Privacy

Updated 2026-10-07. Covers the Piggy Nose website and mobile app.

Menus and AI processing

Menu photos you take or upload are sent to our server and, through Vercel AI Gateway, to AI providers. Menu reading mainly uses Google models; explanations and Q&A may use OpenAI; illustrations use Black Forest Labs. When you ask for recommendations we send the taste details you entered. Providers handle requests under their own terms and data policies. Please don’t upload ID documents, payment details or unrelated personal photos.

What we keep

To avoid reading the same menu twice, the restaurant name, address and other identifiers visible on a menu, plus dishes, prices and translations, are kept as a shared menu cache for up to 90 days. Other people who photograph the same menu may reuse these results after a content check. Account details, saves, conversations, personal edits and photos uploaded by restaurants never enter the shared cache. We don’t keep the original scan photo in the app database; we keep the recognised dish names, descriptions, translations, prices and generated images. Anonymous menus are accessible for 7 days by default. Shared dish images may be kept for 90 days. Photos, menus and account details that restaurants publish are kept as restaurant content.

To diagnose problems and prevent abuse we log anonymous session IDs, recognition time, success or error status, model usage and necessary request logs. Scan snapshots, logs and feedback are cleaned up after 7 and 90 days respectively; cleanup may not happen at the exact moment they expire. Infrastructure providers may keep their own security and operations logs.

Your account, taste and saves

Signing in is required. Your name, email, taste settings, saves and personal menus are stored in your cloud account; personal menus are kept until you delete the account. We record sign-up time, last sign-in and sign-in count for operations and security. Passwords are stored as salted hashes. You can clear taste settings, remove saves or delete your account under Me; uninstalling the app doesn’t delete cloud data. Accounts with restaurant or admin access need to contact support to transfer access first.

Membership and payments

Membership checkout is hosted by Stripe. When you start checkout or manage a subscription, we share your account email with Stripe and create a customer record. Card details are collected on Stripe’s hosted page; we never store full card numbers. We keep Stripe customer and payment event IDs to check your subscription, provide your scan allowance and handle refunds and disputes. Deleting your account doesn’t delete payment records we must keep by law or to resolve disputes. Stripe handles payment data under its own privacy policy.

Analytics and Google sign-in

We use Vercel Web Analytics to count daily visitors, page views, referrers and device types. No email or menu content is sent to analytics. Query strings and private menu IDs are stripped, and admin and sign-in pages aren’t tracked.

If you sign in with Google, Clerk handles authentication and we keep your verified email, name and an account link ID. We never receive your Google password. Linking Google to an existing email account requires that account’s password.

Image sources and usage events

Reference photos may come from Wikimedia Commons; loading them makes your device request the image from its host. Restaurant pages log menu views, language choices, dish views and recommendation use to give restaurants aggregate usage. We don’t use these events for cross-app advertising and we don’t sell them.

Contact and deletion requests

Messages and optional emails sent through the support form are stored in an access-controlled admin area and used to handle your request. You can ask to access, correct or delete your data; we may ask for a menu link or other proof of ownership. If you have an active subscription, cancel it and let it end, or contact support, before deleting your account.