CartaPrivacy policy
Carta is an iPhone app that reads restaurant menus and recipes for you. This page explains what data Carta handles, why, where it goes, how long it is kept, and what you can do about it.
Who is responsible
Carta is made and run by Torsten Terp, a private individual in Denmark (there is no company behind it). He is the data controller. Contact: privacy@carta-app.dk.
What we handle, and why
Photos you scan
When you scan a menu, the photo is sent to our server and on to our AI provider (Anthropic), which reads the dishes. The photo itself is deleted as soon as processing ends, normally within a minute. We keep a fingerprint (a hash) of it so that scanning the same photo twice doesn't cost you a second scan.
For each dish we keep a small cut-out of the photo, so you can compare Carta's reading with the printed menu. These cut-outs are kept as long as the menu exists.
Recipe photos are never stored. The recipe Carta reads from them is kept, without any link to you, so the same page is quicker to read again.
Menus and what you save
- Menus: the dishes read from the menu, the restaurant name (read from the card, or the one you confirm), and your chosen language and currency.
- If you have an account: the menus you scan while signed in, the recipes you save, and your notes on dishes are linked to your account, so they follow you to a new phone.
- Without an account: your menus are linked only to a random device identifier (below), not to you.
A menu and its cut-outs can be opened by anyone who has its link. The links are long random codes that we never publish.
Your account
You create an account with Sign in with Apple. We store your name and email address as Apple provides them (this can be an Apple "Hide My Email" address), a reference to your Apple ID, your country, your language and currency settings, and how many free scans you have used. Accounts created on the old Menu SOS website may also hold an encrypted (hashed) password; it is only used to confirm deleting that account.
Device identifier
The app creates a random identifier on your phone and sends it with your scans. It counts your free scans, keeps menus you scanned without an account together, and lets you delete them when you delete your account. It says nothing about who you are. It is stored in your iPhone's keychain, which can keep it even if you delete and reinstall the app.
Location
Only if you allow it, and only while you use the app. Your position is used on your phone to suggest the restaurant you're in and to show the local food guide. Looking up places and addresses is done by Apple's own iPhone services. Your coordinates are never sent to Carta's servers. What can reach us is the restaurant name you confirm, and which region's guide you open.
Wine suggestions
When you ask why a wine suits your table, the names of the dishes you picked and the wine are sent to Anthropic to write the explanation. Nothing that identifies you is included.
Technical logs
Like any web service, our server logs requests: your IP address, the time, and the address requested (identifiers in it are masked). We use this to keep the service running, find errors and stop abuse, for example by limiting how many scans one address can make. We don't store IP addresses in our database.
What we don't do
No advertising, no tracking across apps or websites, no analytics tools, and no selling of data.
Legal basis
- Providing the service you ask for (GDPR art. 6(1)(b)): scanning, your account, saved menus, recipes and notes.
- Legitimate interests (art. 6(1)(f)): security, preventing abuse, fixing errors, and counting free scans fairly.
- Your permission: location, which you control in your iPhone's settings.
Who else handles your data
| Provider | What for | Where |
|---|---|---|
| Fly.io | Our server and database | Stockholm, Sweden (EU) |
| Cloudflare (R2) | Storage for photos while processing, dish cut-outs, and dish illustrations | EU |
| Anthropic | AI that reads menus and recipes and writes wine explanations | USA |
| fal.ai | Draws dish illustrations from the dish name and description (never your photo) | USA |
| Expo | Delivers app updates; sees your IP address and a random installation ID | USA |
| Apple | Sign in with Apple, app distribution, and the iPhone's location services | Global |
Providers in the USA receive data under their data processing terms, which use the EU Standard Contractual Clauses to protect transfers out of the EU.
How long we keep it
| Data | Kept |
|---|---|
| Menu photo | Until processing ends, normally under a minute |
| Menus and dish cut-outs | As long as the menu exists: until you delete it or your account |
| Saved recipes and notes | Until you delete them or your account |
| Account details | Until you delete your account |
| Device identifier and free-scan count | Kept, so the free allowance can't be reset by reinstalling |
| Recipes read from photos (not linked to you) | Kept as a shared cache |
| Server logs | Briefly, for operations |
| Database backups | Around 5 days |
Your rights
You can ask for access to your data, correction, deletion, restriction, a copy to take elsewhere, and you can object to processing based on legitimate interests. Write to privacy@carta-app.dk; we answer within a month.
Deleting your account is built into the app: tap the account icon in the top-right corner, then Delete account. That deletes your account, your menus and their cut-outs (including menus scanned on that phone before you signed up), your saved recipes and your notes. Menus scanned without an account on other phones can't be connected to you. If you want those deleted, write to us.
You can also complain to the Danish Data Protection Agency, Datatilsynet.
Changes
If we change how Carta handles data, we update this page and the date at the top.