How Food Allergy Chart handles your information.

This Privacy Policy explains how Food Allergy Chart handles information in the public site, guest allergy guides, and restaurant management workspace.

Guest-facing allergen filters are informational controls. Selecting a filter does not create medical advice, does not tell the service that a guest has a medical condition, and does not guarantee that a menu item is safe.

Account features can collect sign-in information such as email address, password authentication data handled by Better Auth, reset-password requests, account identifiers, and role or permission records.

Restaurant workspaces can store business information such as company names, store names, store slugs, menu items, catalog items, allergen answers, availability settings, store notes, configured menu-source URLs, online-menu integration requests and location details, invitations, role assignments, audit log entries, and published guide revisions.

Import and review features may process CSV or PDF allergen files uploaded by an authorized account user to preview catalog changes.

The app uses first-party browser storage for a generated anonymous analytics identifier and a session flag that prevents duplicate signup-started events. It also uses authentication cookies through Better Auth.

The repository includes a first-party analytics endpoint that records allowlisted product events, anonymous identifiers, account identifiers when available, tenant or store identifiers when supplied, sanitized event properties, and timestamps in the application database.

Hosting and application logs may include ordinary technical data such as request paths, timestamps, response status, and server error details. No third-party pixel, session replay, Sentry, PostHog, Google Analytics, or payment analytics integration was found in the audited code.

Messages sent through the public Contact page — name, email address, topic, and message text — are delivered to the Food Allergy Chart team and retained so we can respond and keep a record of the conversation.

Information is used to operate account access, provision workspaces, manage restaurant catalog and store data, publish guest-facing allergy guides, support imports and menu-source review, record product usage events, diagnose errors, and maintain the service.

The codebase shows use of Netlify for hosting and scheduled functions, Netlify Blobs for certain cached or stored application data, PostgreSQL through the pg/Kysely stack, Better Auth for account authentication, and configured online-menu source requests where a store menu URL is present. It also includes syncing from a public Cold Stone allergen reference source.

Information may be processed by those providers or systems as needed to run the service. No billing provider or payment processor is implemented in the audited code.

Account, restaurant, analytics, contact, and log data are retained while an account remains active or while the information is needed to operate the service. Businesses can request deletion of their account data at any time through the contact channel below.

The service includes account authentication, role-based access checks, tenant and store access controls, server-side diagnostics, and database-backed permissions. No public security certification, audit report, breach procedure, or comprehensive encryption practice was verified in the repository.

Account users and visitors can raise account or privacy questions, including data access and deletion requests, through the contact form at foodallergychart.com/contact. We respond by email.

Food Allergy Chart is intended for restaurant operators, restaurant staff, and guests reviewing restaurant information. It is not designed for or directed at children under 13.

This policy may be updated as the product and its providers evolve. The effective date is updated when material changes are published.

Privacy questions and requests can be sent through the contact form at foodallergychart.com/contact. We respond by email.