Privacy & accessibility

Optional Google analytics

Google Tag Manager and Google Analytics are not enabled in this build. We plan to use them to understand public-site usage after configuration and testing, with your optional consent. The controls and planned data handling are described below. Browsing works whether you accept or decline.

Privacy by default

Public recall browsing needs no account or payment and does not require analytics consent. When optional analytics is configured, Google Tag Manager loads Google Analytics only after you choose Allow analytics. You can decline or change your choice through Analytics preferences on public pages. We remember your choice in browser storage for up to 180 days. Consented analytics measures public page visits, result counts and interactions such as source clicks, sharing, usefulness votes and clicks toward our services. Public page labels distinguish recall sources, food-category pages and information pages; they do not identify your health status, occupation or customer role. Google may receive device, browser, approximate location and network information, set analytics cookies, and derive session and engagement measurements. We exclude raw search text, contact fields and private account or alert-token pages from this integration; only approved campaign labels are retained. Advertising consent remains denied and Google Signals is disabled. Changing your preference to decline unloads the analytics integration and clears accessible Google Analytics cookies; it does not delete information already received by Google. Optional paid tracker owners sign in through Supabase and pay through Stripe. When voting is enabled, a first-party HttpOnly cookie remembers an anonymous browser voting identity for up to one year. A keyed hash of that identity and your votes are stored privately; only aggregate counts and your current selections are returned. Votes are not linked to alert contacts. Clearing the cookie or using another device creates a separate identity. Click your selected thumb again to remove that vote; removing the cookie alone does not erase earlier votes. Email and SMS subscriptions are optional. Search terms appear in page URLs, browser history and potentially hosting request logs. Do not include personal or medical information in a search.

The site server queries its recall database. Product images and external source links may connect your browser to FDA or USDA services, which have their own privacy policies. Hosting and infrastructure providers may retain standard access logs.

Optional subscriptions and inquiries

Free alert signup requires no account or payment. When a channel is enabled, a private subscription record is linked to each contact channel you choose using a keyed contact fingerprint; email and SMS remain separate. We collect an optional name, consent timestamps and delivery records. Names, email addresses and phone numbers are encrypted with AES-256-GCM before they enter the database. Public database clients cannot read subscriber or advertiser-inquiry tables.

When you request or receive a message, the selected contact address is sent to the delivery provider: Resend for email and Twilio for SMS. Cloudflare Turnstile processes the signup security check. If you email our support or contact addresses, Mailgun may route your message to our monitored inbox; your address, message and attachments are processed by those mail services. Do not send sensitive medical information. These providers have their own privacy policies. We never sell personal information or distribute it for third-party marketing. Necessary hosting, security, authentication, payment and message-delivery providers process information to provide the features you choose; this is distinct from selling it. Information may also need to be disclosed when legally required.

Use the unsubscribe link in a digest or reply STOP to an SMS. Opting out removes the encrypted name and contact address for that channel; a private suppression fingerprint, consent record and delivery history remain for abuse prevention and operational records. Unconfirmed contacts become eligible for deletion after seven days. Maintenance defaults to report-only; deletion starts only when the operator enables cleanup. Provider logs and database backups have separate retention periods.

Advertising placements are not currently offered for sale. If inquiry collection is enabled in a future release, its form data is encrypted, used to respond to the inquiry, and does not subscribe you to alerts. Closed inquiries whose creation date is more than 90 days old are deleted when the maintenance step runs. Maintenance runs separately from message delivery once scheduled. Report-only mode does not delete records; failed or disabled maintenance can delay cleanup. When cleanup is enabled, subscriber delivery history older than 90 days is removed, excluding unresolved delivery outcomes.

Free-alert action records

We retain private request, confirmation and unsubscribe history for up to 180 days when scheduled maintenance runs. It contains channel and event identifiers and preference flags, not names, email addresses or phone numbers. A signed, HttpOnly result cookie lasts up to five minutes after a confirmation or unsubscribe action so the page can show a trustworthy outcome. It contains only the action result and expiry, not your contact details.

Paid website trackers

When paid trackers are enabled and you create an owner account, email and login records are handled by Supabase Auth. The dashboard stores a login session in browser storage until sign-out or expiry. We store the account identifier, website origins, tracker preferences, Stripe customer and subscription identifiers, billing status and paid period. Stripe handles payment card details; RecallMenu does not store card numbers. Embeds require no viewer account or third-party cookies, and load no social media SDKs. Clicking a sharing link opens the selected external service. Hosting providers may log page requests. After paid access ends, account and tracker settings are retained for a 90-day recovery and support window. They then become eligible for individual review, not automatic deletion. Necessary billing, dispute and security records may remain for a documented purpose. Stripe retains payment records under its own policies; it is not a backup of your tracker settings. Contact the operator for account deletion requests.

Using the site

Search starts with 18 records. Activate Load more records to append another batch; scrolling alone does not load more, so the footer stays reachable. Images load as needed. Search results do not automatically refresh while you read.

The interface supports keyboard navigation, visible focus indicators, labeled controls, reduced motion, mobile layouts and print-friendly record pages. Filtering works with standard HTML forms and does not depend on JavaScript. Copy, print, subscription and inquiry forms use browser JavaScript.

Accessibility checks reduce barriers but are not a certification that every assistive-technology combination will work. Official external notices and attachments have their own accessibility characteristics.

Independent information

RecallMenu is an independent reference tool, not a government website. Source notices take precedence. The site does not diagnose illness or determine whether an individual product is safe.

Privacy requests and accessibility help

Use the appropriate contact below for access, correction or deletion requests, or to report an accessibility barrier. Do not include passwords, payment details, medical information or signed subscription links. We may need to verify ownership before changing private records. Removing a database record does not immediately erase provider logs or backups; necessary suppression, security and billing records can remain. We do not promise immediate deletion from every system.

Privacy requests: privacy@recallmenu.com. Accessibility and site help: support@recallmenu.com. Contact details and mailbox availability.

Optional state preference

If supplied, your state abbreviation is stored in the private subscription table and used to filter email and SMS digests. It is not shared with advertisers.