Last updated: 2026-08-03 · Effective for app builds shipping from this date.
Menu Renzu is an iOS app that reads restaurant menus from photos using AI vision and
helps you order with confidence in any language. This policy describes what data the
app and its backend handle, what is kept on your device, what is sent to AI providers,
and your choices. It applies to the Menu Renzu iOS app distributed on the App Store and
TestFlight.
Summary
No account, no login. We do not collect your name, email, or any account identifier.
Photos are processed, not stored. Menu photos are sent to AI providers for analysis and are not kept by the app or our backend after processing.
Local history is limited. Up to 30 days of scan history (small thumbnails + dish text) lives on your device and can be cleared anytime.
Telemetry is categorical. Only crash/scan categories and counts are sent remotely — never raw menu text, photos, or full crash stacks.
Remote metrics are kept 90 days. Aggregated daily KPI rollups only; raw log events are not persisted long-term.
AI providers
To read and translate menus, the app sends your menu photo (and, when on-device OCR is
used, extracted text) to AI providers:
Google Gemini (vision menu analysis + text-only OCR structuring) — primary provider.
OpenAI (vision fallback on retryable Gemini failures, plus text-to-speech for the order read-aloud feature).
ElevenLabs (optional text-to-speech provider, only if you enable it with your own API key).
These calls go either directly from your device (bring-your-own-key / BYOK
mode, when you provide your own provider API keys in the in-app API Keys screen) or
through our Cloudflare Worker proxy (the default for TestFlight and
App Store builds). In both cases, the menu photo and text are transmitted to the
AI provider you are using so it can return the analysis. The providers process this data
under their own privacy policies; Menu Renzu does not control their retention.
Cloudflare Worker proxy
In proxy mode (default for distributed builds), menu photos and OCR text are sent to our
Worker at menulens-proxy.dokkimsan.workers.dev, which forwards them to
Gemini or OpenAI and returns the result to your device.
The Worker does not store menu photos or OCR text. Request bodies are processed in memory and discarded.
It keeps only short-lived operational logs: timestamp, endpoint, HTTP status, latency, and an error category. No menu content, no photos, no API keys, no raw upstream payloads.
Aggregated daily KPI rollups (scan counts, TTS counts, attestation counts, error/latency buckets, provider call counts) are stored in Cloudflare KV for 90 days for operator monitoring. These rollups contain no personal identifiers and no menu content.
Remote telemetry events sent from the app via /v1/log are forwarded to the Worker structured logger and are not persisted long-term — only the aggregated daily rollups survive the 90-day window.
Device attestation (App Attest)
In proxy mode, the app proves its device authenticity to the Worker using Apple App
Attest. This generates a per-device cryptographic key on your device that signs
requests.
No personal identifier is sent. App Attest key IDs are device-specific random keys, not user identities.
Key IDs are hashed/redacted in all logs (shown as abcd…wxyz).
The per-device counter used for replay protection is stored in a Cloudflare Durable Object; it contains no personal data.
Data stored locally on your device
OCR cache
Memory-only (NSCache) for the current app session; it may be evicted earlier under memory pressure.
The app no longer persists OCR cache entries to UserDefaults; any legacy entries from older builds are purged on launch.
Clear it from Settings → Data & Privacy → Clear local data → Clear OCR cache.
Scan history
Stored in SwiftData on iOS 17+ for the history feature.
Each entry contains: scan date, language code, a 128 px thumbnail, and detected dish fields (original text, translation, romanisation, price, category, source, uncertainty flag, confidence).
Retained for up to 30 days; records older than 30 days are pruned on launch.
Clear it from Settings → Data & Privacy → Clear local data → Clear scan history.
App settings and preferences
Small local preference values needed for normal operation, including:
selected app language
AI processing consent state
preferred text-to-speech provider and related UI settings
onboarding completion state
developer-only local toggles in debug workflows
API keys (BYOK mode only)
If you use bring-your-own-key mode, your provider API keys (OpenAI, Gemini, ElevenLabs) are stored in the iOS Keychain with kSecAttrAccessibleWhenUnlockedThisDeviceOnly and never leave the device except as authentication headers to the provider you chose.
They are never logged, never included in memory snapshots, and never sent to our Worker.
Data the app does not store
Full-resolution menu photos (ephemeral, in-memory only during analysis).
Raw OCR text logs in release builds.
Remote telemetry payloads outside the app container.
Remote telemetry and crash reporting
The app sends a minimal, allowlist-governed set of remote diagnostics to the Worker for
operational monitoring:
Crash and hang diagnostics via Apple MetricKit: only crashType, app version, osVersion, and a hashed crash bucket are sent. No full stack traces, no raw exception reasons.
Never sent: raw menu text, photos, OCR text, URLs, API keys, exception reasons, or unrestricted free-form fields.
All remote events are filtered through a fixed field allowlist and capped at 8 KB
per event. Unknown or dropped events fail closed (they are not forwarded).
Data retention
OCR cache: memory-only, session-scoped, evictable earlier under memory pressure.
Scan history: 30 days maximum (pruned on launch).
App settings: until changed or app data is removed.
API keys (Keychain): until reset by you or removed by the app.
Remote metrics rollups (Worker KV): 90 days.
Remote telemetry raw events: not persisted long-term (only the 90-day aggregated rollups survive).
Your rights and choices
Clear local data: Settings → Data & Privacy → Clear local data lets you clear scan history and the OCR cache at any time.
Uninstall: removing the app deletes the app container and its local SwiftData/UserDefaults data. Keychain items may persist independently until you remove them.
BYOK control: in bring-your-own-key mode you choose which providers receive your data by providing (or withholding) your own API keys.
No account to delete: because we do not collect account identifiers, there is no server-side account profile to delete.
Children
Menu Renzu is not directed at children under 13 and is not marketed to them. We do not
knowingly collect any personal information from children. The app has no age-gated
content and no features intended for minors.
No account, no login
Menu Renzu does not require and does not collect names, email addresses, phone numbers,
or any account identifier. There is no sign-up and no login. The only identifiers
involved are device-specific App Attest keys, which are random and not tied to your
identity.
Third-party providers
Menu Renzu makes AI calls to Google Gemini, OpenAI, and (optionally) ElevenLabs via
Apple’s URL session directly — no third-party SDK binaries are bundled in the
app. The data sent to those providers is governed by their respective privacy policies:
For privacy questions or requests about this policy or the Menu Renzu app, contact:
privacy@menurenzu.app
Changes to this policy
If we change this policy, we will update the “Last updated” date above and
reflect material changes in the app where appropriate. Continued use of the app after a
change constitutes acceptance of the updated policy.