Privacy Policy

Allergy Tree LLC ("Allergy Tree," "we," "us") provides software that lets restaurants publish menu and ingredient information and lets diners check it against their own dietary restrictions. This policy explains what we collect and why. It covers our website, our diner tools, and our restaurant dashboard. To reach us about privacy, use the contact form on our About page.

If you scan a menu without an account.When you pick your restrictions and continue, we record the restaurant location, the menu, the time, the standard allergens you selected, a device type (phone, tablet, or computer), and a random identifier stored in your browser that lets a restaurant count repeat visits. The identifier contains no allergy or personal information and is never used to look up or fill in your restrictions. Free-text terms you type under "Other" are used on your screen to match the menu and are not saved in this record.

If you create a diner account. Your email address, a password (stored only as a one-way hash), your saved dietary restrictions and cross-contact preference, and optional details such as your name, username, and profile photo. If you leave a review, we store the review, any photo you attach, and a snapshot of your saved restrictions at that time.

If you are a restaurant or team member. Your email address, a hashed password, your restaurant and location details, and the menu, ingredient, and allergen information you enter. If you upload a menu or product-label photo to import it, we send that image to an AI provider to extract the text (see section 5). Payment is handled by Stripe. We never see or store your full card number; we keep only Stripe customer and subscription identifiers, your plan, and your subscription status.

If you use "Use my location." Only when you tap it and allow your browser to share it, your approximate coordinates are sent with your search to find nearby restaurants. We use them to run that search and do not save them to your account.

If you contact us. The name, email, and message you submit through our contact and access-request forms.

Your restrictions are health-related information, and we treat them with extra care. We collect them only to provide the screening you asked for. We do not use them for advertising, do not sell them, and do not build profiles about you from them. More detail, including how to exercise your rights over this information, is in our Consumer Health Data Privacy Policy.

• To show you which menu items match your restrictions and suggest substitutes.
• To run your account, sign you in, send account emails (verification, password reset, invites), and take payment from restaurants.
• To show restaurants anonymous usage totals for their own locations.
• To keep the service secure, prevent abuse, and fix problems.
• To answer your messages and meet legal obligations.

Restaurants. A restaurant sees aggregate information about scans at its own locations, such as how many scans mentioned each allergen and when. It does not see your name, email, or account from a scan. If you post a review, the restaurant can see it along with your display name and the restrictions attached to it.

Reviews are public.A review you post can be seen by other visitors to that restaurant's page, including your display name, any photo you add, and the restrictions attached to the review so other diners can find relevant experiences.

Service providers who process data for us.

• Stripe, for restaurant subscription payments.
• Resend, for sending account and contact-form emails.
• Anthropic, whose AI model reads menu and product-label images that restaurants upload, so text can be extracted. We do not send diner data to it.
• Our cloud database and hosting providers, which store and serve the service.

These providers may only use the data to perform services for us. We do not sell personal information and do not share it with advertisers or data brokers.

Legal and safety.We may disclose information if required by law or to protect people's safety or our rights. If Allergy Tree is involved in a merger, acquisition, or sale, information may transfer as part of that deal, and we will tell you if your information becomes subject to a different privacy policy.

We use only what the service needs. We do not use advertising or analytics cookies.

• allergytree_session (cookie): keeps you signed in. It is set when you log in to a diner or restaurant account.
• allergytree:device-profile(browser storage): saves your restrictions on this device only if you check "remember on this device." Use "Not you? Clear" to remove it.
• allergytree:analytics-id(browser storage): the random identifier described in section 2. It is not used on shared kiosk devices. Clearing your browser's site data removes it.

Restaurants can run Allergy Tree on a shared device for staff. In that mode there is no login, no saved profile is loaded, and the device never offers to remember anyone. The guest's selections clear when staff tap "New customer," and also automatically after two minutes without activity.

Staff using a shared device enter their own name, which is saved with the time and what they searched for so the restaurant can see its own activity. A restaurant can also keep a list of its staff names so they can pick their name from a dropdown. Only the restaurant's own staff names are used, never a guest's.

• Account information: for as long as your account is open. When you ask us to delete your account, we delete your profile, saved restrictions, and reviews within 30 days, except payment records we must keep by law.
• Scan records: they are not linked to your identity, and we keep them so restaurants can see trends. They are deleted when the restaurant location is removed from Allergy Tree.
• Contact messages: as long as needed to respond and keep a record of the conversation.
• Backups held by our database provider may retain deleted data for a limited time before they are overwritten.

• Access and correct: view and edit your saved restrictions and profile in your account settings.
• Delete: ask us to delete your account and associated data using the contact form. We will confirm once it is done.
• Clear a device: use "Not you? Clear," or clear your browser's site data, to remove anything Allergy Tree stored on a device.
• Emails: you can opt out of non-essential emails at any time. We may still send account and security messages.
• Location: you control whether your browser shares it, and you can search by city instead.

We offer these choices to everyone, wherever you live. If you live in a state with a privacy law (for example California, Colorado, Connecticut, Virginia, or Washington), you may also have rights to know, access, correct, delete, and opt out of the sale or sharing of your data. We do not sell or share personal information for advertising. We will not treat you differently for exercising your rights. If we decline a request, you can reply to ask us to reconsider, and you may contact your state attorney general.

Passwords are stored as one-way hashes, sessions use secure cookies, and data is encrypted in transit. No online service can promise perfect security, so please use a strong, unique password. If a breach affects your information, we will notify you as the law requires.

Allergy Tree is not directed to children under 13, and we do not knowingly collect personal information from them. A parent or guardian can use the service to check a menu for a child. If you believe a child has created an account, contact us and we will delete it.

Restaurants decide what menu and ingredient information to publish and are responsible for its accuracy, as set out in our Terms. If a restaurant collects information from you directly, outside Allergy Tree, that restaurant's own privacy practices apply to it.

We will update the date above when this policy changes. If a change materially affects how we handle allergy or dietary information, we will give notice on the site and, where the law requires it, ask for your consent before applying the change to information we already hold.

Questions or requests about privacy? Reach us through the contact form on our About page.