Privacy Policy

Private menu item ratings

Your optional journal can also store personal likes and dislikes for items from your menus, with a copy of each item name, course, and occasion date. These ratings are private to your account. They do not change shared decisions, approvals, or compatibility answers, and are not sent to your partner or Google Play. Ratings remain until you remove them or delete your account, independently of shared-menu retention. Saving or changing a rating requires Premium; reading and removing saved ratings remains available after the subscription ends.

Premium and private reflections

When you subscribe through Google Play, Google processes payment and subscription information. On the Menu receives a purchase token, subscription state and expiration, and an obfuscated account identifier to verify access. We do not receive your card details. Purchase tokens are encrypted in our database. Your optional private journal stores occasion titles, dates, and notes encrypted on our server. These notes are visible only through your account, are not shared with your Menu Partner, and are not sent to Google Play. This is server encryption, not end-to-end encryption.

Private reflections remain until you delete them or your account, independently of shared-menu retention. After a subscription ends, you can still read and delete saved reflections. Account deletion removes your journal and our saved purchase verification data. Google retains its own payment records under its policies. Uninstalling the app or deleting your account does not cancel a Google Play subscription.

Information we handle

• Guest planning data: participant display names, scheduled date and time, proposed menu selections and custom text, decisions, approvals, presence timestamps, and deletion confirmations.
• Account data: the email address, display name, and sign-in identifiers supplied through Clerk; an optional exact handle; Menu Partner requests, connections, blocks, and account-menu attachments. For a current Menu Partner connection, this also includes your private compatibility answers, custom consideration cards, revealed mutual matches, and match-to-menu proposal records.
• Notification data: email preference, recipient account, notification type, delivery state, retry state, and a safe destination path. Notification content does not include menu selections, compatibility labels, answers, match counts, or partner identity.
• Operational data: request, device, network, security, error, and performance information processed by Microsoft Azure to host, secure, and monitor the service.

How we use information

We use this information only to operate the shared menu, authenticate accounts, connect a chosen Menu Partner, privately reveal shared interests without disclosing individual answers, preserve account access to attached menus, deliver requested product notifications, enforce retention and deletion, secure the service, and diagnose failures. On the Menu does not sell personal information and does not use it for third-party advertising.

Service providers

Microsoft Azure hosts the application, PostgreSQL data, and operational telemetry. Clerk processes account authentication and federated sign-in. GitHub stores source code and deployment records; production customer data is not intentionally sent there. Resend delivers product email and receives the recipient email address and privacy-minimal notification content, but not menu selections.

Retention

Planning menus are retained until 30 days after their scheduled time or are purged after 30 days without activity, whichever comes first. Agreed and closed menus are retained for 90 days. Notification delivery records are retained for 90 days. Private compatibility data lasts only for its current Menu Partner connection and is deleted when that connection ends or either account is deleted. A compatibility idea already proposed into a shared menu follows that menu's retention. Shared-menu deletion occurs immediately after both participant slots confirm within 24 hours.

Your choices

Signed-in users can change or clear a compatibility answer, withdraw a custom card, turn notification categories or product email off, hide a menu from their own library, disconnect or block a Menu Partner, and delete their account. Either participant can leave or close a menu. See Account and menu deletion for the exact effects.

Security and private links

Traffic uses HTTPS. Guest links and account sessions grant access to private data, so keep links between the intended participants and replace a partner link if it may have been shared. Compatibility matching happens on the server: clients receive your answer and a mutual-match result, never the other person's individual answer. No service can guarantee absolute security.

Adults only

On the Menu is intended only for adults age 18 or older and is not directed to children.

Questions and changes

Questions about privacy can be sent to support@getonthemenu.com. Current support options are published on the Support page. Material changes to this policy will be reflected here with a new effective date.