Privacy policy

Last updated: 7 September 2026

1FoodMenu gives restaurants and food trucks a one-page website. This policy explains what we collect from the owners who build a page, what we collect from the people who open one, where it is stored, and how to have it removed.

1. Who this covers

There are three places this policy applies:

The marketing site at 1food.menu, the pages you are reading now.
The dashboard at app.1food.menu, where owners sign in and edit their page.
Public pages at 1food.menu/@name, the pages customers open from a link or a QR code.

We call the restaurant or food truck owner the vendor, and anyone who opens a public page a visitor.

2. What we collect from vendors

Account details: your email address and password, handled by Supabase Auth. We never see or store the password in plain text.
Your page content: business name, logo, colour, description, photos, menu items with prices and allergens, opening hours, addresses and map pins, phone number, WhatsApp number and email shown on the page, weekly locations for food trucks, and any updates or promos you schedule.
Billing: if you subscribe to Pro, Stripe handles the payment. We receive your subscription status and the last four digits of the card. We never store the full card number.
Support: messages you send through the contact form or by email, so we can reply.

We use this to run your page, bill you, answer you, and send account emails such as password resets and billing receipts.

3. What we collect from visitors

Visitors do not need an account, and we do not build profiles of them.

Page views: when a public page opens, we add one to that vendor's daily view count. We store the count per vendor per day, nothing about the visitor.
Reviews: where a page accepts customer reviews, we store the rating, the text and the name the reviewer gives. The vendor can hide a review from their page.
Reports: if a visitor reports a page, we receive the email address and message they enter, sent to us through Web3Forms.
Maps: the map on a page loads tiles from OpenStreetMap. Loading them sends the visitor's IP address to OpenStreetMap, as with any image loaded from another server.

4. Analytics on our sites

In production we load two analytics services on the marketing site and on public pages:

Ahrefs Analytics counts visits without cookies and without identifying individual visitors.
Hotjar records how pages are used, such as scrolling and clicks, so we can see where a page confuses people. Hotjar sets cookies and may capture anonymised recordings. Typed text is masked by default. You can opt out at hotjar.com/policies/do-not-track.

We do not use these tools inside the dashboard.

5. Public pages are public

Everything a vendor puts on their page is visible to anyone with the link, and search engines index it. That includes the business name, menu, prices, photos, address, hours and the contact details shown on the page. A vendor can hide their page from the dashboard at any time, and hidden pages return “not found”.

6. Cookies

The dashboard uses a session cookie so you stay signed in. It is essential and set only after you log in.
The marketing site and public pages set no cookies of our own. Hotjar sets its own, described above.
Advertising: pages on the Free plan show advertising from Google AdSense, described in the next section. Google sets its own cookies under its own policy. Pro pages show no ads.

7. Advertising on Free pages

Public pages on the Free plan show advertising served by Google AdSense. Pro pages, demo pages and pages with an empty menu show none. We do not show ads inside the dashboard.

Google, as a third-party vendor, uses cookies and similar identifiers to serve ads. Google’s advertising cookies let it and its partners show ads based on a visitor’s visits to this site and to other sites.
Google explains what it collects and how it uses it at How Google uses information from sites that use its services.
You can opt out of personalised advertising at Google Ads Settings or, for other networks, at aboutads.info.
In the European Economic Area, the United Kingdom and Switzerland, a consent message from Google appears before any personalised ad is shown. You can decline; the page still works and may show non-personalised ads instead. You can change your choice from the “Privacy” link in the message or by clearing the site’s cookies.
We receive aggregate reports from Google (views, clicks, earnings). We do not receive information about individual visitors from the advertising, and we do not pass visitor data to Google beyond what its script collects on the page.

8. Where your data is stored

We do not run our own servers. These services hold the data on our behalf, each under its own privacy policy:

Supabase: the database and authentication.
BunnyCDN: photos and logos.
Stripe: subscriptions and payments.
Web3Forms: delivery of contact and report messages to our inbox.
Hotjar and Ahrefs: analytics, as above.
OpenStreetMap: map tiles.

We do not sell personal data, and we do not share it with anyone beyond these services and what the law requires.

9. How long we keep it

Your account and page content stay as long as your account exists. If you delete your account, we remove your personal data and your page within 30 days. Billing records stay for as long as tax law requires. Daily view counts are kept as numbers only and have no personal data to remove.

10. Your rights

You can see and edit everything on your page from the dashboard. For a copy of your data, a correction we cannot make through the dashboard, or deletion, email support@1food.menu from the address on your account. We answer within 48 hours. If you are in the EU or UK, you also have the right to complain to your local data protection authority.

11. Children

The dashboard is for business owners. We do not knowingly collect data from anyone under 16.

12. Changes

When this policy changes in a way that matters, we email vendors and update the date at the top. Small wording changes are made without notice.

13. Contact

Questions about privacy: support@1food.menu.