MENULET · 小酒单
Privacy
Your cabinet belongs to you. This policy explains what stays on your device, what can sync through iCloud, and what is processed when you choose cloud recognition.
Last updated October 12, 2026
Who we are
Menulet (小酒单) is developed and operated by Ziwei Liu. This policy covers the Menulet iPhone app, menulet.app, and the optional bottle-recognition service. Contact hello@menulet.app for privacy questions or requests.
Your cabinet, recipes, and journal
Menulet normally stores your bottles, custom ingredients, shopping list, favorites, personal recipes, and journal in a persistent database on your device. When iCloud is available, this data can sync through your private Apple iCloud account. We do not receive a copy of that private collection on our recognition server. Recent searches and the next party’s draft stay in local preferences and are cleared by Clear App Data. App preferences and the widget use local/shared app storage; some onboarding state also syncs through iCloud. If permanent storage fails, the app can temporarily use memory and warns you that changes may not be saved.
Photos and optional cloud recognition
Camera and photo access are used for the images you choose. On-device label reading and reading a pasted list or screenshot run on your device. If you choose cloud recognition, the app asks for consent before the first upload and identifies later cloud uploads in the photo flow. It resizes and re-encodes the chosen image as JPEG, then sends that image and your selected language over HTTPS to our service on Cloudflare. Our service sends the image to Anthropic for token counting and recognition. It does not forward your App Attest identifier or original IP address to Anthropic. Avoid including people or private information in a bottle photo.
Recognition results and provider retention
Our application code does not save uploaded images or the full recognition response in a server database or application logs. Results return to your device; bottles are added only after you confirm them. This does not mean all providers retain nothing. Anthropic’s standard API policy states that inputs and outputs are deleted within 30 days, with exceptions including safety, legal requirements, and other agreements. We do not claim a zero-retention agreement. Its commercial API data is not used for model training by default. See the provider links below for the current terms.
Security and service records
To protect the free recognition service, Apple App Attest verifies the app. Our server retains a hashed installation key identifier, its public key, replay counter, and daily usage counters. Cloudflare processes connection information such as IP addresses; the Worker hashes the IP address for rate limiting. We keep technical records such as random request IDs, dates, result/error codes, model and token usage, aggregate latency, and budget statistics. These records support security, reliability, and cost limits; they do not contain your cabinet or uploaded photo.
How long technical records remain
The current service does not automatically expire App Attest registrations or aggregate usage statistics. Completed request-ledger entries become eligible for cleanup after two days and are removed when maintenance runs; this is not a guaranteed 48-hour deletion deadline. Operational logs follow Cloudflare’s configured retention. We review technical records as needed for service operation and privacy requests. Clearing the app does not itself delete these server records or a provider’s retained data.
This website and support email
The website has no advertising trackers, analytics scripts, account sign-in, or application cookies. Fonts are served from our own site. Cloudflare still processes network and security information to deliver and protect the site. If you email us, your email address, message, and attachments are processed through Cloudflare Email Routing and our Gmail inbox. We keep correspondence as needed to answer and follow up on your request.
Your choices
You can use the app without cloud recognition, choose on-device reading, and manage camera/photo permissions in iOS Settings. You can export data, delete individual items, or clear app data in Menulet Settings. When iCloud sync is active, app deletions can propagate to your other devices; Apple controls its sync and backup retention. You can also manage Menulet’s iCloud data in your Apple account settings. Email us to request access, correction, or deletion of information we control; we may need enough information to locate and verify the request. Applicable privacy rights depend on your location.
Sharing and international processing
We do not sell personal information or use it for cross-app advertising. Apple, Cloudflare, Anthropic, and Google process information for the functions described above and under their own terms. Their infrastructure may process data outside your country. Sharing or exporting from the app sends only the content you choose through the destination you select, whose privacy policy then applies.
Age and policy changes
Menulet is intended for adults of legal drinking age, including 21 and older in the United States, and is not directed to children. If you believe a child has sent us personal information, contact us. We will publish material policy changes here and update the date above.