Privacy Policy

This notice explains what personal data MenuFuel (menufuel.com) collects, why, who we share it with, and your rights. MenuFuel is operated by GymStreak Ltd, a company registered in England and Wales (company number 11245600), which is the data controller. Contact us at support@menufuel.com or hello@menufuel.com.

What we collect

• Your email address, to create your account, send your 6-digit sign-in codes, and send emails about your plan.
• Your quiz answers and profile: your goal, sex, age or birth date, height, weight, activity level, how often you eat out, eating style, favourite restaurants and food likes and dislikes. Some of this (such as height, weight and goal) is health-related, so we treat it with extra care and use it only to work out your targets and personalise your orders.
• Things you save in the app: saved orders, your "usual" orders, restaurants you've opened, and your 👍/👎 votes on suggestions. These are currently kept in your browser on your device.
• Plan and payment records: which plan you're on, when it renews or ends, and payment references. Card details are entered into Stripe's checkout. We never see or store your full card number.
• Ad and usage data: the link or ad that brought you here, pages you view and steps you complete (see "Cookies, analytics and ad measurement" below).
• Technical data needed to run and protect the service, such as your IP address and browser type, and limits on how many sign-in codes can be requested.

MenuFuel in ChatGPT

When you use MenuFuel in ChatGPT, ChatGPT sends us the restaurant, country, meal targets and food preferences needed to answer your request. We use this information to look up official menu data and suggest orders that match your targets. You do not need a MenuFuel account. We do not save these inputs to a MenuFuel profile or use them for advertising. Our hosting service may process technical request logs to operate and protect the service. ChatGPT handles your conversations under its own privacy policy.

Location

If you use "near me", your browser asks for permission first. Your location (or the place you type) is used in the moment, from your browser, to find nearby branches through OpenStreetMap services (Nominatim and Overpass). It is not sent to or stored on our servers. Your browser may keep the result for the current session so it doesn't have to look it up again. You can turn location off in your browser settings at any time.

How and why we use it

• To provide MenuFuel (performing our contract with you): your account, sign-in, targets, order suggestions, and your profile on every device you sign in on.
• Health-related answers (height, weight, goal) are used only to personalise your targets and orders, with your explicit consent when you enter them. You can change or delete them at any time.
• To run your plan: payments, renewals, cancellations, receipts and support (contract and legal obligations).
• To keep the service safe and prevent fraud and abuse (legitimate interests).
• To measure and improve our advertising and the app (legitimate interests, or consent where required).

We don't sell your personal information. We never send your height, weight, goal or other quiz answers to advertisers.

Who we share it with

We share data only with the providers that help us run MenuFuel, under their data processing terms:

• Google Cloud / Firebase: hosting and our database (Firestore, United States), where your account, profile and plan records are stored.
• Resend: sending our emails, including sign-in codes.
• Stripe and Onelink (Stripe's merchant of record service): payments, tax, receipts and refunds, under their own privacy policies.
• AppRefer: our support chat and help articles. When you message us there, AppRefer receives your messages, any photos you add, the page you wrote from and, if you're signed in, your email address and account id. Some replies may come from our AI assistant, which is marked as AI.
• Cloudflare: our domain and DNS.
• OpenStreetMap services (Nominatim and Overpass): nearby-branch lookups, directly from your browser, only when you use "near me".
• Meta (Facebook, Instagram) and AppRefer, our ad attribution service: ad measurement, as described below.
• Microsoft Clarity: session recordings and heatmaps that show how pages are used, as described below.

We may also disclose data where the law requires it, or to protect our users or the service.

Cookies, analytics and ad measurement

• Essential: a sign-in cookie (mf_session) keeps you signed in, and your browser's local storage keeps your profile and saved items so the app works, including offline. If you use the support chat, local storage also keeps your chat session so you can pick the conversation up again. These are needed for the service to work.
• Our own site analytics: we count how people use MenuFuel (pages viewed, which quiz screens were shown, sign-ups, checkouts, trials and purchases, and which restaurants are opened) so we can see what works and fix what doesn't. Your browser keeps a random visitor id and a random visit id for this (in local and session storage), and when you're signed in the events are linked to your account. We record only the event, the page type, the kind of device (phone, tablet or computer) and where the visit came from (for example "facebook"). We don't record your IP address, browser details, email, quiz answers or anything you type. It's stored in Google Cloud (BigQuery) for up to 400 days, used only to improve MenuFuel, and never sold or shared with advertisers.
• Ad measurement: when we run ads, we use the Meta Pixel in your browser, and AppRefer, our ad attribution service, records which ad you came from. If you arrived from an ad, a cookie (mf_attr, kept for 90 days) remembers the ad click, and our server tells AppRefer when you sign up, start a checkout or pay; AppRefer passes those events to Meta (through Meta's Conversions API) so we can see which ads work. The Meta Pixel and AppRefer may use cookies (such as _fbp and _fbc) and receive your IP address, browser type, the pages you visit, order values and your email address and account id in hashed (scrambled) form. We never send your quiz answers or health-related data. Meta uses this under its own privacy policy.
• Microsoft Clarity: records how pages are used (clicks, scrolling and taps) as session recordings and heatmaps, so we can spot confusing screens. Your email, sign-in codes, body measurements and Profile page are masked and never recorded. Clarity uses cookies (such as _clck and _clsk) and Microsoft processes the data under its own privacy statement.
• Your choice: we don't show a cookie banner. We honour Global Privacy Control: if your browser sends it, ad pixels and Clarity don't load, our own analytics is switched off (and its random ids are deleted), and we don't send ad events for you. You can also block or delete cookies in your browser, manage ad preferences in your Meta account, or email hello@menufuel.com and we'll stop using your data for ad measurement.

Under some US state laws (for example California's), ad measurement can count as "sharing" personal information for targeted advertising. You can opt out with Global Privacy Control or by emailing us.

How long we keep it

• Your account and profile are kept while you have an account. Delete your account and we delete them.
• Sign-in codes expire after 10 minutes.
• Our own site analytics events are deleted after 400 days. The ad-click cookie expires after 90 days.
• Payment and tax records are kept by us, Stripe and Onelink for as long as the law requires (usually 6 years in the UK).
• Data in your browser stays on your device until you sign out, clear your browser data or delete the app.

Deleting your account

Email support@menufuel.com from the address you sign in with and ask us to delete your account. We'll delete your account, profile and the analytics events linked to it within 30 days and confirm by email. If you have an active plan, cancel it first in Profile → Manage subscription (or ask us to). We keep only the payment records the law requires. To clear what's stored on a device, sign out in Profile or clear your browser data.

Your rights

Under UK GDPR (and similar laws where you live), you can ask us to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent at any time. Email support@menufuel.com from the address you sign in with. We'll reply within one month and won't treat you differently for using your rights. If you're unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Children

MenuFuel is for adults aged 18 and over. We don't knowingly collect data from children. If you think a child has given us data, contact us and we'll delete it.

International transfers

We are based in the UK, and some of our providers store or process data in the United States and other countries. Where data leaves the UK or EEA, we rely on the safeguards the law provides, such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses or adequacy decisions (including the UK-US data bridge, where the provider is certified).

Security

Data is encrypted in transit, sign-in codes are stored only in hashed form, and access to our database is restricted. No system is perfectly secure, so please tell us at support@menufuel.com if you notice anything wrong.

Changes

We'll update this notice when what we collect or who we share it with changes, and change the date at the top. For significant changes we'll tell you by email or in the app first. See also our Terms of Service.

Contact

GymStreak Ltd, company number 11245600, England and Wales. support@menufuel.com or hello@menufuel.com.