Menu photos stay on your phone, and so does your scan history. The one thing MenuLens sends anywhere is a dish name, as text, so a server Lumaru runs can look up representative photos with the Brave Search API and hand back image links. That server keeps an anonymous identifier and a weekly count of your photo lookups, which is how we cap search costs. It holds no photo, no location, and no name, email, or account, because MenuLens has none of those. Subscriptions go through Apple, and Apple keeps your payment details to itself.
The full account is in the MenuLens section of our privacy policy.