Legal

Privacy Policy

Last updated: May 19, 2026

1. Summary

MenuBrat collects the minimum data needed to run a dish-review service. We never sell your data. We use a small number of well-known infrastructure providers to host and operate the service. This page explains exactly what we collect, why, and how to remove it.

2. Who we are

MenuBrat is operated by Mo Merheb. Contact: mo.merheb@gmail.com.

3. What we collect

3a. Account data (when you sign in)

• Email address (from Google Sign-In or magic link)
• Display name (if provided by Google)
• Your chosen taste profile
• Reviews you submit (rating, optional note, optional photo)
• Lists of dishes you curate
• Anti-fraud signals attached to each review you post — the IP address, browser/user-agent, and an optional device identifier at the time of posting. We use these only to detect and prevent fake or coordinated (bot/“Sybil”) reviews, never for advertising, and we retain them for up to 90 days (see retention below).

3b. SMS Menu Submissions (when restaurants text our number)

If you text our published number to submit a menu photo, we collect:

• Your phone number (so we can reply)
• The photo(s) and any accompanying text you send
• Twilio message metadata (timestamps, message ID)

We use this information only to:

• Reply to confirm receipt of your menu;
• Match your submission to an existing restaurant listing or create a new one;
• Send you a confirmation reply with the link to the resulting listing.

Mobile information (including phone numbers and SMS opt-in data) will not be shared with third parties or affiliates for marketing or promotional purposes. All categories above exclude text-messaging originator opt-in data and consent — this information will not be shared with any third parties.

This is a consumer-initiated program: we only message you in reply to a menu you texted us, never as unsolicited marketing. Message frequency varies — typically 1–5 messages per submission. Message and data rates may apply.

We do not share your phone number with restaurants, advertisers, or third parties. We do not use it for marketing. Reply STOP at any time to opt out and we'll stop messaging you and delete the submission. Reply HELP for assistance, or see our SMS Terms for the full messaging policy.

3c. Browsing data (everyone)

• Standard web server logs (IP address, browser, referrer, requested URL, response code) retained for 30 days for security and debugging.
• No third-party analytics, advertising, or behavioral-tracking cookies. We use only essential cookies for sign-in sessions.

4. Infrastructure providers (data processors)

We use these third-party services to run MenuBrat. Each has its own privacy policy:

• Supabase — database (Postgres) and authentication. supabase.com/privacy
• Cloudflare — website hosting, image storage (R2), serverless compute (Workers), DNS. cloudflare.com/privacypolicy
• Twilio — SMS/MMS messaging for the Menu Submission service. twilio.com/legal/privacy
• Google — Google Sign-In, used only for authentication when you choose it. policies.google.com/privacy

5. How we use your data

We use your data only to:

• Operate the Service (let you sign in, post reviews, browse rankings);
• Weight dish scores by taste profile (using the snapshot of your profile at the time you posted each review);
• Reply to Menu Submissions and confirm restaurant listings;
• Diagnose security and reliability issues.

We do not sell your personal information. We do not use it for behavioral advertising.

6. Your rights

You can:

• Access your data — sign in and view your profile and reviews;
• Edit or delete individual reviews from your account;
• Change your taste profile at any time;
• Request deletion of your entire account and all associated data — email mo.merheb@gmail.com and we'll process within 14 days;
• Opt out of SMS replies by texting STOP to the Menu Submission number.

If you are in the EU, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA. To exercise them, email us — we'll comply.

7. Children

The Service is not directed at children under 13 and we don't knowingly collect data from them. If you believe a child has signed up, email us and we'll remove the account.

8. Data retention

• Account data: while your account exists, plus 30 days after deletion for backup purges.
• Reviews and photos: deleted with your account.
• Per-review anti-fraud signals (IP, user-agent, device identifier): up to 90 days, then dropped or anonymized; deleted sooner with your account.
• SMS Menu Submissions: kept while the submitted menu is in use on the site. Removable on request.
• Web server logs: 30 days.

9. Changes to this policy

We'll update the "Last updated" date at the top when we make changes. Material changes will be flagged in-product.

10. Contact

For privacy questions or to exercise any of the rights above, email mo.merheb@gmail.com.