Privacy Policy
Last updated: October 28, 2026
domenu (“we”) is a family menu app for iPhone, Android and the web. This policy explains what the app stores, who can see it and how to delete it.
What the app stores
You can use domenu without signing in or with an account: with Google, with Apple (in the iPhone app) or with an email and password. A family is identified by its family code. So that everyone in the family has the menu, our server stores:
- the family name;
- family members’ names: members type them in or they come from the account (optional, the name step can be skipped);
- dishes: names, categories, notes, who cooks them and when they were last cooked;
- “Want today” marks and dinner votes.
On your phone, or in your browser for the web version, the app keeps the family code, your member ID in the family and a copy of the menu so that it opens without a connection. If you signed in, it also keeps a sign-in key there: a random string the server uses to recognize your account.
Signing in
Signing in is optional: “Continue without signing in” works as before. An account lets your family menu open on another phone or in a browser: you sign in to the same account and see your family. For an account we store the email address, the name, the sign-in IDs (Google, Apple) and your family code with your member ID. The account name becomes your name in the family, and the other members see it; you can change it in Profile. Your email address isn’t shown to other members, and we don’t send newsletters.
**Google.** Google gives us your email address, name and Google account ID. We never see your Google password: you enter it on Google’s side. In the Android app, sign-in goes through the Google service on your phone; in the iPhone app and the web version, through Google’s sign-in window (accounts.google.com). Google knows that you are signing in to domenu. How Google handles data: https://policies.google.com/privacy.
**Apple.** In the iPhone app you can sign in with Apple. Apple gives us your Apple account ID and, if you chose so, your email address or Apple’s hidden relay address, and your name on the first sign-in. We never see your Apple password. How Apple handles data: https://www.apple.com/legal/privacy/.
**Email and password.** When you sign up or change your password, we email you a 6-digit code that works for 15 minutes. The email is sent by the Resend mailing service (resend.com), which receives your email address and the text of the email with the code. We store your password only as a hash (PBKDF2); the password itself is never stored and no one can see it.
One account can be opened in several ways. If you sign in with Google or Apple using the same verified email as the account, you get into that account. In Profile → Ways to sign in you can connect another sign-in method to the account.
Vote notifications
The iPhone and Android apps can notify you when someone in the family starts a vote. This only works if you allow notifications. The app then sends our server the device’s notification token, language and time zone, and we keep them together with your family code and member ID. The notification is delivered by the Apple Push Notification service (iPhone) or Firebase Cloud Messaging, a Google service (Android); it contains the name of the person who started the vote and the meal time. You can turn notifications off in your phone’s settings. When you sign out, delete your account or leave the family, the token is removed from the server.
Analytics and crash reports
The Android app sends usage data and crash reports to Firebase, a Google service. They show us which features people need, at which step they give up and why the app crashes.
Analytics (Google Analytics for Firebase) receives:
- which screens are opened and what is done in the app: a dish added, Want tapped, a vote started, the family invited, the menu printed or saved as a PDF. Actions come with numbers and the options chosen: how many dishes are in the menu, which sheet style was picked, which app the menu or invite was shared to;
- your member ID in the family, how many people are in the family and roughly how many dishes are in the menu;
- what Firebase collects on its own: a random ID of the app installation, the phone model, the Android and app versions, the language, the country Google works out from the IP address, and when sessions start and how long they last.
A crash report (Firebase Crashlytics) is sent when the app crashes: where in the code the error happened, the phone model, the Android and app versions, free memory and storage, your member ID and the latest actions in the app from the list above.
Analytics and crash reports never include names, email addresses, family or dish names, notes or the family code. Google processes this data on our behalf: it keeps crash reports for 90 days and analytics data for no longer than 14 months. How Google handles Firebase data: https://firebase.google.com/support/privacy. Analytics can't be turned off in the app yet.
The iPhone app and the web version (domenu.pro/app) don’t send analytics or crash reports. If you chose to share analytics with app developers in your iPhone settings, Apple may pass us anonymous crash reports.
What the app does not collect
No location, contacts, photos, files or advertising ID. The app has no ads, and analytics data isn't used for advertising. Like any website, our server may record technical data such as the IP address and the time of a request in its logs; we use it only to keep the service running and secure.
The web version and this site load the Onest font from Google Fonts, so your browser sends your IP address to Google when it loads the font. The iPhone and Android apps have the font built in and don’t.
Website analytics
The pages of the domenu.pro website use Yandex Metrica to count visits and see how the pages are read, including recordings of mouse movements, scrolling and clicks (Webvisor). To do this, Metrica stores cookies in your browser and receives your IP address and information about your browser and device. The apps and the web version (domenu.pro/app) don't use Metrica, so it never sees your family's menu or names. You can turn it off with a content blocker or by blocking cookies in your browser.
Who can see the data
Your family: anyone with your family code or invite link can join, see the family menu and change it. Treat the code like a key and share it only with people you trust. We don't sell the data and don't use it for advertising. Apart from your family, data goes only to the services the app can’t work without:
- Google — Android analytics and crash reports, Sign in with Google, notification delivery on Android;
- Apple — Sign in with Apple, notification delivery on iPhone;
- Resend — your email address and the code in the email when you sign up or change your password.
A printed menu and its file are made on your device and go only where you send them.
Security
The app talks to our server, to Google, Apple and Firebase only over HTTPS. The sign-in key is kept only on your device and on our server, and the password only as a hash.
Keeping and deleting data
Family data is kept while the family uses the app. Dishes can be deleted in the app at any time. “Sign out” removes the data from this phone or browser; the family menu stays for the other members.
You can delete your account in the app and in the web version: Profile → Delete account. We delete the account right away: the email address, name, Google and Apple IDs, the password, all sign-in methods and sign-in keys. If you are the only member of the family, the family and its menu are deleted with the account. If there are other members, you leave the family and the dishes stay with it.
You can also ask for this by writing to support@domenu.pro from the email address linked to the account, or by including the family code. If you use domenu without signing in, this is how to delete your name or the whole family. When you write to us, we will delete the data within 30 days, together with the analytics data and crash reports linked to your member ID.
Children
domenu is not directed at children under 13. If you believe a child has given us personal information, write to us and we will delete it.
Changes
If this policy changes, we will update this page and the date at the top.