Privacy Policy
Last updated 22 October 2026
SpoonTip (“the app”, “we”) is built and operated by SpoonTip. This policy explains what data the app and this website handle, where it goes, and how you control it. We have tried to keep it short and specific. If anything here is unclear, email privacy@spoontip.com.
What leaves your device, and where it goes
| What | Where it goes | Why | Do we keep it on our servers? |
|---|---|---|---|
| Menu photos you scan, the language you want them in, and small copies of your photos | OpenAI or Anthropic | Reading and translating the menu; checking which way up a photo is and whether it shows a menu or a dish | Not the photos. If Anthropic read the menu, the menu text, for up to 24 hours |
| Text and photos you send in chat, with the menu, preferences and cart as context | OpenAI or Anthropic | Answering you and recommending dishes | If Anthropic answers, the conversation, for up to 30 days after your last message. Photos are not kept |
| Text you type in Talk to Staff | OpenAI or Anthropic | Translating it for restaurant staff | No |
| Your voice, when you use voice translation or dictation | OpenAI | Turning speech into text | No |
| Your approximate location (city level), only if you allow it | OpenAI or Anthropic | Giving the assistant local context; suggesting a local language | Not on its own. Your city is saved with a conversation Anthropic answers |
| The restaurant name you type during a scan, and your approximate location if you allow it | Apple Maps, directly from your device | Suggesting matching restaurants as you type | No |
| The restaurant name and city you confirm, when you ask about the restaurant | OpenAI or Anthropic | Introducing the restaurant and the dishes it and the region are known for | As for chat, below |
| A notification token, only if you allow notifications | Apple | Telling you when a scan or reply finishes in the background | No |
| Your email address and name | Supabase, our sign-in provider | Signing you in and showing your name in the app | Yes, while your account exists |
| A sign-in token from Apple, if you sign in with Apple | Supabase, our database | Revoking SpoonTip’s access at Apple when you delete your account | Yes, while your account exists |
| How many scans you ran each day | Supabase, our database | Enforcing the daily scan limit | Yes — we retain these counts |
| Dish names | Wikipedia and Bing | Finding dish photos | No personal data is sent |
| Currency codes | frankfurter.app | Converting menu prices | No — nothing personal is sent |
The details
Scanning a menu. Your photo, and the language you want the menu translated into, are sent over an encrypted connection to OpenAI or Anthropic, which reads the text and translates it. Small, low-resolution copies of your photos may also be sent to either provider to check which way up a photo is and whether it shows a menu or a dish. We do not keep any photo.
Which provider handles a request. In Settings → System → AI model you can choose who reads your menus and answers new chats: Automatic (the default), OpenAI, or Claude, which is Anthropic’s model. On Automatic, we choose. A chat you have already started keeps the provider it began with. If Anthropic is unavailable, a scan may be retried with OpenAI. For photo checks and Talk to Staff translations we choose the provider, and either may handle them. Voice goes only to OpenAI.
Chatting with the assistant. Whatever you type or send in chat — questions, photos, your answers to the assistant’s questions — goes to OpenAI or Anthropic to generate the reply, together with the context the assistant needs: the menu you are looking at, your preferences, your cart and, if you allow location, your city. To answer questions about restaurants, the assistant may search the web through the same provider’s search service. Your conversations are stored on your device. When Anthropic answers, we also keep the conversation and that context on our servers for up to 30 days after your last message, so the assistant can remember earlier messages; it is then deleted automatically. Photos you send are not kept: once answered, each is replaced with a short note. This copy is linked to your account. Clearing the app’s data on your device does not delete it before the 30 days are up; deleting your account does, or email us and we will delete it.
Restaurant suggestions. During a scan you can type the name of the restaurant you are in. As you type, the text goes from your device to Apple Maps, which suggests matching restaurants. If you have already allowed location, your approximate location is sent with it so nearby places come first; the app never asks for location just for this. We do not receive or store what you type here until you confirm a restaurant.
Asking about the restaurant. When you tap Restaurant Intro, House Signatures or Local Favorites, the restaurant name and city you confirmed go to OpenAI or Anthropic, like any chat message. For Restaurant Intro and House Signatures the provider may search the web with them; Local Favorites runs no search. These are stored like the rest of the conversation, as described above.
Talk to Staff. When you type a message in Talk to Staff, the text is sent to OpenAI or Anthropic to be translated. We do not store it. Spoken messages go only to OpenAI, as described under Voice.
Voice. When you use voice translation or dictate a message, your audio is sent only to OpenAI to be converted into text. We do not store the audio. This corrects an earlier version of this policy, which said speech recognition ran on your device — it does not.
Picking up where you left off. If your phone pauses the app while a scan or reply is still running, the work carries on and is waiting when you return. For this we keep a short record of the job on our servers for up to 24 hours, then delete it automatically. For scans and chats Anthropic handles, that record includes the finished result: the menu text or the assistant’s reply. It is linked to your app identifier so only you can retrieve it. We do not keep the photos.
What OpenAI and Anthropic keep. Each provider may keep requests for a limited time under its own terms, described in its privacy policy. OpenAI keeps scan and chat responses for up to 30 days, so the app can recover them and continue conversations. Neither uses this content to train its models: OpenAI’s API terms state that API content is not used for training, and Anthropic does not use API inputs, including uploaded images, to train its models.
Signing in. You sign in when you first open the app, with Apple, with Google, or with an email address and password. We store your email address and, from Apple or Google, your name. We use them only to sign you in and to show your name in the app. If you sign in with Apple, Apple shares your name only the first time, and you can choose to hide your email address, in which case we receive an address Apple forwards to you. We also keep a token from Apple so that, when you delete your account, we can tell Apple to remove SpoonTip’s access; it is deleted with your account. The app also uses an identifier from Supabase Auth to authorise access to our shared dish catalog and to count your daily scans. We do not send marketing email.
Location. Only if you grant permission, and only approximately, at about city level. It is sent to OpenAI or Anthropic as context when you ask the assistant about local food, and to Apple Maps while you type a restaurant name. We do not store your location, except that your city is saved with a conversation Anthropic answers, as described above. You can revoke permission at any time in iOS Settings → SpoonTip → Location.
Notifications. If you allow notifications, Apple gives the app a token that lets us tell you when a scan or reply finishes in the background. The token is sent with each request and used only for that. We do not store it.
What stays on your device. Your scan history, translated menus, cart, and preferences are stored on your device only. They are not sent to our servers and are not visible to anyone else. Menus you have already scanned open offline.
Scan counts. To enforce the daily scan limit we keep a count of how many scans your identifier ran each day. It contains no menu content, and we retain these counts.
Dish photos. Dish images shown in the app are loaded from our hosting provider, which sees your IP address in the ordinary way any web server does. We do not use this to identify you. To find photos for dishes, our server looks up dish names on Wikipedia and Bing. Only the dish name is sent, never anything about you.
Maps. Tapping a restaurant’s address opens it in Apple Maps or Google Maps. From that point you are in their app, under their privacy policy.
What this website handles
Early access. “Ask for early access” opens your email app. If you write to us, we keep your message and address to reply and to let you know when the app launches. We do not add you to a marketing list or share your address. Ask us to delete it at any time and we will.
Analytics. This website uses Vercel Web Analytics to count page views. It is cookieless. Each view records the page, the referring page, your country and city, and your browser, operating system and device type. Visitors are told apart by a hash that is discarded after 24 hours and is not tied to your IP address, so there is no per-person history. The script and its beacons load from spoontip.com itself, not from a third-party domain. Nothing else on this site — no fonts, scripts or images — is loaded from third parties.
What we do not do
- We do not track you across apps or websites.
- We do not show ads.
- We do not sell your data, or share it for advertising.
- We do not use analytics that profile your identity. The app has no analytics or crash-reporting SDK at all; the website’s page-view counter is cookieless and keeps no per-person history.
Third-party processors
| Processor | Purpose | Their privacy policy |
|---|---|---|
| OpenAI | Reading menus, photo checks, translation, chat, voice transcription, web search | https://openai.com/policies/privacy-policy |
| Anthropic | Reading menus, photo checks, translation, chat, web search | https://www.anthropic.com/legal/privacy |
| Supabase | Sign-in, shared dish catalog, scan counts, short-lived scan and chat records | https://supabase.com/privacy |
| Apple | Sign in with Apple, push notifications, restaurant suggestions (Apple Maps) | https://www.apple.com/legal/privacy/ |
| Wikipedia | Finding dish photos by dish name | https://foundation.wikimedia.org/wiki/Policy:Privacy_policy |
| Bing | Finding dish photos by dish name | https://privacy.microsoft.com/privacystatement |
| frankfurter.app | Exchange rates for price conversion | https://www.frankfurter.app/about |
| Vercel | Website hosting and cookieless page-view analytics | https://vercel.com/legal/privacy-policy |
Your rights and controls
- Clear everything on this device. In the app: Settings → System → Privacy → Clear All Data. This permanently removes every menu, cart entry, and preference from your device. Conversations we keep for chats answered by Anthropic stay on our servers until they expire after 30 days or you delete your account.
- Sign out. In the app: Settings → Account → Sign out.
- Delete your account. In the app: Settings → Account → Delete account. Or email privacy@spoontip.com and we will delete your account and its data, including any conversations we keep. If you signed in with Apple, we also remove SpoonTip’s access at Apple.
- Revoke location. iOS Settings → SpoonTip → Location.
- Ask us anything. Email privacy@spoontip.com with any privacy question or request.
Children
SpoonTip is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes to this policy
Material changes will be reflected in the “Last updated” date above and announced in the app on next launch.