Privacy Policy
This policy explains, in plain language, how the Self Menu app and this website handle your data. It applies to people who use Self Menu in any country and follows Brazil’s General Data Protection Law (LGPD) and the European Union’s General Data Protection Regulation (GDPR).
Summary
- Without an account, nothing leaves your phone. The app works without an account and without internet: dishes, entries and settings stay on the device.
- With an account, we keep the minimum: the account (your email and how you sign in) and a usage record of each analysis, with no photos or foods.
- Photos and speech go to an AI service only for the analysis. Self Menu doesn’t keep the photo or record the audio.
- No ads, no trackers and no selling of data.
- You can export your data, delete your account and contact us whenever you want: privacy@selfmenu.app.
1. Who looks after your data
The data controller is Flowing Rocks Tecnologia LTDA (being incorporated), the Brazilian company responsible for Self Menu.
- Privacy and data protection officer: privacy@selfmenu.app
- Anything else: contact@selfmenu.app
2. Without an account, everything stays on your phone
Self Menu works without an account. In that case:
- your dishes, meal entries, My foods and settings are stored on the device;
- the food database comes inside the app, and looking things up doesn’t use the internet;
- nothing is sent to our servers, and we don’t know who you are.
The data on your phone is yours. You can export a copy under Account › Your data, and it is erased when you uninstall the app. If Android backup is turned on on your phone, the system itself may include the app’s data in your Google account backup, which is controlled by you and Google; Self Menu has no access to it.
3. With an account, what we keep
An account is only needed for what goes through our server: photo and speech analysis and dish icons. You sign in with your Google account or, once this option reaches the app, with a code sent to your email; the same email is always the same account. Even with an account, your dishes and entries stay on your phone, in a separate space for each account.
| Data | What for | How long |
|---|---|---|
| Account: the email; if you sign in with Google, the name and profile picture it sends us; an identification code and the dates of creation and last sign-in | to identify you and protect the account | until you delete the account |
| Sign-in sessions: technical sign-in data, such as the IP address and the type of device | to keep you signed in securely | while the session exists; erased when you delete the account |
| Usage record: for each analysis, the date and time, the type (dish, label, photo without food or speech), the result, the AI model used, the amount processed, the cost and the response time | billing and usage limits, abuse prevention and cost control | while the account exists; afterwards, with no link to you (section 8) |
| Sign-in code deliveries: for each code sent to your email, the account, the date and the result, without the email or the code | to limit deliveries and prevent abuse | erased within 30 days |
| Encrypted IP address: the IP of each analysis, stored only as a code made with a secret key, never the IP itself | to limit use per network and prevent abuse | erased within 2 days |
The usage record has no photo, food, meal text or dish name.
4. Photos, speech and icons
Photo analysis
When you ask for a photo to be analyzed:
- the app shrinks the photo and sends it, over an encrypted connection, to our server;
- the server passes it to OpenAI’s AI service, which identifies the foods and estimates the amounts;
- the result comes back to the app, and you check everything before saving.
Self Menu doesn’t keep the photo: on the phone, the copies are deleted when the analysis ends, and the server doesn’t store it. We ask OpenAI not to store the analysis, but under its current terms it may keep the photo for up to 30 days, only to monitor abuse. It doesn’t use this data to train models.
A photo may show people or other information: photograph only the food.
Along with the photo, the app sends its language and the food swaps you usually make in the review (for example, white rice for brown rice), to improve the result. This isn’t stored.
Spoken meals
Your speech is turned into text by your phone’s voice service (such as Google’s or Apple’s), under that service’s rules, and it may use the internet. Self Menu doesn’t record the audio. Only the text goes to our server and to OpenAI, just like the photo, and we don’t keep it.
Dish icons
To draw a dish icon, we send only a short description of it, in English, and the name you gave the dish (for example, “a plate with rice, beans and salad, called Lunch”), to Runware or, if it fails, to OpenAI. No photo goes with it. Icons are kept in a shared collection, with no link to who asked for them, and are reused for similar dishes. On your phone, the icon is stored with the dish.
Foods still missing from the database
When the AI finds a food that the app’s database doesn’t have yet, we count its name in English (such as “corn cake”), with no link to you, to know what to add to the database.
5. What we don’t do
- We don’t show ads, and we don’t sell or rent data.
- We don’t use trackers, advertising cookies or behavior analytics tools, in the app or on the site.
- We don’t ask for your weight, height, age or other body data.
- We don’t use your data to train AI models.
- We don’t make automated decisions with legal effects on you: the AI only suggests foods and amounts, and you decide what to save.
6. Who we share it with
We use a few providers to make the app work. They handle the data only to provide their service to us, under the data processing agreements we have with them.
| Provider | What it does | Data | Where |
|---|---|---|---|
| Supabase | server, database and sign-in | account, sessions, usage record and encrypted IP; the cloud backup, when it exists | servers in São Paulo, Brazil; a United States company |
| OpenAI | analysis of the meal photo and text; fallback for icons | the meal photo or text, the language and the swaps; the dish description | United States |
| Runware | drawing dish icons | the dish description and name | a United Kingdom company; processing in the European Union and the United States |
| Resend | sending emails: the sign-in code and, once they exist, backup notices | your email and the message, with the code | United States |
| sign-in with your Google account; Google Play, which distributes the app | the sign-in data you authorize when signing in | United States and other countries | |
| Cloudflare | hosting this website | technical data from visits to the site, such as the IP address | worldwide network; a United States company |
We may also share data when the law or a court order requires it, or to defend rights in legal proceedings.
Transfers to other countries
Some providers handle data outside the country you are in, mainly in the United States. In those cases, we use the safeguards provided by law, such as the standard contractual clauses in these providers’ data processing agreements (LGPD, articles 33 to 36; GDPR, chapter V).
7. Why we handle your data (legal bases)
| What | Legal basis |
|---|---|
| Account, sessions and the analyses you ask for | performance of the contract, the terms of use (LGPD, art. 7, V; GDPR, art. 6(1)(b)) |
| Meal photo and text, which may reveal something about your health | your consent, given with each analysis you ask for (LGPD, art. 11, I; GDPR, art. 9(2)(a)); you can stop using the analysis whenever you want, and the rest of the app keeps working |
| Usage record, encrypted IP, limits and abuse prevention | legitimate interest (LGPD, art. 7, IX; GDPR, art. 6(1)(f)) and performance of the contract |
| Cloud backup, when it exists | specific and prominent consent (LGPD, art. 11, I; GDPR, art. 9(2)(a)) |
| Tax records, once there are payments, and responses to authorities | legal obligation (LGPD, art. 7, II; GDPR, art. 6(1)(c)) |
8. How long we keep it
| Data | Period |
|---|---|
| Account and sessions | until you delete the account |
| Usage record | while the account exists; when you delete the account, it loses any link to you and stays only as an anonymous cost. Once there are payments, tax records are kept for the period required by law (usually 5 years) |
| Encrypted IP | 2 days |
| Sign-in code deliveries | 30 days |
| Meal photo, audio and text | we don’t keep them; OpenAI may keep the photo and text for up to 30 days to monitor abuse |
| Technical database backups | erased within 7 days |
| Emails exchanged with us | as long as needed to reply and prove the reply |
| Cloud backup | see section 10 |
9. Your rights
Under the LGPD and the GDPR, you can:
- find out whether we handle your data and access it;
- correct incomplete or wrong data;
- ask for data to be deleted, anonymized or blocked;
- take your data to another service (portability);
- find out who we share your data with;
- withdraw consent whenever you want, without affecting what was done before;
- object to processing based on legitimate interest;
- ask for a review of decisions made solely by automated means;
- complain to the data protection authority: the National Data Protection Authority (ANPD) in Brazil, or the authority in your country in the European Union.
How to exercise them
- In the app: export your data under Account › Your data; erase the data on the device with Account › Google account › Sign out › Sign out and erase my data from this device; delete the account under Account › Google account › Delete account.
- By email: write to privacy@selfmenu.app, preferably from your account’s email. We may ask for confirmation to make sure it’s you. We reply within 15 days.
- To delete your account without the app, see the Delete account page.
10. Cloud backup (optional)
Today, your data stays only on your phone. When cloud backup is available in the app, it will work like this:
- Only if you turn it on. It needs an account and its own consent, asked once, on a separate screen, off by default. Without it, nothing changes in the app.
- What goes in: your dishes, meal entries, My foods and settings and, for 7 days, the previous version, to undo a mistake. No photos. This data may say something about your health.
- What for: only to keep the copy and give it back to you, for example on a new phone. No analytics, no metrics, no AI training and no sharing.
- How it’s protected: the app encrypts the copy before sending it. The key stays on our server, separate from the data and also encrypted, and the copy is stored under a code that doesn’t reveal whose it is. Someone who accesses only the database can’t read anything. This is not end-to-end encryption: we are able to decrypt it, and we only do so automatically, to give the copy back to you.
- Where: on Supabase’s servers, in São Paulo.
- Email notices: when your backup is restored on a different device, and before it is deleted for inactivity.
- How long: while backup is on. When you turn backup off or delete your account, we delete the copy right away; any remaining technical copies become unreadable within 37 days. If you don’t sign in for 24 months, we let you know by email and, 30 days later, delete the backup (the account stays).
- You can turn it off whenever you want, in the app’s settings. Your data stays on your phone.
- Limits: because we have the key, we may be required by a court order to hand over the content. And anyone who gets into your Google account can restore your backup; that’s why we email you every time it’s restored on a different device.
We keep a record of your consent (the version of the text you accepted and the dates you accepted and withdrew it), as proof required by law.
11. Security
- Communication between the app and the server is always encrypted.
- The AI service keys stay only on the server, never in the app.
- We keep the minimum and separate what identifies you from the rest: the IP only encrypted, the usage record without content.
- Access to our systems is restricted and protected by two-step verification.
- If there is a security incident that may put you at risk, we will notify you and the data protection authority, as the law requires.
12. Children and teenagers
Self Menu isn’t made for children. To create an account, you must be at least 13 years old and, under 18 (or the age of majority in your country), have a parent or guardian’s permission. In the European Union, where your country’s law sets a higher age for consent (up to 16), your country’s age applies. If we learn that we have handled a child’s data without permission, we delete that data.
13. This website
- The selfmenu.app site doesn’t use cookies, trackers or analytics tools.
- If you choose a language in the language menu, your browser stores that choice, only on your device and without a cookie, so the site opens in the same language next time.
- The site is hosted by Cloudflare, which processes technical access data, such as the IP address, to deliver the pages and protect the site.
- When you write to one of our email addresses, we use the message and your address only to reply.
14. Changes to this policy
When this policy changes, we update the date at the top. If the change is important, such as a new use of data or a new provider, we let you know in the app before it takes effect and, when the law requires it, ask for your consent again.
15. Contact us
privacy@selfmenu.app, Flowing Rocks Tecnologia LTDA (being incorporated).