Four LeafGreenlit
Privacy Policy
Last updated 13 October 2026
Greenlit reads restaurant menus and sorts the dishes against your diet. The personal part, your diets, allergies and the foods you avoid, is worked out on your phone and never sent to us. This page explains exactly what does leave your device, and why.
The short version.
- Your diets, allergies, food preferences and scan history stay on your phone.
- When you scan a menu, the photos are sent to our server and on to OpenAI so the menu can be read. We don’t keep the photos.
- We collect basic usage and crash data, tied to a random ID on your device rather than to your name. There are no accounts.
- No ads, no tracking across other companies’ apps or websites, and we don’t sell your data.
On this page
Who we are
Greenlit is made by Four Leaf (“we”, “us”). For any privacy question, or to use a right described below, write to support@tryfourleaf.com.
What stays on your device
This is stored on your iPhone and is not sent to us or anyone else:
- Your diet profile: the diets you follow, the allergies you flag, your avoid list, and the foods you mark as loved or disliked.
- Your scan history: the menus you’ve scanned, kept until you clear them (up to 50 menus), and your running totals.
- Menu photos: the photos behind your recent scans are kept on your phone for up to 28 days, for your 20 most recent scans, so you can check a menu against the original. They are excluded from iCloud backups.
- Your settings, such as appearance.
- A random install ID and a queue of usage events waiting to be sent (see below).
An allergy list says something about your body. That is why Greenlit works the way it does: the app decides which dishes suit you by running rules on your phone against the menu text, rather than sending your profile to a server.
You can delete this data yourself. Settings → Clear Scan History removes saved menus and menu photos immediately. Settings → Reset Profile clears your diets, allergies and preferences. Deleting the app removes everything stored on the device.
What leaves your device
Menu photos
When you scan a menu, the photos are sent over an encrypted connection to our scanning service, which forwards them to OpenAI to be read and turned into structured menu data. Photos you share into Greenlit from other apps are handled the same way. Before upload, each photo is resized and re-encoded, which removes metadata such as the time and location a photo was taken.
- The request contains the photos only. It does not contain your diets, allergies, preferences, name, email or location.
- We don’t store the photos. The extracted menu goes back to your phone and isn’t saved on our servers. We only log that a scan happened, as described under usage data below.
- OpenAI handles what it receives under its own API terms and data controls (see its data usage page). It may keep API inputs for a limited period under those terms. OpenAI states that data sent through its API is not used to train its models by default.
Usage and crash data
The app sends basic events to our own database, hosted by Supabase: which screens are opened, which buttons are tapped, when the app is opened or sent to the background, whether a scan completed or failed (and the kind of failure, and how many dishes it found), and crash diagnostics delivered by iOS. Each event carries your iPhone model, iOS version, app version, a random session ID, and a random install ID.
- The install ID is a random code generated the first time you open the app. It isn’t linked to your name, email, Apple ID or advertising identifier. Deleting the app removes it, and a fresh install creates a new one.
- We use these events to keep the app reliable, fix bugs, and decide what to build. We use no third-party analytics or advertising service.
- Right now there is no switch inside the app to turn this collection off.
Restaurant name search
When you name a menu or look for a restaurant, the text you type may be sent to Apple’s Maps search to suggest matching places. We don’t send your location, and the app doesn’t request it. Apple handles that search under its privacy policy.
Your IP address
Our scanning service sees the IP address your request comes from, as any internet service does. We use it to enforce a limit on scans per hour, so the service can’t be run up by abuse. For this the address is held in a short-lived counter alongside your install ID and removed during routine cleanup, typically within a few hours of inactivity. It isn’t joined to your scans or your usage events, and it isn’t shared. Our hosting provider may also keep its own standard infrastructure logs.
What we don’t do
- No accounts. This version doesn’t ask you to sign in, and we collect no name or email address.
- No location. The app doesn’t request or use your location.
- No advertising and no cross-app tracking. There is no ad network or attribution service in the app. Nothing about you is combined with data from other companies’ apps or websites, so the app doesn’t ask for App Tracking Transparency permission.
- No sale or sharing. We don’t sell your information or share it for cross-context behavioural advertising, as those terms are used in California law, and we don’t sell data to brokers.
Who receives data
| Provider | What it receives | Why |
|---|---|---|
| Supabase | Menu photos in transit; usage and crash events; IP addresses | Hosts the scanning service and our analytics database |
| OpenAI | Menu photos | Reads the menu from the photos |
| Apple | Restaurant name searches; App Store distribution | Suggests matching restaurants; delivers the app |
How long things are kept
- Menu photos on our servers: not retained. Retention by OpenAI follows its own terms.
- Usage and crash events: kept for as long as they help us understand and improve the app. We don’t yet apply an automatic deletion schedule.
- Scan-limit counters (including IP addresses): typically hours.
- On your device: as described above, or until you delete them or the app.
Your choices and rights
- Delete local data with Clear Scan History and Reset Profile, or by deleting the app.
- Revoke camera or photo access any time in iOS Settings. The app uses them only to capture or select menu photos.
- Access, correction, deletion. Depending on where you live, you may have rights over your personal information, for example under the GDPR or UK GDPR (access, rectification, erasure, restriction, portability, objection) or under California and other US state privacy laws. We hold no name or email for you, so we can usually act on data only if it can be tied to your install ID, which the app doesn’t yet display. Write to support@tryfourleaf.com and we’ll help where we reasonably can, and respond within 30 days.
- Where the GDPR applies, our legal basis for reading menu photos is performance of the service you asked for, and for usage events and scan limiting it is our legitimate interest in keeping the app reliable and affordable to run. You may object, and you may complain to your local data protection authority.
Children
Greenlit is not directed to children under 13, and we don’t knowingly collect personal information from them.
International transfers
Our service providers process data in the United States. If you use the app elsewhere, the menu photos you scan and your usage events will be processed there.
Security
Traffic between the app and our service is encrypted in transit. Access to our servers is restricted, and the app can add usage events to our analytics table but cannot read or change what is already stored in it.
Changes to this policy
If we change what the app collects, we’ll update this page and the date above before the change ships. Material changes, such as adding accounts or collecting location, will be described here explicitly.