permission: Apple’s advertising identifier is not read.
To serve and count ads and fight fraud, Google may process device and advertising identifiers, your IP address, an approximate location derived from it, and your interactions with the ad. For this processing, Google (Google Ireland Limited, with Google LLC) acts as an independent controller, under its own policies: policies.google.com/technologies/partner-sites. On our side, we only receive totals from Google (ads viewed, revenue), nothing that identifies you; for each ad watched, our server counts what it unlocked (tied to the device’s hashed identifier), so that an ad unlocks only what the app announced.
To change your mind: Profile › Privacy › Ad choices, after your first ad (the row appears when Google’s form applies in your country). In the ad-free version, the app does not start Google’s advertising module. The menunative.com website shows no ads. On the web, no ads and no purchase for now: once the free photos are used, carry on in the iPhone or Android app.
Payments and subscriptions
The ad-free version (Premium, as a subscription or a one-time purchase, at the price shown by your store at the time of purchase) is bought in the iPhone or Android app. Payment is processed by Apple (App Store) or Google (Google Play), depending on your phone, each as a controller for its own store; RevenueCat, Inc. (USA), our processor, checks the purchase with the store.
We receive a pseudonymous purchaser identifier (random, no name or e-mail), linked in hashed form to your device, and the subscription status (active or not, end date). Never your card details: they stay with Apple or Google.
If you are signed in to an account, this purchaser identifier is your account identifier, so that your purchase follows you to your other devices.
To cancel a subscription: in your store settings (iPhone: Settings › your name › Subscriptions; Android: Google Play › Payments & subscriptions › Subscriptions). Cancellation takes effect at the end of the paid period.
Ads and payments: legal bases, transfers, retention
Legal bases: for ads, your consent, collected through Google’s consent form where required; for the per-device counters (free photos, pages unlocked by an ad, daily limit of the free and ad-free versions, requests the service could not complete), our legitimate interest in preventing abuse; for payments, the performance of the contract you enter into when you buy the ad-free version.
Transfers outside the European Union: some of this data is processed in the United States by Google LLC and RevenueCat, Inc., under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
Retention: per-device ad counters are kept for 30 days; the purchase status and its hashed link to the device are kept while the subscription is active (for a one-time purchase, while it is valid), then anonymised 13 months after it ends; the counter of free photos and of the daily limit, like the monthly counter of the ad-free version (a number, tied to the device’s hashed identifier, with no photo or data that identifies you), is erased 12 months after last use; the counter of failed requests (photos or explanations the service could not complete, a number per day tied to the device’s hashed identifier) is erased within 3 days.
Our providers
Your personal data is never sold or rented. It is only passed to the providers that run the service, each for the use described on this page:
- Cloudflare, Inc.: hosting of the site, our servers and our databases, account backup (in the European Union where this page says so);
- Google Ireland Limited and Google LLC, Firebase Authentication: account sign-in;
- Apple: Sign in with Apple, for your Apple ID, under its own policies;
- Google LLC, Gemini API: reading menus, translations and explanations;
- Google (Google Cloud), Cloud Vision API: reading the printed text of menus, in the European Union, to place each translation on the right line;
- Google Ireland Limited and Google LLC, AdMob: ads in the free version, as an independent controller (see “Advertising in the app”);
- Functional Software, Inc. (Sentry): crash reports from the app and error reports from our servers, hosted in the European Union;
- RevenueCat, Inc.: checking purchases of the ad-free version, when purchase is offered in the app;
- Apple and Google, for payments made in their store, each as a controller.
Transfers outside the European Union take place under the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses.
Legal notice
Publisher: FILABS, a French simplified joint-stock company with a single shareholder (SASU) with a share capital of €1,000, registered office: 60 rue François Ier, 75008 Paris, France. Registered with the Paris Trade and Companies Register (RCS Paris) under number 930 621 719. EU VAT number: FR14930621719. Phone: +33 6 81 03 19 58. Contact: [email protected].
Publication director: Fiona Roch, President of FILABS.
Hosting: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (cloudflare.com).