DinerAI Privacy Policy

Updated September 10, 2026. DinerAI is intended for adults 18 and older. Contact team@dinerai.app for privacy questions or deletion help. The initial public release has community accounts, public reviews, and subscriptions disabled; those sections below describe gated capabilities and are not promises that they are available.

Menu analysis

When you scan, your menu image and the dietary preferences you submit are sent to our Railway-hosted service and Google Gemini for analysis. These preferences can include allergy or health-related information. In the normal analysis request, menu images are processed in memory rather than intentionally retained by our application. The separate optional private-history feature below does store selected original images. Google processes requests under its applicable API terms, including its service and abuse-monitoring practices. Dish-image descriptions are sent for image generation. Generated images and request records are cached on our server. Generated images are illustrative, not photos of the actual meal, and may be accessible to anyone with their generated-image URL. Do not upload personal documents or include private information in menu images.

Optional private menu history

Only after you opt in, preview the selected content, and confirm an upload, we store selected original menu photos, dish names and descriptions, personalized analysis results, page warnings/errors, upload dates, and access records. These can reveal dietary or other personal information. We do not upload your full profile, meal log, or travel plans through this feature. A randomly assigned, device-bound credential in iPhone secure storage controls access; its hash and a device enrollment record are stored on our server. This is not a recoverable email account, and cross-device recovery is not supported. Uploading or reopening a saved report does not automatically run AI analysis or publish your content.

Optional support sharing

A private upload does not automatically grant the support viewer access. You can separately choose Share for Debugging to let authorized support view/download that scan's photos, report, and errors. Access lasts up to seven days or the scan's expiry, whichever occurs first, and access events are logged. Revoke Debug Access stops future support access but cannot recall copies already downloaded. Infrastructure administrators may access stored data for operations; this is not end-to-end encryption. We do not use these stored uploads for model training.

Private-history retention and deletion

Private scan photos and reports expire 30 days after upload. Expired scans are immediately inaccessible; active-database cleanup runs on history requests and every 15 minutes while the service runs. Delete Cloud Scan removes the active copy and revokes support access without deleting your local menu. Minimal access logs expire after 30 days; inactive device enrollment records expire after 180 days. Our normal application backup script excludes the separate private-history database. Infrastructure-provider backups and previously exported support copies may have separate retention; contact team@dinerai.app with the scan reference for help. Limits are five JPG/PNG pages per upload, 10 MB per page, and 50 scans or 100 MB per device, subject to a global service cap. This temporary history should not be your only backup.

Restaurant discovery

On supported iPhones, restaurant search uses Apple Maps. Typed search terms are sent to Apple under Apple's privacy policy. We do not request GPS access or background location. Results do not verify ingredients or allergy safety. Restaurants you save stay on your device. When you open community reviews for an Apple Maps place while signed in, its name, address, coordinates and place reference are sent to DinerAI to associate reviews with that location. Device-supplied place details are not independently verified.

Accounts and community

We store invited email addresses, public display names, salted password hashes, hashed sessions, short-lived hashed verification/recovery codes, and account-verification status. Codes expire after 15 minutes. Hostinger handles account email delivery. Passwords are not stored in readable form. Reviews, ratings, visit dates and display names become public after moderation. Reports and blocked-user relationships are stored for community safety; reports are visible to administrators. Do not include private medical details in public reviews.

Shared menus

Only when you explicitly choose to share a saved scan, we store its menu name, scan date, dish names and descriptions, the selected restaurant, and your account identity. Your display name and submitted menu text become public after moderation. We do not include the original menu photo, private dietary profile, inferred ingredient list, or personal match scores in this shared record. Submitted text can be inaccurate or outdated and is not restaurant-verified. Menu-specific reviews may also publish the selected dish name. Reports go to administrators. You can delete your shared menu; this also removes reviews attached to that menu from the active database. Deleting your account removes your shared menus and their attached reviews. Deleting a local saved scan does not delete a previously shared copy; delete that copy separately in community.

Device storage

Saved menus, dietary preferences, meal logs, allergy cards, and travel plans are stored locally in the app. These may contain sensitive dietary information. They are not automatically synced to a DinerAI account; sharing selected menu text is a separate opt-in action described above. Native session tokens use the device's secure storage. Your operating system may include app data in device backups according to your settings.

Retention and deletion

Delete your account in the app using your password to remove the account, its sessions, codes, reviews, reports and blocks from the active database. Password reset invalidates existing sessions. Deleting an account does not delete your local library; remove local items in the app or delete the app's data. Invitation records are separate administrative records; email team@dinerai.app to request their removal. Operational backups may retain deleted records until replaced or deleted; contact us about backup removal. We currently retain server-generated image caches and request records for service operation until operational cleanup. No fixed automated backup-retention period is implemented yet.

Other collection

The website stores waitlist email addresses and selected interests when submitted. Creator referral links record attribution events. Hosting providers receive normal network metadata such as IP addresses. We use bounded rate-limit counters and usage totals for security and cost control. We do not sell personal data or run third-party advertising trackers in the app. Billing and subscriptions are not enabled in this beta.

Safety

DinerAI cannot confirm food is safe for an allergy. Inferred ingredients, nutrition estimates, community experiences, generated images and draft translations can be wrong. Confirm ingredients and cross-contact directly with staff. This service is not medical advice.