Privacy

Looking at restaurants and dishes

You don’t need an account, and the site sets no cookies unless you accept the ones described under Cookies below or choose a city, and gives you no identifier. We count what is looked at so restaurants can see how they are found: that a menu was opened, which dishes were looked at, which words were searched. Each count has nothing about who: no name, no address of your computer, no browser details.

• Words about allergies, intolerances, diets or health are removed from searches before anything is counted.
• Where you are is never kept. When you share it (Near me), it is used to measure distances and then forgotten; counts keep only a distance band, such as “under 250 m”.
• For our own view of the whole site we also count pages opened, searches (and whether they found anything), which partner’s link a visit came from, and which parts of the map were looked at up close, as squares of about 500 m, never a point.
• We also count the first time a visit does something (searches, uses a filter, opens the map or a restaurant, taps directions) so we can see what visitors do, without knowing who; if you came from an ad, the ad’s code and number, and where it was shown, stay with the visit so we can see what each ad brings. Which allergen or diet filter you used is never counted.
• If your browser asks sites not to track you (Do Not Track or Global Privacy Control), it sends nothing at all.
• Single visits are deleted after 7 days (never more than 90); what remains are daily totals per restaurant. A searched word is kept only if it was searched at least 3 times that day, for up to 13 months.

Cookies

We count visits, and the hour they start, with nothing about who you are, and that needs no cookie. Our own cookie is for analytics only: it lets us tell new visitors from returning ones (Google Ads measurement and ChatGPT ads measurement, which are separate and optional, are described below). It is set only if you press Accept in the window that asks on your first visit. The cookie is a small mark in your browser’s storage: one date, kept for 7 days after your last visit, with no ID, and, if a link brought you, that link’s name; nothing else. The mark also remembers the name of the ad or partner link that first brought you to MindMeal (the word after ?via= in the address, or a partner’s page), for 7 days from that first visit, and nothing else: a later link does not replace it. On a later visit the site tells us that name, so we can see which ads bring people back. The mark itself never leaves your phone; on your first page of a visit the site only tells us three things: whether it is your first visit today, whether you were here on an earlier day, and which link first brought you. Whatever you answer, your first page also says whether this notice got a yes, a no or no answer: we count how many visits said yes, no or nothing to this notice, as daily totals only, with nothing beside them. If you press Continue without accepting, nothing is kept except that you said no (for 7 days for our own cookie, 90 days for Google Ads measurement and a year for ChatGPT ads measurement), and nothing changes for you. You can change your mind at any time: “Cookie settings” at the bottom of the page asks again, and turning Visit counting off there removes the cookie.

The city you choose. When MindMeal has more than one city and you choose one in the header, or press “Use my location” there, the site remembers that city in one cookie (mm_city), so the next page shows it too. It holds the city’s name and nothing else, for a year, and is set only when you choose. It needs no Accept, because you asked for it. “Use my location” asks your browser where you are once, finds the city you’re in on your phone, and forgets the position: it is never sent to us or kept. Choosing “All cities” removes the cookie.

Google Ads measurement (only if you accept). We advertise on Google. If you press Accept, or switch on Google Ads measurement in Cookie settings, your browser loads Google’s tag (gtag.js, from googletagmanager.com) on the pages of this site. Google then sets its own cookies (_gcl_*, up to 90 days) and receives the page you open and the address you came from (without what you searched, your filters or where you are), your IP address and your device and browser details, so that it can tell which of its ads brought you. Google also learns when you open a restaurant’s page, tap Directions or Call, search for a dish, or open a menú del día: only that it happened, never what you searched. Google receives this as a separate controller and handles it under its own privacy policy (policies.google.com/privacy). We receive only totals from Google Ads, never who you are. Until you accept, nothing is sent to Google and its tag is not even loaded. If you press Continue without accepting, or never answer, nothing is loaded. We ask again after 90 days. You can withdraw at any time with “Cookie settings” at the bottom of any page: the tag stops and its cookies on mindmeal.net are removed. Cookies Google keeps on its own domains you remove in your browser’s settings. Browsers that send Do Not Track or Global Privacy Control are never asked and load nothing.

ChatGPT ads measurement (only if you accept). We advertise in ChatGPT. If you press Accept, or switch on ChatGPT ads measurement in Cookie settings, your browser loads OpenAI’s measurement pixel (oaiq.min.js, from bzrcdn.openai.com) on the pages of this site. OpenAI then sets its own cookies on mindmeal.net: __oppref (the code of the ChatGPT ad you came from, 30 days, renewed by a new ad click), __obref (a random number for this browser, 365 days) and __oaiq_consent (your answer, 30 days), and receives the page you open and the address you came from (only the site and the page, without what you searched, your filters or where you are), your IP address and your browser’s details, so that it can tell which of its ads brought you. OpenAI also learns when you open a restaurant’s page, see search results, tap Directions, Call or Website, or search for a dish: only that it happened, never what you searched. OpenAI’s script may also send OpenAI a scrambled (hashed) copy of an email address, phone number or name you type into a box on the page, so OpenAI can match a visit to an account (its “automatic advanced matching”, which OpenAI switches on and we cannot switch off). That is why it is never loaded on the pages where you would type them to us: MindMeal AI (Ask AI, also on a partner’s page) and the contact page. OpenAI receives this as a separate controller and handles it under its own privacy policy (openai.com/policies/privacy-policy). We receive only totals from OpenAI, never who you are. Until you accept, nothing is sent to OpenAI and its pixel is not even loaded. If you press Continue without accepting, or never answer, nothing is loaded. We ask again after a year, the life of OpenAI’s longest cookie. You can withdraw at any time with “Cookie settings” at the bottom of any page: the pixel stops and its cookies on mindmeal.net are removed. Browsers that send Do Not Track or Global Privacy Control are never asked and load nothing.

The map

The map’s pictures come from OpenFreeMap, so your browser asks their servers for them, as it would for any map. Directions open in Google Maps only when you tap Directions.

MindMeal AI (Ask AI)

MindMeal AI answers your questions about places to eat from MindMeal’s menus. To do that, your question and the conversation so far go to Anthropic, the company that makes the Claude AI model, which works for us as our processor under its API terms. Anthropic doesn’t use them to train its models; see Anthropic’s privacy policy for how long it keeps them.

• If you mention an allergy, a diet or anything about your health, that goes to Anthropic with the rest of the question. You don’t have to: the filters on the Dishes page do the same without it.
• We keep nothing of a conversation: not your words, not our answers, not who asked. It lives in your browser tab and is gone when you close it.
• We count only totals for each day: how many questions and conversations there were, how many were off topic, and what they cost. Searches MindMeal AI makes are counted like any other search, with the same health words removed.
• If you tap “use my location”, your position goes with that question, rounded to about 100 m, and is not kept.
• To stop one visitor asking too often, your computer’s address is held in memory until a day after your last question, then forgotten within a minute. It is never written down.

MindMeal in ChatGPT and Claude

You can add MindMeal to ChatGPT or Claude as an app (a connector). The assistant then calls MindMeal’s tools to answer you. MindMeal has no account for you and asks for no sign-in: the tools only read restaurants’ published menus. This section says exactly what each tool receives, what it gives back, what we keep and for how long, and who else sees anything.

What each tool receives and returns

The assistant decides what to send, from what you asked. Every input below is optional unless it says otherwise. What the tools return is about restaurants, never about you.

MindMeal also offers four ready-made questions you can pick in your assistant (dinner near a place, an allergy check at a restaurant, a menú del día, what’s on a menu). When you pick one, our server receives what you filled in (a place, a restaurant’s name, allergens, a diet, a budget) and sends back the question as text for the assistant to ask. Nothing of it is kept or counted.

The links in the results (a restaurant’s page, the map, directions, “near me”) open our website or your maps app only when you tap them. A map link carries the search in its address so the map can show the same results; a restaurant link carries ?from=assistant, so the visit is counted as coming from an assistant. Once opened, our website follows the rest of this page. The “near me” link opens our map, which asks your phone whether to share where you are; your location goes from your phone to our page, never through the assistant.

What else arrives with a call

• Not your device. The calls come from the assistant’s servers (OpenAI’s or Anthropic’s), not from your phone or computer. So our server sees the internet address of their server, not yours, and the ordinary headers of a web request (such as the name of their software). No cookies, no sign-in, nothing that names you.
• The app’s name. When the assistant connects, it says which app it is (such as “ChatGPT” or “claude-ai”) and its version.
• ChatGPT’s extra details. ChatGPT may add to each call your approximate location (city, region, country, time zone and rough coordinates; openai/userLocation), your language setting (openai/locale), a description of your device and browser (openai/userAgent) and an anonymous identifier OpenAI gives you (openai/subject). We use only the approximate location, and only when you named no place, no neighbourhood and no area, and its city is one MindMeal covers (Barcelona): then the nearest restaurants come first, and the answer tells the assistant the distances are rough. We read none of the others. We keep none of them.
• The cards. When ChatGPT or Claude shows our results as cards in the chat, your device loads the card’s script and the restaurants’ photos from www.mindmeal.net. For those requests our server sees your device’s internet address and browser details, as any website would. We write none of it down, except an error line if our server fails to answer (see Error lines below).

What we do with it, and why

We use what a tool receives only to answer that call: to find the dishes, restaurants or places asked for. Our legal basis is our legitimate interest in answering the searches you ask your assistant to make, and in knowing, as totals only, how MindMeal is used, so restaurants can see how they are found and we can see which questions MindMeal can’t answer yet. We never use any of it for advertising, never build a profile, and never sell or share it.

What we keep, and for how long

• Nothing of what was asked. Not the words, the allergens or diet, the price, the place, the coordinates, your approximate location, nor any of ChatGPT’s details: they are not stored and not written to any log. The only thing read from a call besides answering it is the tool’s name and, on connecting, the app’s name.
• Daily totals, about nobody. For each day: how many times each restaurant was shown to an assistant (its owner sees this), how many calls each tool had, how many searches found nothing (per tool), and how many times each app (“ChatGPT”, “claude-ai”) connected. Nothing about who, nor what was asked. Totals that cannot point to anyone are kept without a time limit, unless we choose a shorter one.
• A note per restaurant shown, for 7 days. That a restaurant was shown to an assistant, and when: nothing about the question or who asked. Kept only to recount the totals if counting goes wrong, and deleted after 7 days (never more than 90).
• A place name, for a day, in memory. When find_place looks up a name, the name and what OpenStreetMap answered are held in our server’s memory for up to 24 hours, so the same question isn’t sent to OpenStreetMap again. Never written down; gone sooner if our server restarts.
• The caller’s address, for rate limits, in memory. To stop one caller flooding MindMeal (600 calls a minute at most), the internet address that called (the assistant’s server, not yours) is held in our server’s memory and never written down. It is forgotten within a minute after its one-minute window passes.
• Error lines. We keep no log of requests: neither our web server (Caddy) nor our API writes one. If our server fails to reach its own API while answering a request, the web server writes one error line with the address it came from (for a call, the assistant’s server; for a card’s script or photo, your device), the address asked (such as /mcp) and the request’s headers, never what was asked. Every log on our server that could hold an internet address, these included, is deleted after 14 days.
• Backups. Copies of our database (for the assistants, they hold only the totals and notes above) are kept on our host for 14 days and then deleted.

Who else receives anything

• OpenStreetMap (Nominatim). Only for find_place: the place name and the city, sent from our server, so OpenStreetMap sees our server’s address, not yours. Nothing else is sent: no question, no location, nothing about you. The OpenStreetMap Foundation handles it under its own policy (osmfoundation.org/wiki/Privacy_Policy).
• Hetzner, our host: our server and database run in Germany, and the backups at Hetzner in the EU, under its data processing agreement with us.
• Nobody else. MindMeal’s tools call no other service and use no AI of their own.
• The assistant’s maker. What you tell ChatGPT or Claude, and what it receives from MindMeal, is handled by OpenAI or Anthropic under their own privacy policies (OpenAI, Anthropic). We don’t control or receive your conversation.

Your choices

• There is no account: you never give us your name, email or anything else to use MindMeal.
• You decide whether to add MindMeal to your assistant, and you can disconnect it at any time in ChatGPT’s or Claude’s settings for apps or connectors. Then it sends us nothing.
• In ChatGPT you can stop it sharing your approximate location in its settings. MindMeal still works: name a place, a street or a neighbourhood.
• You don’t have to mention an allergy, a diet or anything about your health; if you do, we keep none of it.
• To ask what we hold, or to have something corrected or deleted, write to info@mindmeal.net. Because we keep nothing about who asked, there is usually nothing to find. You can also complain to a data protection authority (see Your rights below).

Restaurants

What we show about a restaurant is what it publishes itself: its menu, address, phone, website. A restaurant can ask us to correct or remove anything.

Someone who runs a restaurant can have an account: their name, email and a password we keep only in a form that can’t be turned back into it. Signing in sets one cookie that keeps them signed in; it is used for nothing else. To prove they run a restaurant they may send photos; those are seen only by MindMeal staff and deleted 7 days after we decide. The decision itself is kept.

Emails

Apart from the research questions described under Research with restaurants below, we only send emails you need: a sign-in link, a claim link, an answer to a claim. No newsletters, no marketing.

Research with restaurants

To learn how restaurants keep their menus current and how new guests find them, someone researching for MindMeal may write to a restaurant with a few questions, by Instagram direct message or by email from a mindmeal.net address. The messages sell nothing, and not answering, or saying no, is fine.

• What we keep: the restaurant’s name, the Instagram account or business email we wrote to, when we wrote, and the answers about the business (where its menu appears, how guests find it, what it pays to be found). Nothing else about a person: if someone signs with their name, we write “owner” or “manager” instead.
• Where: in a private spreadsheet seen only by MindMeal’s founder and whoever sent the messages. It is not in MindMeal’s website, app or database, and nothing from it is published. We quote a restaurant or name it publicly only if it says yes in writing.
• Why, and on what basis: research to improve MindMeal, on our legitimate interest in understanding the restaurants it shows.
• For how long: 12 months from our first message. Then the restaurant’s name, the account name or email address, the answers and any quotes are deleted; only counts with nothing about who remain.
• Your choices: to object, to stop further messages, or to have the answers deleted at once, reply to the message or write to info@mindmeal.net.

Your rights

You can ask us what we hold about you, to correct it, to delete it, or to stop using it, and you can complain to a data protection authority: in Estonia the Andmekaitse Inspektsioon, in Spain the AEPD, or the authority where you live. For a diner there is usually nothing to find, because we keep nothing about who you are.

Who we are

MindMeal, the website mindmeal.net and the MindMeal app in ChatGPT and Claude are owned and run by Vasyl Vasyliev, an individual, who decides what is done with your data (the controller). Write to info@mindmeal.net about anything here. More about us on the About page.