Cookie Policy

Last updated: August 6, 2026

This Cookie Policy explains how AR Menu ("we," "us," or "our") uses cookies, localStorage, sessionStorage, IndexedDB, and similar browser storage technologies (collectively, "cookies and similar technologies") on our Platform: the restaurant dashboard at dashboard.armenu.me, the diner-facing menu application at menu.armenu.me, the marketing website at armenu.me, and the backend API at api.armenu.me.

This policy should be read together with our Privacy Policy, which explains how we process personal data more broadly, and our Terms of Service.

1. What Are Cookies and Similar Technologies?

A cookie is a small text file that a website stores on your device (computer, phone, tablet) through your web browser. Cookies may be:

• First-party cookies: Set by the domain you are visiting directly (e.g., a cookie set by armenu.me when you visit armenu.me).
• Third-party cookies: Set by a domain different from the one you are visiting (e.g., a cookie set by stripe.com embedded on armenu.me).
• Session cookies: Temporary cookies that are deleted when you close your browser.
• Persistent cookies: Cookies that remain on your device for a set period or until you manually delete them.

In addition to traditional cookies, we use Web Storage APIs built into modern browsers:

• localStorage: Stores data with no expiration date. Data persists until explicitly cleared by the website or the user. Accessible only by JavaScript running on the origin that stored it.
• sessionStorage: Stores data for the duration of a browser tab session. Data is cleared when the tab is closed. Like localStorage, it is origin-scoped.
• IndexedDB: A low-level API for storing significant amounts of structured data, including files and blobs. Used by the menu PWA (Progressive Web App) for offline caching of dish images, 3D models, and menu data via the Workbox service worker.

Throughout this policy, we refer to all of these technologies collectively as "storage mechanisms" and specify which technology is used for each purpose.

2. Cookies and Storage We Use — Overview

Below is a complete inventory of every storage mechanism set by the AR Menu Platform, organized by category. We do not use any storage mechanisms beyond those listed here.

Note on third-party cookies: We do not use any advertising cookies, retargeting pixels, social media trackers, or cross-site tracking cookies. We do not integrate with Google Analytics, Facebook Pixel, or any analytics service that uses third-party cookies.

3. Category 1: Necessary Storage (Always Active)

These storage mechanisms are essential for the Platform to function and cannot be disabled. They are set in response to actions you take that amount to a request for services, such as logging in, setting language preferences, or loading a menu from a QR code. Under the ePrivacy Directive (EU) and PECR (UK), these are exempt from the consent requirement.

4. Category 2: Functional and Analytics Storage (Consent-Based)

These storage mechanisms are not strictly necessary for the Platform to function but enhance the experience and provide us with aggregated insights. Under the ePrivacy Directive and GDPR, these require your consent. These are set only after you accept them — either through our cookie banner (where implemented) or implicitly through using features that require them (such as return visits to the menu app).

5. Category 3: Third-Party Services and Their Data Flows

In addition to the first-party storage mechanisms listed above, certain third-party services that our Platform depends on may receive data from your browser as a byproduct of standard HTTP communication. This is not the same as third-party cookies (which we do not use), but we disclose it here for transparency.

6. FingerprintJS — Browser Fingerprinting in Detail

6.1 Why We Use Fingerprinting

We use FingerprintJS (an open-source library, v3, loaded from jsDelivr CDN) on the diner menu application for two specific purposes:

• Fraud prevention: Detecting automated scripts or bots that scan QR codes programmatically to harvest menu data, place fake orders, or abuse the platform. Browser fingerprints help distinguish legitimate diner browsers from headless browsers, Selenium scripts, or other automation tools.
• Accurate unique visitor counting: When a diner clears their browser data (including the armenu_diner_id from localStorage), we would otherwise count them as a new unique diner on their next visit. The browser fingerprint provides a secondary, more stable identifier — allowing us to deduplicate and provide restaurants with more accurate analytics ("this diner who cleared their cookies is the same person who visited yesterday").

6.2 How It Works — Technical Details

1. The FingerprintJS library (approximately 18 KB gzipped) loads in the diner's browser when they first access a menu.
2. The library collects approximately 30 browser characteristics: Canvas fingerprint (how the browser renders a hidden test image), WebGL vendor and renderer string, installed fonts (via font enumeration), audio context fingerprint, screen resolution and color depth, list of navigator plugins, platform and User-Agent, language, timezone, touch support, and more.
3. These characteristics are combined and hashed using SHA-256 entirely within the browser. The raw characteristic values are never transmitted to our servers or to any third party.
4. The resulting 64-character hexadecimal hash (e.g., a1b2c3d4e5f6...) is stored in localStorage under the key fingerprint_visitor_id and may be included in API requests to our backend.
5. Our backend stores this hash in the diner_sessions table alongside the session data. The hash cannot be reversed to reconstruct the original browser characteristics.

6.3 Privacy Implications

• No cross-site tracking: Our use of FingerprintJS is limited to our own domains (menu.armenu.me). The visitor ID does not follow you to other websites. We do not participate in any cross-site fingerprinting network.
• No raw data leaves the browser: The browser characteristics are computed and immediately hashed client-side. The raw characteristics (canvas image, font list, etc.) are discarded. Only the hash is stored.
• Not linked to real identity: The fingerprint hash is a pseudonymous identifier. We do not link it to a name, email, phone number, or any real-world identity unless the diner explicitly authenticates (e.g., creates an account — a feature not currently available to diners).
• Opt-out: You can prevent fingerprinting by blocking JavaScript on our menu domain (though this will break the AR and 3D viewing features) or by using a browser with fingerprinting protection (Brave, Firefox with ResistFingerprinting, Safari with Advanced Tracking Protection). Clearing localStorage also removes the stored fingerprint hash, though a new one will be computed on the next visit.

6.4 FingerprintJS vs. Fingerprint Pro

We use the open-source FingerprintJS library (v3), not Fingerprint Pro. The open-source version operates entirely in the browser — no data is sent to FingerprintJS Inc. servers. We do not have a commercial relationship with FingerprintJS Inc. and they do not receive any data from our use of their open-source library.

7. How to Manage, Delete, or Block Cookies

7.1 Browser Settings

All major browsers allow you to manage cookies and site data. You can typically:

• View all cookies and site data stored by a website.
• Delete specific cookies or all cookies from a domain.
• Block all cookies (may break site functionality).
• Block third-party cookies specifically.
• Automatically clear cookies when the browser closes.
• Use private/incognito mode (cookies and site data are automatically cleared when the private window closes).

Instructions for common browsers:

• Google Chrome: Settings → Privacy and security → Cookies and other site data → See all site data and permissions
• Mozilla Firefox: Preferences → Privacy & Security → Cookies and Site Data → Manage Data
• Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data
• Brave: Settings → Shields → Cookie blocking; Settings → Privacy and security → Clear browsing data

7.2 Clearing Web Storage (localStorage and sessionStorage)

Browser cookie management interfaces do not always include localStorage and sessionStorage. To clear these:

• Chrome/Edge: Open Developer Tools (F12) → Application tab → Storage → Local Storage / Session Storage → right-click the domain → Clear.
• Firefox: Open Developer Tools (F12) → Storage tab → Local Storage / Session Storage → right-click the domain → Delete All.
• Safari: Develop menu → Show Web Inspector → Storage tab → Local Storage / Session Storage.

7.3 Clearing PWA Cache (IndexedDB / CacheStorage)

The menu PWA at menu.armenu.me caches assets for offline use. To clear this cache:

• Chrome/Edge: Developer Tools → Application → Cache Storage → right-click → Delete. Or, Settings → Privacy → Clear browsing data → Cached images and files.
• Alternative: In the browser, visit menu.armenu.me, open Developer Tools → Application → Service Workers → click "Unregister." Then reload the page. The service worker and all its caches will be removed.

7.4 Effect of Blocking Cookies

If you block necessary cookies and storage:

• Dashboard: You will not be able to log in (authentication and CSRF protection depend on necessary cookies).
• Diner menu: The menu will still load and function for browsing, but: language preferences will not persist, the "continue browsing" feature will not work, orders may not route correctly to your table (sessionStorage is required for table identification), and the PWA offline mode will not function.
• Landing page: Language preference will not persist between visits (always defaults to English).

8. How to Withdraw Consent

For Category 2 (Functional) storage mechanisms, you may withdraw your consent at any time. There are several ways to do this:

8.1 Clear Browser Data

The simplest method is to clear all site data for our domains. This removes all localStorage and sessionStorage entries — including the functional ones (diner ID, last restaurant, fingerprint hash). Follow the instructions in Section 7 above. After clearing, the necessary storage mechanisms will be recreated on your next visit (as they are required for the Platform to function); the functional ones will not be recreated unless you implicitly consent again by using the features that require them.

8.2 Browser Fingerprinting Protection

To specifically prevent browser fingerprinting, you can:

• Use Brave Browser — blocks fingerprinting by default.
• Use Firefox with privacy.resistFingerprinting = true in about:config.
• Use Safari with Advanced Tracking Protection enabled (default on macOS and iOS).
• Use browser extensions that block or spoof fingerprinting scripts.

Note that fingerprinting-resistant browsers may cause the Platform to incorrectly classify your visits or may prevent AR/3D features that rely on WebGL (which is often disabled or spoofed by fingerprinting protections).

8.3 Cookie Consent Banner

Where required by law (EU/EEA, UK, California, and other jurisdictions with consent requirements), we display a cookie consent banner on first visit, allowing you to accept or reject Category 2 storage mechanisms. Your preference is stored and respected for 12 months, after which the banner will reappear. You can change your preference at any time by clearing site data and revisiting the page (the banner will reappear).

9. What Third-Party Services Receive Your Data

The following table summarizes which third-party services receive data from your browser when you use the Platform, either through cookies/storage or as a byproduct of HTTP requests. This repeats and consolidates information from Sections 2-6 for clarity.

10. Changes to This Cookie Policy

We may update this Cookie Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. For significant changes (e.g., adding a new third-party service that sets cookies or introducing new tracking mechanisms), we will also notify restaurant owners via email and display a notice on the Platform. We encourage you to review this policy periodically. Continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

The full version history of this policy is maintained in our internal records and available upon request to dpo@armenu.me.

11. Contact