How What Can I Eat Here handles your data.

1. Overview

What Can I Eat Here helps users save dietary preferences, search restaurant menus, receive AI-assisted meal suggestions, save meals, and manage account features. The service is intended to make restaurant ordering easier, but it is not a medical device and does not replace professional medical, nutrition, allergy, or healthcare advice.

This policy applies to the What Can I Eat Here website, mobile applications, account portal, subscription features, AI menu analysis, support requests, and related tools operated by Prestige Worldwide Labs. The Apple App Store developer account is Joshua Cameron. Privacy questions for either listing can be sent to hello@whatcanieathere.com.

2. Data We Collect

We collect information that users provide directly, information created while using the service, and technical information needed to operate and secure the platform.

Biometric login, when enabled in the mobile app, uses the device operating system's authentication tools. We do not receive or store fingerprint, Face ID, or biometric templates.

Diet choices, allergies, weight entries, and meal logs may reveal health information. Some optional diet choices may also reveal religious beliefs or pregnancy-related preferences. We treat those details as sensitive and use them to provide the requested account and meal-personalization features, not for advertising targeting.

3. How We Use Data

• Create, authenticate, secure, and maintain user accounts.
• Save dietary preferences and synchronize account information between the website and mobile apps.
• Analyze restaurant menus and provide personalized order suggestions.
• Save favorite meals, saved orders, meal logs, and plan preferences.
• Operate free and paid membership limits, including Plus features.
• Process subscriptions, payment status, account upgrades, and billing-related support.
• Prevent fraud, spam, abuse, unauthorized access, and excessive API usage.
• Provide customer support, account notices, service updates, and legally required communications.
• Improve the service, debug technical issues, and understand aggregate usage trends.

4. Sharing And Service Providers

We do not sell private account credentials, password hashes, payment card numbers, or individual diet profiles. We share information only as needed to operate the service, provide features requested by the user, comply with law, or protect the service.

• AI provider: OpenAI processes the restaurant/menu information, location text, and selected dietary preferences described below to generate recommendations. We do not send the account password or payment credentials to OpenAI. Personal information that a user puts in menu text or notes may be included in the request.
• Payment providers: Paid subscription activity is processed through PayPal. PayPal handles payment information under its own privacy practices.
• Hosting, security, and infrastructure providers: Website hosting, storage, logging, email, and security systems may process information needed to operate the service.
• Delivery and ordering partners: No delivery-provider ordering integration is currently active in the mobile apps. Before activating an integration, we will explain the selected provider and information to be shared and obtain any required permission.
• Legal and safety reasons: We may disclose information if required by law, legal process, fraud prevention, account security, or protection of users and the service.

5. AI Menu Analysis And Health Notice

When a user requests AI menu analysis, our server sends OpenAI the restaurant, menu text or menu information, supplied location text, and the relevant diet profile fields: diet, calorie target, allergies, foods to avoid, goals, and notes. The profile allowlist does not include the account name, email address, current weight, or goal weight. Avoid entering unrelated personal information in free-text fields.

In the mobile app, the first analysis requires explicit permission after a disclosure naming OpenAI and the data shared. In version 1.1.2 build 11 and later, acceptance is remembered for that account on that device for future searches. Declining sends no AI analysis request. Users can withdraw permission in Account > AI privacy; a new installation, account, or materially changed disclosure requires a new grant. Withdrawal stops future AI requests from that app until permission is granted again; it does not recall data already processed.

Our OpenAI Responses API requests set store=false, which disables response storage for that feature. This is not a promise of zero provider retention: OpenAI may retain information for abuse monitoring, security, or legal obligations under its applicable policies. See OpenAI API data controls for provider-side handling. We will disclose material changes to providers or sharing scope before requesting new permission where required.

AI recommendations are generated from the information users provide and from available restaurant or menu information. AI can be incomplete or incorrect. Users with allergies, medical conditions, pregnancy-related dietary restrictions, medication interactions, or other health needs should verify ingredients with the restaurant and consult a qualified professional.

6. Security And Data Handling

We use reasonable administrative, technical, and organizational safeguards designed to protect user information. These include HTTPS, password hashing, server-side session controls, mobile token storage, rate limiting, limited admin access, and abuse monitoring. No online service can guarantee absolute security, but we work to reduce unauthorized access, misuse, and accidental loss.

7. Data Retention And Account Deletion

We retain account information while an account is active or as needed to provide the service. Saved orders, meal logs, AI usage records, subscriptions, support records, security logs, and admin records may be retained as needed for service operation, accounting, legal compliance, fraud prevention, dispute handling, and safety.

Users can delete their account online at https://whatcanieathere.com/account/delete. Account deletion removes the user account, saved orders, meal logs, and usage records from the active account system. A limited deletion or security record may be retained where necessary for fraud prevention, compliance, audit, chargeback handling, or legal obligations. Active PayPal subscriptions may also need to be cancelled through PayPal.

8. Your Choices And Controls

• Users can update profile details, diet preferences, allergies, ZIP code, saved meals, and account details through the website or app where available.
• Users can choose not to provide optional diet, weight, allergy, craving, or meal-log details, but personalized recommendations may be less useful.
• Users can sign out of the app and website, disable biometric login in the app or device settings, and clear browser cookies through browser settings.
• Users can request help, correction, export, or deletion assistance by contacting hello@whatcanieathere.com.

9. Cookies, Local Storage, And Mobile Storage

The website uses cookies and server-side sessions to keep users logged in and protect account access. The mobile app stores login tokens using operating-system secure storage and keeps app settings, cached member data, and account-specific AI permission in local app storage. Signing out removes local login access; remembered AI permission can be withdrawn separately in Account > AI privacy.

First-party activity records include events such as sign-in, profile saves, searches, saved meals, and upgrade clicks. Records may include page paths, timestamps, referral or campaign identifiers, counts, and a hashed account identifier. Account-linked hashes are not anonymous. Older analytics records may also contain derived visitor identifiers; new visitor fingerprint derivation was disabled on September 15, 2026. Growth-event records are pruned on a rolling 90-day basis when new events are processed. Security, support, and billing records follow the retention purposes in Section 7.

10. Advertising, Affiliates, And Sponsored Placements

The mobile apps currently have no active third-party advertising SDK or targeted ad delivery. The advertising page accepts partnership inquiries. We do not use or disclose health information, allergies, weight, religious or pregnancy-related dietary preferences, or meal logs for advertising targeting, and we do not sell individual diet profiles to advertisers.

If contextual sponsored placements are introduced, they will be identified as sponsored and will not use sensitive diet or health information for targeting. Plus includes an ad-free experience. General referral or affiliate links may identify What Can I Eat Here as the referring service; they do not include private diet profiles. Material changes to advertising or data sharing will be reflected in this policy and the applicable consent and app-store disclosures before activation.

11. Children

What Can I Eat Here is not directed to children under 13. Users under the age required by their country, state, or app store rules should not create an account. If we learn that we collected personal information from a child in a way that requires deletion, we will take reasonable steps to delete it.

12. International Users

The service is operated from the United States. If users access the service from another country, their information may be processed in the United States or other places where our service providers operate. Users are responsible for deciding whether the service is appropriate for their local requirements.

13. Changes To This Policy

We may update this Privacy Policy as the service changes, including new app features, subscriptions, AI providers, delivery integrations, advertising features, or legal requirements. The effective date above will be updated when material changes are posted.

14. Contact

For privacy questions, account deletion help, or data requests, contact:

Prestige Worldwide Labs
What Can I Eat Here
Email: hello@whatcanieathere.com