When I first downloaded the McDonald’s app years ago, I signed up for its loyalty program hoping to get better deals. Why not get some cheap French fries? While I understood that this would entail some type of data tracking, I didn’t grasp how the information would be used to algorithmically predict my next purchase.

As a California resident, I have the legal right to access the data a company stores about me. So, I decided to request that information from McDonald’s to better understand what one of the major fast-food companies is collecting about its customers. A few days after I visited the McDonald’s Privacy Rights Center site and requested access, I received a 515-page file in my inbox with the iconic golden arches stamped across the top.

When customers sign up for loyalty programs, like the one offered through the McDonald’s app, they might not fully realize the extent to which their data is being aggregated and used in predictive models.

“McDonald’s secret sauce is really commercial surveillance,” says Jeff Chester, executive director at the Center for Digital Democracy, a group that advocates for consumer protections. Privacy experts I spoke with said this level of detail may feel invasive, but it’s fairly standard for how large companies in America run their loyalty programs.

“This report contains specific pieces of personal information about you that were identified by searching McDonald’s systems which contain information about our customers,” read the report’s intro. It was lengthy and difficult to parse, so I used a generative AI tool to extract key information before verifying details with the original document and reaching out to privacy experts.

“McDonald’s takes data privacy and security seriously, and we take robust steps to safeguard customer information,” a McDonald’s spokesperson tells WIRED via email. “Like many digital loyalty programs, we use information such as past purchases to provide a more engaging, personal customer experience—like delivering the most relevant deals, offers and messages. Our customers continue to have privacy choices available to them as outlined in our privacy statement.”

Much of my data report contains a detailed account of past McDonald’s transactions as well as offers the fast food company sent me and how many loyalty points I accumulated. Essentially, every time I opened up the app to grab a bite to eat, it created a detailed record about when, where, and what I purchased. The log was even more thorough than I anticipated, including a record of every time I’ve scanned a code as part of its returning Monopoly sweepstakes along with the prize I received.

While the sheer amount of data McDonald’s stored over the years caught me off guard at first, the way it was used by the company’s predictive algorithms was what I found most concerning. The company predicted how often I would visit in the next six weeks (2.16 times), what I would spend on average ($13.49), and what I would spend in total ($29.15). One reporter at WIRED joked that McDonald’s had created a Minority Report-style dossier to predict my next snack wrap purchase.

Beyond the numbers, McDonald’s also tracked a large Diet Coke as my favorite item to repeatedly purchase. It labeled my core purchasing habits as getting a “Food-Led Afternoon Snack” or an “On the Go Lunch in a Rush.” (Jokes about grabbing a “food-led” snack have now become a meme in my household.) Notably, the report also listed my “attrition” score as zero, which could mean that Ronald McDonald sees me as a lifelong customer who’s never going to stop grabbing French fries and a soda on the walk home.

“The 500 pages is kind of a wake-up call,” says Lorrie Cranor, a professor at Carnegie Mellon University and director of the CyLab Security and Privacy Institute. “But it’s not in a format that people will readily understand.” She says a more beneficial approach for consumers would be highly detailed disclosures during the sign-up process that lay out what’s going to be stored in your “permanent record” and how that data will be used to make specific inferences about you.

When it comes to this kind of data collection, there’s a stark power imbalance between the individual consumer and a well-organized company. “You’re mediated by the technology,” says Ryan Calo, a professor at the University of Washington and faculty co-founder of its Tech Policy Lab. “You’re going through their drive-through. You’re using their kiosk. You’re using their app. You’re in their ecosystem, and they have a bunch of people with letters after their names trying to design it in a way that maximizes profit.” Calo sees this power imbalance impacting users. Rather than benefiting consumers with sweet deals, loyalty programs can be used for long-term surveillance.

While many of the data points in my McDonald’s report, when viewed individually, seem innocuous, the accumulation of information over years creates a creepily accurate picture of my habits. “You eating this burger or liking that musician itself may not be private, but the aggregation and collection of this information, as well as its processing through AI, can create pretty invasive and personal information about when you’re going to be there, what you do during the day, and so forth,” says Ari Ezra Waldman, a professor of law at the University of California, Irvine.

Along with the right to request access to the data collected about me, I can also request that McDonald’s delete what it has stored. After rifling through the document, I went back to McDonald’s Privacy Rights Center and requested that everything be deleted. It always feels good to have a clean slate. Maybe, I hoped, this could be a turning point.

When I spoke with Cranor, she was floored by just how often I went to McDonald’s: “This guy eats a lot of McDonald’s.” My boss, who was also stunned by my processed food choices, says I now have to stop eating there. Despite my love of crispy Diet Cokes and greasy French fries, I agree. Not out of shame, or even as part of an attempt to make healthier food choices—I want to leave it all behind just to prove the algorithm wrong.