Ordermaxx.

Privacy Policy

Effective 24 May 2026 (web quiz sections added 10 July 2026)

This Privacy Policy explains what data Ordermaxx collects, why we collect it, and what we do with it. Ordermaxx is published by Save Smart Group PTY LTD ("we"), a company registered in South Africa, address 71 Queen Victoria Street, Cape Town. You can reach us at support@ordermaxx.co.

We've tried to write this in plain English. If anything is unclear, email us.

Scope of this policy

This Privacy Policy covers both the Ordermaxx mobile app and the Ordermaxx web quiz at quiz.ordermaxx.co.

Sections 1 to 12 describe the mobile app, which stores your data on your device and does not use advertising trackers. The web quiz works differently: it collects the quiz answers and email described in section 13, and it uses the Meta Pixel, PostHog analytics, and Whop for payments. Where the app and the web quiz differ, section 13 governs the web quiz.

1. The short version (mobile app)

We do not track you across other apps or websites.

We do not sell your data, ever.

We do not show third-party ads.

In the app, we do not have user accounts. Your profile lives only on your phone.

We collect the minimum data needed to (a) find restaurants near you, (b) read menus you scan, and (c) personalise the picks we show you.

2. What we collect

2.1 Data stored only on your device

The following information stays on your phone, in iOS's standard UserDefaults storage. We never send it to our servers.

  • Your profile: age, sex, height, current weight, goal weight, activity level, dietary goal (e.g. lose weight, gain muscle), dietary preferences (e.g. vegetarian, gluten-free), allergens, and the food types you said you love or dislike during onboarding.
  • Saved items: restaurants and menu items you bookmark inside the app.
  • Imported order history: if you import a delivery-app CSV/JSON file to generate your "EatsWrapped", the parsed orders are stored locally.
  • Recent searches: the last 8 search terms you typed.
  • App-side cache: menus you've previewed, restaurant photos, item nutrition cards.

Tapping Delete account in the app erases all of the above. Uninstalling the app also removes it.

2.2 Data sent to our backend (Cloudflare Worker at ordermaxx-menu-worker.workers.dev)

We send the following to our backend only at the moment you trigger the relevant feature:

  • Coarse location (your approximate latitude and longitude): sent when you tap Allow on the location permission so we can find restaurants near you. Used to call Google Places. Not stored.
  • Restaurant name / website / address: sent when you open a restaurant's menu, so we can look up or scrape the menu for that location. Cached for 30 days by restaurant (not by you).
  • Menu photos: sent when you tap Scan menu and take or pick a photo. The image is processed by our backend to extract menu items and nutrition data, then discarded. We do not store your menu photos beyond the duration of the request.
  • The menu item name you're viewing: sent when we generate the "what's in this dish" intelligence card. Cached for 90 days by item name (not by you).

None of this is linked to a user identifier in the app. Requests are authenticated with a shared app-wide token, not a personal one.

2.3 Subscription data (Apple + Superwall)

When you subscribe inside the app:

  • Apple processes the payment and sends us only a "subscription is active / inactive" signal. We never see your Apple ID, name, email, payment details, or billing address.
  • Superwall (our paywall and subscription-state provider) receives an anonymous device-level identifier so it can show you the correct paywall and let you restore purchases. See Superwall's privacy policy at https://superwall.com/privacy.

2.4 Information the mobile app does not collect

In the mobile app we don't collect: your name, your email address, your phone number, your contacts, your photos other than menu scans, your calendar, your microphone audio, your health/fitness data, your device's advertising identifier (IDFA), your IP address (logged transiently by Cloudflare for abuse prevention, not retained). The web quiz is different, see section 13.

3. Why we collect each thing (mobile app)

  • Coarse location. Purpose: find restaurants near you. Legal basis (GDPR/POPIA): your consent (the iOS permission prompt).
  • Menu photos. Purpose: extract menu items and nutrition. Legal basis: performance of the service you requested.
  • Restaurant name and your location. Purpose: look up the right menu. Legal basis: performance of the service you requested.
  • Your profile (on-device). Purpose: personalise recommendations. Legal basis: your consent (you entered it in onboarding).
  • Subscription status. Purpose: unlock paid features. Legal basis: performance of contract.

4. Who we share data with

We use a small number of third parties strictly to make the app work. We do not share mobile-app data with anyone for advertising or marketing purposes. The web quiz uses additional providers, described in section 13.

  • Apple. Receives: subscription transactions. For: process in-app purchases.
  • Cloudflare (hosting our backend). Receives: all API requests. For: run the menu-lookup backend.
  • Google Places. Receives: restaurant name, coords, country. For: return restaurant photos, ratings, reviews.
  • Anthropic (Claude). Receives: menu text, menu photos, item names. For: extract menu items, estimate nutrition.
  • Firecrawl. Receives: restaurant website URLs. For: scrape menu pages.
  • Superwall. Receives: anonymous device-level subscription state. For: manage paywalls and restore purchases.

Each provider acts as a sub-processor under our instructions and is contractually prohibited from using your data for any other purpose.

5. How long we keep things

  • On your device: until you tap Delete account in the app or uninstall.
  • Menu cache on our backend: 30 days per restaurant, then evicted.
  • Item-intelligence cache on our backend: 90 days per item, then evicted.
  • Restaurant photo cache: indefinitely (Google Place photos are immutable).
  • Menu scan photos: discarded immediately after the request completes (not retained).
  • Cloudflare access logs: transient (Cloudflare's default retention, used for abuse prevention only).

Retention for web quiz data is described in section 13.

6. Your rights

You have the right to:

  • Access the personal data we hold about you. Email us and we'll confirm what we can see.
  • Delete all your data. In the app, tap Profile then Delete account, which wipes everything on your device. For web quiz data and web accounts, email support@ordermaxx.co.
  • Withdraw consent at any time by turning off location/camera/photos permissions in iOS Settings, then Ordermaxx, or by deleting the app.
  • Object to processing, restrict processing, or port your data. Email us.
  • Lodge a complaint with your local data protection authority (e.g. the Information Regulator in South Africa, or your national DPA in the EU/UK).

We respond to verifiable requests within 30 days.

7. Children

Ordermaxx is rated 12+ on the App Store and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, email us and we'll delete it.

8. Security

  • All traffic between the app and our backend goes over HTTPS (TLS 1.2+).
  • Our backend is hosted on Cloudflare Workers and uses standard industry security practices.
  • Your on-device data is stored in iOS's standard application sandbox, protected by the device's passcode/biometric lock.

No system is perfectly secure. If you believe you've found a vulnerability, please email support@ordermaxx.co with the details.

9. International data transfers

Our backend runs on Cloudflare's global edge network, which means your requests are processed at the data centre nearest to you. Third-party sub-processors (Anthropic, Google, Superwall, and, for the web quiz, Meta, PostHog, Whop, and Supabase) may process data in the United States or other countries. Where required, we rely on standard contractual clauses or other appropriate safeguards.

10. Cookies

The mobile app does not use browser cookies. The web quiz at quiz.ordermaxx.co uses browser storage and third-party cookies/identifiers as described in section 13.

11. Changes to this policy

If we change this policy in a material way we'll update the "Effective date" above and, where the change is significant, notify you inside the app or by adding a notice next to the in-app link. Continued use after the effective date constitutes acceptance.

12. Contact

Questions, requests, complaints:

Email: support@ordermaxx.co

Company: Save Smart Group PTY LTD

Address: 71 Queen Victoria Street, Cape Town, South Africa

This policy is provided for transparency and to comply with the App Store Review Guidelines, the EU GDPR, the UK GDPR, the California CCPA/CPRA, and South Africa's POPIA. It does not create any rights beyond those granted by applicable law.

13. Web quiz funnel (quiz.ordermaxx.co)

This section covers our web quiz at quiz.ordermaxx.co, where you answer a short quiz and can subscribe to Ordermaxx. It works differently from the mobile app, and where the two differ, this section governs the web quiz.

13.1 What the quiz collects

As you move through the quiz we collect the answers you provide, so we can build your personalized plan:

  • Your age range, sex, height, current weight, and goal weight.
  • Your activity level, dietary goal, and how healthy you want to eat.
  • Your food preferences: the foods you pick, love, or want to avoid.
  • At checkout, your email address (collected by our payment provider, Whop, and shared with us to create and identify your account).

13.2 Analytics and advertising tools

The web quiz uses the following third-party tools, which the mobile app does not:

  • Meta Pixel. We use the Meta (Facebook) Pixel to measure the performance of our ads. It shares limited event data (such as page views, quiz steps, and purchases) with Meta and may set cookies. This is used for advertising measurement and optimisation. You can manage this through your Meta ad settings and your browser cookie controls.
  • PostHog. Product analytics that records events and a randomly generated visitor identifier so we can understand how the funnel is used and where people drop off. It is not used to identify you personally.
  • Whop. Our payment processor for web subscriptions. Whop collects your email and payment details to process the charge and any renewals. We receive a confirmation and your email, not your full card details. See Whop's privacy policy at https://whop.com/privacy.
  • Supabase. Hosts the web account (your email and encrypted password) that you create after paying, so you can sign into the app.

13.3 Your web account

After you pay, you set a password to create an Ordermaxx web account. We store your email and an encrypted password so you can sign in. We never store your password in readable form.

13.4 Retention and deletion

We keep your quiz answers and account record for as long as your subscription is active, and for a reasonable period afterward for legal and accounting purposes. To access or delete your web quiz data and web account, email support@ordermaxx.co and we will action it within 30 days.

13.5 Local storage

The quiz saves your answers in your browser's local storage so you can resume where you left off. Clearing your browser storage removes them from your device.