Legal

Privacy Policy

Last updated: 23 July 2026

This policy explains what personal data OnlyMenuMaker.com ("OnlyMenuMaker", "we", "us") collects when you use our tip-menu design tool and website (the "Service"), why we collect it, who we share it with, and the choices and rights you have. We've tried to write it the way we'd want it explained to us — specifically and without legal fog.

The short version: we collect the minimum we need to run the Service — an email and password for your account, whatever you choose to save in your menus, purchase status from our payment partner, and standard analytics. We don't sell your data, we don't run ads, and we never see your card details.

1. Data we collect

a) Account data (only if you create an account)

• Email address — used to sign you in and to contact you about your account or purchases.
• Password — stored only as a salted scrypt hash. We cannot see your actual password.
• Optional creator profile — a display handle, Instagram username, and TikTok username, if you choose to add them so your menus auto-fill. You can edit or blank these at any time in your account.
• Account creation date, plan status (free/trial/Pro), and a counter of any clean downloads used in the current period.

You can use the design tool without an account; an account is only needed for cloud saves and purchases.

b) Content you save

• Saved menus — if you click "Save to my account", the menu (its text, prices, styling, stickers, and any photos you placed in it) is stored on our server so you can reopen it on any device.
• Photos — images you add in the editor are processed inside your browser. They are only sent to our server as part of a menu you explicitly save. If you never save, your photos never leave your device.

c) Purchase data

• Payments are handled by our third-party payment partner. We receive and store your purchase and subscription status (e.g. trialing, active, cancelled, refunded) so we can unlock Pro features. The payment partner — not us — collects your card or payment details and billing information under its own privacy policy.

d) Technical data

• Server logs — like nearly every website, our web server records requests with IP address, timestamp, URL, and browser user-agent, used for security and debugging, and rotated on a short schedule.
• Rate-limiting — our API briefly tracks request counts per IP address in memory to block abuse; this is not written to disk.
• Analytics — we use Google Analytics 4 to understand which pages are used, in aggregate (see cookies below).

e) Support messages

• If you email us, we keep the correspondence so we can help you and keep a record of what was agreed.

2. Cookies and browser storage

We use a small number of cookies and localStorage keys:

Essential storage is required for the Service to work. Analytics cookies are not: you can block them with your browser settings or a content blocker and the Service works fine. localStorage entries stay on your device until you clear your browser data or log out (which removes the session token).

3. Why we use your data (and legal bases)

• To provide the Service — sign-in, cloud saves, unlocking Pro, enforcing the free monthly download quota. Legal basis: performance of a contract.
• To take payment and fight fraud — verifying your subscription status with our payment provider, handling refunds and chargebacks. Legal basis: contract and legitimate interests.
• To keep the Service secure — logs, rate limiting, abuse prevention. Legal basis: legitimate interests.
• To improve the Service — aggregate analytics about which pages and templates are used. Legal basis: legitimate interests / consent where required.
• To respond to you — support and account requests. Legal basis: contract and legitimate interests.

We do not use your data for advertising, we do not send marketing emails, and we do not sell or rent personal data to anyone.

4. Who we share data with

Only the processors we need to run the Service:

Beyond these, we disclose data only if the law genuinely requires it (e.g. a valid legal order), to protect the rights and safety of users, or — with notice to you — as part of a transfer of the business.

5. International transfers

Our servers are in the European Union. Some providers above (Cloudflare, Google, US-based payment partners) may process data in the United States or other countries; where they do, transfers rely on recognised safeguards such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses maintained by those providers.

6. How long we keep data

• Account, profile, and saved menus — for as long as your account exists. Deleted menus are removed from the live database immediately; short-lived backups age out on rotation.
• License/purchase status — for as long as needed to honour your plan and to meet the payment partner's refund/chargeback windows and our legal record-keeping obligations.
• Server logs — rotated on a short schedule (days to weeks, not months).
• Analytics — Google Analytics retention is set to the shortest available period.
• Support emails — kept as long as reasonably needed for support history.

7. Security

• All traffic to the Service is encrypted with HTTPS/TLS.
• Passwords are hashed with scrypt (a deliberately slow, salted algorithm) — never stored or logged in plain text.
• Sessions use random tokens; API endpoints are rate-limited per IP to slow down abuse.
• Card data never touches our servers — checkout happens entirely on the payment partner's systems.

No online service can promise perfect security, but if we ever learn of a breach affecting your personal data we will notify you and the relevant authorities as required by law.

8. Your rights and choices

Depending on where you live (e.g. GDPR in the EU/UK, CCPA/CPRA in California), you may have rights to access, correct, download, delete, or restrict the use of your personal data, to object to processing based on legitimate interests, and to complain to your local data-protection authority. Regardless of where you live, we honour these for everyone:

• Access / export — ask us and we'll send you a copy of the data we hold about your account.
• Correction — you can edit your email-visible profile fields in your account; for anything else, ask us.
• Deletion — email us from your account address and we will delete your account, profile, and all saved menus. Purchase records may be retained where the law requires it (e.g. tax records held by the payment partner).
• Analytics opt-out — block the _ga cookies, use a content blocker, or Google's opt-out browser add-on.

To exercise any right, contact [email protected]. We respond within 30 days at the latest.

9. Children

The Service is strictly for adults 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete the account and its data.

10. Changes to this policy

If we change this policy, we'll update the date at the top; for material changes we'll give notice on the site or by email before they take effect. Older data practices are never applied retroactively in a way that reduces your rights without your consent.

11. Contact

Privacy questions or requests: [email protected] · Contact page.