Privacy Policy

Version 1.0 · Effective 1 September 2026

Foretaste reads a photograph of a menu and gives it back to you translated. That one sentence is most of the privacy story: a picture of a menu goes out, a translated menu comes back, and almost nothing else moves.

Leaves your phone

The menu photograph, or the menu text you paste
The language you want it read into
An anonymous per-install ID

Never leaves your phone

Your dining preferences, allergies and avoided foods
Everyone you have added to your table
Saved scans and their dish pictures
Every setting in the app

Who this is

Foretaste is an iPhone app published by an independent developer. The app talks to one service, the Foretaste service, run by the same developer at api.wxy.one. Questions, complaints and requests all go to support@wxy.one, and there is more about that on the support page.

What the app sends, and why

The menu photograph Sent when you scan. It is resized on your phone first and uploaded as a JPEG. It is the input to the whole feature: reading the dishes off the card is the thing you opened the app to do.

Menu text you paste If you type or paste a menu instead of photographing one, that text is sent in place of a photograph and used the same way.

Your reading language Which language to translate the menu into.

An anonymous install ID A random identifier created the first time you open the app and kept in the iOS keychain. It exists so one install gets one share of the daily scanning limit, instead of everybody on a café's Wi-Fi counting as a single user. It is not your Apple Account, not the advertising identifier, not the vendor identifier, and not derived from your device or from you. It means nothing anywhere except this service's rate limiter. Deleting the app and reinstalling produces a new one.

A dish name and its description When dish pictures are switched on, the name and a short visual description of each dish — both produced from the menu — are sent so a picture can be drawn.

Your IP address Not sent by the app as such, but unavoidably visible to the service and its host because that is how an internet request arrives. It is used to deliver the response and to block abuse.

That is the complete list. The app contains no analytics SDK, no advertising SDK, no crash reporter that phones home, and no account system. There is nothing to sign in to and no profile of you anywhere.

What happens to a menu photograph

The photograph goes to the Foretaste service, which hands it to a language model that reads the text, translates each dish, and estimates ingredients, allergens and a taste profile. The service then draws a picture for each dish from the dish's name and description.

The service never stores your photograph. It reads the bytes, hashes them to make a cache key, passes them to the model, and drops them. Nothing writes them to disk, to a bucket, or to a log. The model provider that reads the photograph is a different matter: it receives the image, and what it keeps is governed by its own terms — providers typically retain a prompt for a limited period to monitor abuse.

How long anything is kept

The photograph — not kept Dropped when the response is produced. See above for the model provider's own logs.

The reading derived from it — kept indefinitely The translated dishes, their descriptions and ingredient lists are cached so that scanning the same menu again is fast and costs nothing. The key is a hash of the photograph, the language and the model — the row carries no identifier of who scanned it, and the key cannot be turned back into your photograph. There is no expiry on it.

Generated dish pictures — kept, and shared Stored under the dish's name, so the same picture serves everyone who later scans that dish. They contain nothing of yours.

Your install ID — never kept as you sent it The service immediately reduces it to a salted hash. That handle names a counter — five numbers, no record of what you asked for — which is deleted after 25 hours of silence. A further-truncated form of the handle appears in the service's own logs, which are kept for days rather than indefinitely.

Request logs — days Our host records the usual network details of a request, including your IP address, and retains them briefly for security and abuse prevention.

Nothing joins those two halves. The cached reading of a menu carries no identifier; the identifier's counters carry no menu. Your install ID is never sent to a model provider.

Other people in the frame

A menu photograph taken in a busy restaurant can catch other diners, a waiter, or a neighbouring table. Foretaste has no interest in any of that and no ability to recognise a face, but the photograph is uploaded as taken. Frame the card, not the room — and if someone else is in shot, take the picture again.

Who else processes it

The service is not the last stop for a menu photograph. These are the processors it relies on, and the only ones:

Cloudflare Hosts the service and stores its caches, and handles the network request. Its logs include IP addresses, kept briefly for security and abuse prevention.

Google (Gemini) Reads and translates the menu. The photograph, or the menu text you pasted, is sent to Google's API for that and nothing else.

OpenAI Draws the dish pictures, from a dish name and a short description — never from your photograph. The app names the image provider actually in use under Me → Settings → Menu Service, because the service can be configured to draw with Google or with Cloudflare's own models instead.

They are processors acting on the service's instruction, and they receive a menu — never your install ID, and never anything about you. Nothing is sold, rented, shared for advertising, or handed to a data broker: there is no such arrangement and no plan for one.

What stays on your phone

Your dining preferences, your allergies and avoided foods, the people you have added to your table, your saved scans and every dish picture in them, and every setting on the Settings screen live in the app's own storage on your device. They are never uploaded. There is no cloud backup of them run by us; they travel only in an encrypted iPhone backup you make yourself, if you make one.

The consequence is worth stating plainly: if you delete the app, that data is gone. There is no server copy to restore from.

Your choices

Don't scan. Nothing leaves your phone until you take a picture of a menu and start a scan.
Turn off dish pictures. Me → Settings → Menu Service stops the app requesting drawn dishes at all.
Erase everything. Me → Settings → Reset Foretaste deletes every saved scan, every dish picture, everyone at your table and every setting, and starts the app over. Deleting the app removes the install ID with the keychain item.
Camera and photos. iOS asks before the app can use either, and you can withdraw that in the Settings app at any time.

Your rights

Depending on where you live — the EU or UK under the GDPR, California under the CCPA, and elsewhere — you have rights of access, correction, deletion, portability and objection over personal data held about you. Write to support@wxy.one and we will answer within 30 days.

An honest limitation: because the service keeps no account and nothing that links a scan to a person, we usually cannot find "your" data to hand over or delete — there is no key to look it up by, and we will not ask you for more identifying information than we hold in order to invent one. Almost everything personal Foretaste knows about you is on your phone, under your control, and erasable in the app. Where a request does concern something we can identify, we will act on it.

The legal basis for processing a menu photograph is the performance of the service you asked for; for the install ID and request logs it is our legitimate interest in keeping a free service affordable and unabused. EU and UK users may complain to their data protection authority.

Children

Foretaste is not directed at children under 13 and does not knowingly collect anything from them. It has no social features, no messaging and no profile.

Security

Everything between the app and the service travels over HTTPS. The service holds the model API keys so the app never carries one. No system is perfect, and this one is run by one developer; what limits the damage is that there is so little held — no account, no password, no contact details, no payment information, and no store of your photographs.

Where data is processed

The service runs on Cloudflare's global network and its model providers operate primarily in the United States, so a menu photograph is likely to be processed outside your country, including in the US. Standard contractual clauses or the providers' equivalent transfer mechanisms cover those transfers.

Changes

If this policy changes, the version and date at the top change with it, and a material change will be called out in the app's release notes. The current version always lives at foretaste.wxy.one/privacy.

Contact

support@wxy.one — for privacy questions, data requests, or anything on this page that reads as if it is hiding something. It shouldn't be.