Privacy

Nellie is built to know as little about you as possible. No account, no ads, no tracking.

Last updated October 25, 2026

The short version

• No accounts. Nellie never asks for your name, email or phone number.
• A random install ID. The app creates a random identifier when you install it. It is used only to count free scans and prevent abuse, and it is stored on our servers only as a one-way hash.
• Menu photos are not stored. They are processed to read the menu and then discarded — unless you choose to share a scan, and even then only text is kept, never the photo.
• Your profiles live on your device. Restrictions, table members, scan history and your Trigger Detective journal are stored on your iPhone or iPad.
• No third-party analytics or advertising SDKs.

What the app sends to our server

To answer a request, the app sends only what that request needs to nellie.youens.com:

• Scans: the menu photo, link or text you scan; the restrictions, severity levels and "avoid" items of the people you selected; and the display name and emoji you gave each person (so Nellie can say "For Ana: …"). Use a nickname if you prefer.
• Live Lens: a small, downscaled camera frame of the menu and the text recognized on your device.
• Ask Nellie, Server Card and Trigger Detective: the dish, menu details, your question, or the journal entries you ask Nellie to analyze.
• With every request: the random install ID, the app version, your language setting and — if you bought Nellie Unlimited — Apple's signed proof of purchase.

We don't use this content to build a profile of you, and we don't sell or share it for advertising.

Who processes it

Nellie runs on Cloudflare. To read menus and reason about dishes, requests are processed by AI models running on Cloudflare Workers AI and, through Cloudflare AI Gateway, by model providers such as OpenAI, Anthropic and Google. They process the content only to return a result, under their API data-use terms. We've turned off request logging in our AI Gateway, so prompts, photos and answers are not kept there.

What we store, and for how long

• Free-scan counter: a one-way hash of your install ID, the date and a random scan ID. Deleted after 30 days.
• Purchase check: a hash of Apple's signed transaction and its verification result, for up to 7 days, plus a short list of hashed install IDs per purchase so one purchase can't be shared with unlimited devices.
• Menu Memory: dish-level verdicts keyed by the dish text and a restriction profile (for example "peanuts: anaphylactic"), so popular dishes come back instantly. It contains no photos, names or install IDs. Entries expire after 30 days.
• Shared scans: only when you tap Share. The scan summary you share (restaurant, dishes and verdicts, the first names/emoji and restrictions of the people included) is stored so anyone with the link can view it. Links expire after 180 days. Email us the link to remove it sooner.
• Operational logs: request IDs, timings, model names, error types and counts — never photos, menu text, questions or profile details. Kept for a few days.

Purchases

Purchases are handled by Apple. Nellie checks Apple's cryptographically signed transaction to unlock unlimited scans; we never see your Apple ID or payment details.

Children

Nellie isn't directed at children under 13. Parents can add children as table members; those profiles stay on the parent's device and only their restrictions and the nickname you choose are sent with a scan.

Your choices

• Delete a scan or profile in the app at any time; deleting the app removes everything stored on your device, including the install ID.
• To remove a shared link, email us the link.
• Questions about privacy: support@sentientdonut.com.