Privacy policy

1 · Data that stays on your device (signed-out users)

When you use PlatePal without signing in, the following is stored only on your device and is not transmitted to us:

• Your dietary/faith profiles, allergen selections, strictness settings, and custom avoid-list.
• Your scan history and saved products.
• Your optional account display name and email (kept on-device unless you sign in, as described in section 3).
• Notification preferences.

If you delete the app or use the in-app “wipe data” control, this data is removed from the device. Allergen detection is never gated: it is always free and always runs on-device, regardless of whether you sign in.

2 · Data sent to third parties to make the app work

• Open Food Facts (openfoodfacts.org). When you scan a barcode or search for a product, the barcode or search text is sent to Open Food Facts to retrieve product information. These requests are not linked by us to your identity. Open Food Facts is an independent project with its own privacy policy.
• RevenueCat (revenuecat.com). Handles subscriptions and purchases. By default you are identified to RevenueCat only by an anonymous app-generated id. If you sign in, your account user id is sent to RevenueCat so your subscription follows you across devices. Purchase transactions are processed by Apple or Google and reported to RevenueCat.

3 · Optional account (Sign in with Apple / Google)

Signing in is optional, and signing in is how you turn syncing on. When you sign in:

• We create an account linked to your Apple or Google identity (provider user id, display name, email).
• Your dietary/faith profiles, allergen selections, scan history, saved products, notification preferences, and any product photos you take are stored on our servers (Supabase) and follow you across your devices.
• This data is protected by per-user row-level security and is used solely for app functionality. It is not used for tracking or advertising.
• Your account user id is also sent to RevenueCat so your subscription follows you across devices.

If you stay signed out, none of the above leaves your device.

You can delete your account and all synced data at any time from Settings → Account → Delete account. Deleting your account permanently removes all server-stored data linked to your identity, including any coverage-gap records and alternatives-watch records. Products you share to the community product database are stored under your signed-in account and are removed when you delete your account (sharing to the database requires sign-in, see section 4).

4 · Camera and photos

The camera is used to scan barcodes and to photograph ingredient labels for on-device text recognition (OCR). Camera frames are processed on your device and are not uploaded. If you are signed in, product photos you take are synced privately to your account on our servers (Supabase) as described in section 3.

Separately, the optional “Contribute scanned labels” feature is on by default (opt-out). While it is on, the product details (barcode, name, ingredients text) and any label photo you capture are saved on your device. Sharing them to PlatePal's community product database (on our servers, Supabase) requires you to be signed in, and only products with a barcode are shared; barcode-less captures stay on your device only. Shared contributions are stored under your signed-in account, help give other PlatePal users an instant verdict, and may be shared onward with Open Food Facts under its open database license in a future step. A contribution never includes your allergens, dietary or faith profiles, strictness, the verdict, or which products you check. You can turn this off at any time in Settings → Data & contribution, and a label photo is kept only while it is on.

5 · Anonymous ingredient & barcode telemetry (always on)

On every scan, when a product contains ingredients we don't recognise yet, we send those ingredient names and the product barcode to our own servers so we can see which ingredients to define next. This stream is anonymous and is always on: no account is involved and there is no toggle, because it carries nothing that identifies you.

What we send: the ingredient token text, the product barcode, whether the product was found in our database, which public data source provided it (for example Open Food Facts or USDA), how the scan was started (barcode, search, or photo), your app version, the ingredient-database version, and a two-letter language code (such as “en”). We also send a random session identifier that is regenerated every time you open the app, so it cannot be used to identify you across sessions.

What we never send: your name, email, allergen selections, dietary profiles, verdict results, or any other health or personal information.

This data is classified as “Diagnostics / Product interaction,” not “Health,” because it contains no profile or verdict information. It is not tracking: there is no advertising identifier, no cross-app linkage, and no stable identifier, so no App Tracking Transparency prompt is required.

6 · Usage analytics (anonymous, on by default, opt-out)

PlatePal records a small set of anonymous usage events so we can see where the app works well and where it fails. This is on by default, and you can turn it off at any time with the “Share usage analytics” toggle in Settings → Data & contribution; your choice is remembered across launches, and turning it off stops collection immediately and discards anything not yet sent. These are coarse funnel signals (for example, counts of scans started, paywall views, returns after install, when you reach a daily limit, and which premium feature prompted a paywall) sent to our own servers (Supabase, a first-party sink, not a third-party analytics company). They are never tied to your account or identity, which is why we are comfortable having them on by default.

The only stable identifier attached to these events is an opaque, randomly generated per-install device identifier that is not linked to your account, your name, or any other identity. Paywall events additionally carry a per-view, non-persistent join id (generated fresh for each paywall view, never stored as a profile, and not linked to your identity) used solely to correlate a paywall view with its resulting purchase. When an A/B experiment is active, we also record an experiment_exposure event containing only the experiment name and the variant you were assigned, both short opaque keys defined on our servers (such as paywall_a or control), never free text.

These events never include your allergen or dietary identities, the verdict for a product, the identity of a scanned product, a barcode, an ingredient name, or any other personal information. This is not cross-app tracking and does not require the iOS App Tracking Transparency prompt. You can turn usage analytics off at any time in Settings → Data & contribution.

7 · This website (tryplatepal.com)

Everything above describes the app. This section covers the website you are reading now, which is separate and works differently.

This site uses Microsoft Clarity, a third-party analytics product, to understand how people move through these pages. Clarity records a replay of your visit to this website (pointer movement, scrolling, clicks, and page changes) and aggregates those visits into heatmaps. It also sets cookies to recognise a returning browser, and it receives your IP address and user-agent as part of any ordinary web request. This data goes to Microsoft, not to us, and is handled under the Microsoft Privacy Statement.

What Clarity does not get. It is limited to this marketing website. It has no access to the app, to your scans, to your allergen, dietary, or faith profiles, or to anything stored in your account. The recording captures this page as you saw it, which here is public marketing copy: the site has no login and no fields that ask for personal information. The only input boxes are the product checker and E number decoder search boxes, which take a product name, barcode or code. Clarity runs on its default masking setting, which additionally hides numbers and email addresses, and in every mode it refuses to capture what is typed into an input box or picked from a dropdown.

We also send Clarity a few named events describing how you used the page, for example that the “open in your browser” sheet appeared when you tapped an App Store link from inside Instagram or TikTok. These record what happened on the page, never who you are.

Your choice. If your browser sends a Global Privacy Control or Do Not Track signal, Clarity is not loaded at all and no recording is made. Most browsers and privacy extensions can send one, and blocking clarity.ms at the browser or extension level also stops it completely. The rest of the site works normally either way. You can also opt out through Microsoft directly using the Clarity opt-out options.

Cloudflare Web Analytics. This site is served by Cloudflare, and we use Cloudflare Web Analytics to count page views and measure how fast pages load. It sets no cookies, does not use your IP address to identify you, and only produces aggregate totals such as how many people viewed a page. It builds no profile of you and cannot follow you to other sites. Because it is aggregate only, it runs for every visitor. It is handled under the Cloudflare Privacy Policy.

Google Analytics, through Cloudflare Zaraz. We count page views and a few named events with Google Analytics 4, sent through Cloudflare Zaraz. Zaraz sends the data to Google from Cloudflare’s servers, not from your browser, so no Google script runs on the page, and it hides your IP address from Google. The named events are: a tap on an App Store or Google Play button (which button, and which page it was on), a click on a link to another website (only that site’s domain), and use of the product checker and E number decoder. For the checker we record only whether you searched by name or by barcode and the resulting halal, kosher, vegetarian, and vegan states, never the product name or the barcode you typed. To tell a returning visitor from a new one, Zaraz sets first-party cookies on this site: cf_zaraz_client and cfz_google-analytics_v4, which last up to one year, and cfzs_google-analytics_v4, which ends with your browser session. We do not link this data to your PlatePal account, use it for advertising, or share it with Google for its own products. If your browser sends a Global Privacy Control or Do Not Track signal, Zaraz is not loaded at all: no cookies are set and nothing is sent. Google’s handling is covered by the Google Analytics terms and Google Privacy Policy.

Campaign tags on store links. The App Store and Google Play links on this site carry a short campaign tag that names the page and the spot on the page the link came from, for example the end of the Nutella article. Apple and Google use that tag to tell us, in aggregate, how many installs each page led to. The tag describes the page, not you, and we never receive a list of who installed.

We do not run advertising trackers on this website, and we do not sell or share this data.

8 · Remote configuration

At startup, PlatePal fetches a public configuration document from our servers. This request contains no personal information, no device identifier, and no account identifier; it is an unauthenticated read of a static, non-personalised document. If an A/B experiment is defined in the configuration, the app assigns you to a variant using a random identifier stored only on your device, and that identifier is not sent to our servers as part of the configuration request. If usage analytics is on (the default), the resulting assignment is reported via the experiment_exposure event described above. Remote configuration is used to roll out new features gradually or to run structured tests; it does not enable advertising targeting or cross-app tracking.

9 · Coverage-gap records (signed-in and opt-in only)

When you are signed in and have enabled “Notify me when we add data for products I couldn't scan” in Settings → Notifications, PlatePal stores a record on our server when a scan returns Insufficient Data because of unrecognised ingredient tokens. This record contains your account identifier, the product barcode (if available), the list of unrecognised ingredient tokens, and timestamps for when the record was created and when you were notified. It does not contain your verdict result, allergen detection outcomes, dietary or faith profiles, the product name, or any other product content.

The purpose is to send you a notification when a future PlatePal data update covers one of those previously unrecognised ingredients. These records are captured only when both conditions are met (you are signed in, and you have enabled the preference). They are protected by per-user row-level security and are not used for tracking or advertising. All coverage-gap records are permanently deleted when you delete your account, and you can stop new records from being created by disabling the preference.

10 · Alternatives-watch records (signed-in and opt-in only)

When you are signed in and have enabled “New alternatives for products you couldn't use” in Settings → Notifications, PlatePal stores a record on our server when a scan returns a Concerns Found verdict in a known product category. This record contains your account identifier, the product category, the product barcode (if available), a baseline count of how many alternative products existed in that category at the time, and timestamps for when the record was created and when you were notified. It does not contain your verdict result, allergen detection outcomes, your dietary or faith profiles, the product name, or any ingredient text.

The purpose is to notify you when new products are later added in the category of a product that didn't fit your profile, so you can re-scan and check them. These records are captured only when you are signed in and have enabled the preference. They are protected by per-user row-level security, are not used for tracking or advertising, and are permanently deleted when you delete your account. You can stop new records from being created by disabling the preference.

11 · Weekly Safe List summary (signed-in and opt-in only)

When you are signed in and have enabled “Weekly Safe List summary” in Settings → Notifications, PlatePal's weekly job reads the count of products in your saved list and sends you a push notification of the form “Your Safe List has N products that fit your profile.” The push contains only the count; no product names, barcodes, ingredient text, or verdict details. This digest does not store any new record on our servers: it reads your existing saved-products count (already part of your synced account data, see section 3) and discards it after sending. Disable the preference in Settings → Notifications to stop the digest; deleting your account removes your saved products entirely.

12 · Advertising

The current build does not run any cross-app advertising tracker. PlatePal does use privacy-preserving first-party install attribution (Apple Search Ads via Apple's AdServices on iOS, and the Play Install Referrer on Android) so we can measure which campaigns bring new users. These signals flow only to RevenueCat, do not use the iOS advertising identifier (IDFA) or the Android advertising id (GAID), do not require the App Tracking Transparency prompt, and do not change the store “Data used to track you” label. In a future version we may add advertising attribution on platforms such as Meta or TikTok. If we do, it will require your permission via the system App Tracking Transparency prompt on iOS, and we will update our store privacy labels accordingly. Until then, no cross-app tracking occurs.

13 · Data we do not collect

• No precise location, contacts, or browsing history.
• No health records beyond the dietary preferences you enter yourself.
• We do not sell personal data.

14 · Children

PlatePal is not directed to children and does not knowingly collect personal information from children.

15 · Your choices

• Stay signed out to keep all dietary, faith, and allergen data on your device only.
• Delete your account (Settings → Account → Delete account) to permanently remove all server-stored data linked to you, including any coverage-gap records and alternatives-watch records.
• Disable “Notify me when we add data for products I couldn't scan” (Settings → Notifications) to stop new coverage-gap records from being created.
• Disable “New alternatives for products you couldn't use” (Settings → Notifications) to stop new alternatives-watch records from being created.
• Disable “Weekly Safe List summary” (Settings → Notifications) to opt out of the weekly digest.
• Turn off “Share usage analytics” (Settings → Data & contribution) to opt out of anonymous usage analytics. It is on by default; the events are anonymous and never linked to your identity.
• Turn off “Contribute scanned labels” (Settings → Data & contribution) to stop sharing product contributions (on by default).
• Turn on Global Privacy Control or Do Not Track in your browser to stop this website recording your visit, setting analytics cookies and sending usage events to Clarity or Google Analytics (see section 7). Blocking clarity.ms also stops Clarity. The site works normally either way.
• Use the in-app data wipe to clear on-device data.
• Manage or cancel your subscription via the App Store or Google Play.
• Request deletion of your account and data.

16 · Security and accuracy

Product data from Open Food Facts is community-sourced and may be inaccurate or incomplete; PlatePal is a screening aid, not a religious or medical ruling. Always verify the product label yourself, especially for allergens.

17 · Contact

Questions or requests: platepal@supportu.ai.