Privacy policy

1. Who we are

lettermenu provides the website at letter.menu and the lettermenu Fire TV app. For the personal information described in this policy, lettermenu is the data controller. Contact us at [email protected].

2. What this policy covers

This policy covers the lettermenu website, account dashboard, public menu screens and Fire TV app. Amazon’s handling of information through Fire TV devices and the Amazon Appstore is governed by Amazon’s own privacy terms.

3. Information we collect

Account and service information

When you create and use an account, we collect your name, email address, encrypted password, email-verification status, saved colour palette, venue names and settings, and the menu content you create.

Fire TV information

The Fire TV app creates a random device identifier and short-lived pairing details. After you approve pairing in your signed-in browser, we issue that TV its own access token. We record when the token was created and last used. The app uses the token to retrieve the locations on your account and the menu data for the location you choose. It does not receive or store your account password.

Technical information

Like most online services, our hosting and security systems may process IP addresses, browser or device type, request times, session identifiers, cookies and diagnostic logs. We use these to sign you in, keep the service secure, diagnose faults and operate reliable TV displays.

Information you send us

If you email us, we receive your email address and anything you include in the message.

4. Why we use it

We do not use your information for solely automated decisions that have legal or similarly significant effects.

5. Public menu screens

Each location has an anonymous public URL at /screen/{slug}. Anyone with that URL can view the enabled menus for that location without signing in. Do not put personal, confidential or sensitive information in a menu. Pairing a Fire TV makes setup easier; it does not make the location’s public screen private.

6. Who we share information with

We use service providers to host the application and database, deliver transactional email, and help us maintain security and reliability. They process information for us under their own contractual and security obligations. We may also disclose information if required by law, to protect people or the service, or as part of a business sale or reorganisation. We do not sell personal information.

Some providers may process information outside the UK. Where required, we use an adequacy regulation or appropriate contractual safeguards for those transfers. Contact us if you would like more information about the safeguards used.

7. Cookies and local storage

We use essential cookies and similar storage to keep you signed in, protect forms against misuse and remember the state needed to provide the service. The Fire TV app stores its device identifier, access token and selected location on the device so it can reconnect. We do not currently use advertising cookies.

8. How long we keep information

We keep account and menu information while your account is open. Short-lived Fire TV pairing records expire automatically; a paired TV token remains until it is disconnected or the account is deleted. Session, security and diagnostic records are kept only as long as reasonably needed for security, fault investigation and legal obligations. Support correspondence may be retained where needed to resolve a request or protect legal rights.

When an account is deleted, its active account data, locations, menus and TV tokens are deleted. Limited information may remain temporarily in protected backups or where we must keep it to comply with law, resolve disputes or prevent abuse; it is isolated from ordinary use and removed under the relevant retention cycle.

9. Security

We use reasonable technical and organisational measures designed to protect information, including hashed passwords, email verification, account-scoped access controls and separate revocable tokens for Fire TVs. No online service can promise absolute security.

10. Your rights

Depending on where you live and the circumstances, you may have rights to access, correct, erase, restrict or receive a copy of your personal information, and to object to certain uses. Where processing is based on consent, you can withdraw it at any time. These rights can have legal limits.

Email [email protected] to exercise a right. We may need to verify your identity. We normally respond within one month. For the full process, see how to delete your account. You can also complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local data-protection authority.

11. Changes to this policy

We may update this policy when the service or the law changes. We will post the new version here and change the date at the top. If a change materially affects how we use your information, we will take reasonable steps to tell account holders.