afs privacy policy
The short version
- You don't need an account. Your scans, your goal and your plan stay on your iPhone unless you share them with your family (§2).
- To look up a product, afs sends our servers the barcode or the ingredient text. Never your name, and never a photo: labels are read on your iPhone.
- Only ingredient text, never personal data, reaches the trusted AI and data service providers that help us read unusual ingredient names.
- If you choose to share with your family, you sign in with Apple, and your first name and the scans you share are stored in the European Union.
- Usage data is sent only if you say yes, and you can change your answer in Settings at any time.
- §8 lists every provider that handles data for us, where it does so, and what binds it to protect the data today.
- We don't sell or share your personal information, we show no ads, and we don't track you across other companies' apps and websites.
- "Delete my data" in Settings clears this iPhone. "Delete account" in Settings › Account deletes your family account.
1. What stays on your iPhone
Unless you share them as §2 says (a family's plan name and goal and the scans you share with it, and, if you say yes to usage data, one summary of the first-run screens), your scan history with each result, your goal and its history, your plan name, your answers from the first-run screens, your preferences and your notification settings are stored only on your iPhone. iOS includes them in your iCloud or encrypted device backup, which Apple holds under its own terms, not us.
Your iPhone's Keychain also holds three small items (and, while you're signed in to a family, your sign-in session and the id Apple gives afs for you): a random app id (the "App User ID" in Settings, used for your subscription), the free-scan counter and a note of when afs asked for notification permission.
2. What leaves your iPhone, and why
Looking up a product
When you scan a barcode, search by name, or scan or type an ingredient list, afs sends our servers the barcode, the search words or the ingredient text, with your language, region and app version. Our servers look the product up, check its ingredients and send back the result. The text of a search or a label is sent inside the request, never in a web address.
- Our servers see your network (IP) address while they answer, to stop abuse (a limit on requests per address). They don't store it in full: each request writes one log line with the kind of request, the outcome and the timings, and the address shortened so it no longer points to one device. These lines are deleted before they are 7 days old. The web front end of our servers keeps no access logs. When a connection fails before our servers can read the request (for example a broken secure connection), the front end's error log notes your full network address, and nothing you asked for; its weekly rotation deletes these notes within 11 weeks. No log keeps a barcode, a search or ingredient text.
- When you scan or type the ingredient list of a product our database doesn't know yet, we keep that ingredient text with the product's barcode. Once it has been checked, we may use it to give the next person who scans that product a result; it never shows who sent it. Nothing in it says who sent it, so we can't find it again for you or delete it on request. It stops being used when the product's record arrives from our product data sources, and we keep it, with our product database and its backups, for as long as we run afs.
- Please type only ingredient lists into the ingredient field; the app says the same under the field. Anything typed there is sent to our servers and may reach the AI service below.
Reading unusual ingredient names
When an ingredient isn't in our dictionary, our servers ask one of our trusted AI service providers what kind of ingredient it is. Only ingredient text, never personal data, reaches it: our servers make the request, so it carries no account, no app id, no device data and not your network address. We use providers that keep no copy of what we send. We keep each answer by ingredient name, with nothing about who scanned it, so our team can review it.
Subscriptions and free scans
Payment is handled by Apple. To know whether you have a subscription, the app sends our subscription service provider your random App User ID and your App Store purchase records, from the first time afs opens, whether or not you subscribe. With each request it also sends an identifier iOS gives afs on this iPhone, which "Delete my data" does not change, plus the device model, the iOS version, your preferred languages, your App Store country and the app version. The provider also sees your network address. None of this is your name or your Apple Account's details.
Your first 3 scans are free on each iPhone or iPad. afs counts them in the Keychain, so the free-scan counter is not reset by "Delete my data" and usually not by deleting the app either (iOS does not promise that).
Usage data and crash reports
Only if you say yes, afs sends our analytics provider, whose servers are in the European Union, a record of how the app is used: which screens open, scans started and finished (with the barcode, the score and how long the scan took), paywall views, and errors in the app. Each record carries a random id made for analytics only, the app version, the device model, iOS version, language and time zone. It never carries your name, your App User ID, your account, your plan name, a search or ingredient text, and it is never combined with them. The provider is set to discard your network address and not to work out your location from it.
afs asks once, on a card on the Home screen after the first-run screens: "Share usage data" or "Don't share". Until you answer, and if you choose "Don't share", afs sends no usage data and stores no analytics id, wherever you live. If you choose "Share usage data", afs also sends one summary of the first-run screens: the scores you saw and chose, whether you made a scan, whether you allowed the camera, how long the screens took and whether you started a trial (never your plan name). You can change your answer at any time with the "Share usage data" switch in Settings › Data; turn it off and nothing more is sent. Nothing in afs, free or paid, depends on your answer.
Crash reports from iOS reach us only through Apple, from people who chose to share them with developers in iOS Settings.
Family sharing (only if you choose it)
Sharing your pantry with your family is optional. When you tap "Share with family" or join a family from an invite, you sign in with Apple. afs asks Apple for your name only, never your email address. Our family-sharing database provider, in the European Union (Paris, France), then stores:
- your account: the id Apple gives afs for you, and your first name as Apple shares it or as you type it ("Your name" in Settings › Account), which your family sees on the scans you make;
- your family: its name, the plan name, the goal and goal date, who is in it, who owns it and when each person joined;
- the scans you make while you're in the family: the barcode, the product's name and brand, its score and result, and when you scanned it, with your time zone;
- invites: only a scrambled form of each invite code, when it expires and who used it;
- a token from Apple, kept only so we can end afs's Sign in with Apple link when your account is deleted;
- failed invite-code attempts (who tried and when), kept a short time to stop people guessing codes (§4).
Your first name, and how many products were scanned that day, can appear in the family notifications other members receive. These pass through our notification delivery provider in the United States and Apple's push notification service, even if you don't allow notifications yourself.
Every member of your family can see the family's name, plan name, goal, members' names and the scans shared with it. No other afs user can, with one exception: someone holding a valid invite to your family (whoever you sent it to, or anyone they pass it on to) can see, before joining, the family's name and the first name of the member who sent the invite, and, once signed in, the members' first names and who owns the family. When you sign in, the provider records your network address and the kind of device with your session; this is deleted when you sign out or delete your account, and its system logs keep the addresses of requests for up to 1 day (up to 7 days on a paid plan).
If an invite link, https://aifoodscan.app/join/ followed by the code, is opened where afs isn't installed, it opens a page of our website, so the company that hosts our website receives your network address and the invite code (§13). The page only shows the code back to you; it looks nothing up and names no one.
Family notifications (only if you allow them)
If you're in a family and allow notifications, afs registers this iPhone to receive three family notifications: when someone joins (for the family's owner), when the family reaches its goal, and a short evening note on days another member scanned. To get that notification address (a "push token"), your iPhone sends our notification delivery provider, in the United States, the address Apple's push notification service gives this iPhone for afs and a random id the notification software makes for this installation of afs. For this, our family-sharing database stores this iPhone's push token, your time zone (so the evening note arrives at 7 PM where you are) and the Family switch in Settings › Notifications. Each notification's text, which can include a family member's first name and a number of scans, passes through our notification delivery provider, in the United States, and Apple's push notification service. We keep a record of each family notification sent for 7 days. afs never registers for notifications if you're not in a family.
Photos and the camera
afs uses the camera to read barcodes and ingredient lists. A photo of a label is read on your iPhone and deleted straight after; it is never uploaded. afs saves a score card to your Photos only when you choose Save Image.
When you write to us
"Contact support" and "Suggest a product" (Settings › Support) and "Report a problem with this result" (under a result) open your Mail app with a message to our support address, which you can read and change before you send it; afs itself sends nothing. If you send it, we receive your email address, the name your mail app shows, what you wrote and what the message holds: for "Contact support", your App User ID and the app version; for "Suggest a product", the product name and barcode you add; for a report, the product, its barcode, its Clean Score and the versions of our scoring. Our email provider keeps these messages for us. We use them only to answer you and to fix or add products, and we delete a conversation 12 months after it ends, unless the law requires us to keep it longer: once a month we delete the conversations that ended more than 12 months before, and deleted messages then leave our email provider's trash after 30 days.
What we never collect
Your email address (unless you write to us), your contacts, your location, health records, payment details (Apple handles payment) and the advertising identifier. afs shows no ads and doesn't track you.
3. Our legal bases (EEA, UK and Switzerland)
- To provide the app you asked for (GDPR Art. 6(1)(b)): looking up products, scoring them, your subscription, family sharing and family notifications.
- Our legitimate interests (Art. 6(1)(f)): limiting abuse and keeping the service secure (the network addresses in our logs), serving our website (§13), keeping ingredient text that is not linked to anyone so that a product someone scanned gets a result for the next person, and answering what you write to us. You can object (§9).
- Your permission (Art. 6(1)(a)): usage data, only after you choose "Share usage data" (§2), which you can withdraw with the switch in Settings › Data at any time; and notifications, through the iOS permission alert, which you can change in iOS Settings at any time.
- Legal obligations: records that the law requires, such as Apple's purchase records.
4. How long we keep it
| Data | Kept |
|---|---|
| Everything on your iPhone | until you use "Delete my data" or delete the app; the free-scan counter stays (§5) |
| Server log lines (shortened address, no barcode or text) | under 7 days |
| Error notes for connections that failed before the request was read (full network address, nothing you asked for) | under 11 weeks (the front end's weekly rotation) |
| Ingredient text kept for a product our database didn't know (not linked to you) | as long as we run afs, with our product database and its backups; it stops being used once the product's record arrives or our review rejects it |
| AI answers, by ingredient name (not linked to you) | as long as we run afs, as part of our ingredient dictionary and its backups |
| Subscription records at our subscription service provider and Apple | as long as their services need them and the law requires |
| Usage data (only if you said yes) | at least 1 year, the retention period of our analytics plan; after that the provider may delete it at any time |
| Your family account, family and shared scans | until you delete your account; when you leave a family, the scans you shared stay with it as "a former member" |
| The token from Apple for your family account (to end the Sign in with Apple link) | until your account is deleted |
| Failed invite-code attempts (who tried and when) | a day; then deleted at the next failed attempt by anyone, and at the latest when your account is deleted |
| Your push token and time zone | until you sign out (which "Delete my data" does too), leave the family, are removed, the family closes, or you delete your account, whichever comes first |
| Record of family notifications sent | 7 days |
| Emails you send us | 12 months after the conversation ends (we delete them once a month), unless the law requires longer |
| Our database provider's system logs (with network addresses) | up to 1 day (up to 7 days on a paid plan) |
| What our website's host receives (your network address and the page you asked for) | the host's own log period, which its privacy policy does not state; we keep none of it |
5. Delete my data: what it erases and what it can't
"Delete my data" is in Settings, in its own group at the end; in a family it reads "Delete data on this phone". It erases from this iPhone your scans, goal, plan, answers and preferences, the files afs saved, its scheduled notifications and two of the three Keychain items. It forgets your answer about usage data, so afs asks again and nothing is sent until you answer, under a new random analytics id; it also starts a new App User ID and restores an active subscription from the App Store. If you're signed in to a family, it first deletes this iPhone's push token (so it needs a connection) and then signs you out, which removes your sign-in session and the id Apple gives afs for you from the Keychain too, so only the free-scan counter stays there.
What it can't erase:
- The free-scan counter. It stays on this iPhone, so deleting your data never gives the 3 free scans back.
- Your family account and the scans you shared. They stay until you use "Delete account" (§6).
- Records held by Apple and our subscription service provider about your purchases. Your subscription is not cancelled; cancel it in Settings › Cancel subscription.
- The identifier iOS gives afs on this iPhone, which our subscription service provider has already received. "Delete my data" doesn't change it, so the provider could connect your old App User ID with the new one.
- Usage data already sent. It carries only the old random id, which nothing links to you, so we can't find it again.
- Ingredient text kept on our servers for unknown products, because nothing in it says who sent it, and server logs, which end on their own (§4).
To ask about data held by our subscription service provider, write to us with the App User ID shown in Settings before you use "Delete my data", because the delete replaces it.
6. Delete account
"Delete account" is in Settings › Account while you have a family account, and it works even when you're signed out (you sign in with Apple again to confirm). It first revokes afs's Sign in with Apple link at Apple, and then deletes from our family-sharing database your account, your name, your place in the family, the scans you shared, your push tokens and the record of family notifications sent to you. If you own the family, you choose who owns it next, or close it. It says it's done only once our database has confirmed.
It doesn't delete the scans on your iPhone (use "Delete my data") and doesn't cancel a subscription (Apple bills it until you cancel). Our database provider keeps no backups of this data on our current plan, so we promise none; if that changes, deleted data could stay in its backups for up to 7 days before it ages out. Its system logs keep request addresses for up to 1 day (7 on a paid plan).
If you stop using Sign in with Apple for afs. You can stop using Sign in with Apple for afs in your iPhone's Settings without opening afs. The next time afs opens on your iPhone, it finds out, signs you out on this iPhone at once and asks our servers to delete your family account as "Delete account" does; it asks again each time afs opens until our servers confirm. If you own the family, it passes to the member who joined first, or closes if no one else is in it. Once our servers confirm, afs tells you once that your account was deleted; the scans on your iPhone stay. If you stop using it and never open afs on that iPhone again, your family account stays until you write to us. If you delete your Apple Account, write to us and we will delete your family account (§10 says what to include), because afs can't tell a deleted Apple Account from a change of account on your iPhone. If your iPhone simply moves to another Apple Account, afs signs you out and deletes nothing.
7. Moving to a new iPhone
When you set up a new iPhone from an iCloud or encrypted backup, your scans, goal and plan come back with the backup, since iOS includes afs's own storage in it, and so does the free-scan counter, since afs keeps it in the Keychain in the way iOS moves to a new iPhone with such a backup. Your subscription comes back with Restore purchases in Settings. A family member signs in with Apple again to see the family. A restore onto a second iPhone is not yet verified on device by us, so if something doesn't come back, write to us.
8. Who handles your data for us, where, and how it is protected
These providers handle data for us, each only for the job named here; of them, only the AI service receives no personal data:
| Provider | What it handles for us | Where |
|---|---|---|
| The company that hosts our servers | the lookups of §2: your network address while a request is answered, shortened in our logs, and in full in the error note of a connection that failed before its request was read | Singapore |
| Our trusted AI service providers | ingredient text only, never personal data (§2) | the United States and elsewhere |
| Our subscription service provider | your App User ID, your App Store purchase records, an identifier for this device, the device model, iOS version, languages and App Store country, and your network address | the United States |
| Our analytics provider, only if you said yes | usage data under a random id (§2) | the European Union |
| Our family-sharing database provider, only in a family | your account, your family and the scans you share; the push token and time zone if you allow notifications | the European Union (Paris, France) |
| Our notification delivery provider, only in a family | from an iPhone that allows notifications, its Apple push address and a random installation id (to get the push token), and then its push token; and the text of each family notification, which can carry any member's first name | the United States |
| Our email provider, only if you write to us: Cloudflare Email Routing, which forwards your message, and Google, which keeps it | your messages to us | Cloudflare: the United States, the European Economic Area and its data centres elsewhere; Google: its servers around the world, which may be outside the country where you live |
| The company that hosts our website, only if you visit it | your network address and the page you ask for, which on an invite page includes the invite code (§13) | the United States, the European Economic Area and its data centres elsewhere |
We want every provider to protect it at least as well as this policy says we do and as Apple's App Store rules require. Today, this is what binds each one:
- Our subscription service provider, our family-sharing database provider, our notification delivery provider and the company that hosts our website (which also forwards the emails you send us) are bound by data processing terms that are part of their service agreements with us: they may process the data only on our instructions, to provide their service to us, and must keep it confidential and secure.
- Our analytics provider handles usage data under its terms of service, which let it use the data to provide its service to us and, once aggregated or de-identified so that it can't identify anyone, to develop its own products. We have not signed its separate data processing agreement yet.
- The company that hosts our servers handles the lookups of §2 under its own terms; we have no separate data processing agreement with it yet.
- The inbox where our email provider keeps your messages is a personal account under that provider's own terms and privacy policy; no data processing agreement covers it.
- Our AI service providers receive no personal data, and every request we send them asks that nothing be kept.
Apple also handles data for afs as part of iOS and the App Store (purchases, Sign in with Apple, the delivery of notifications, and crash reports you chose to share), under Apple's own privacy policy.
Where personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, such as Singapore or the United States: our subscription service provider and our notification delivery provider rely on the European Commission's Standard Contractual Clauses, which are part of their terms; the company that hosts our website relies on them and on the EU-U.S. Data Privacy Framework, also part of its terms; and our family-sharing database provider and our analytics provider store the data in the European Union. The inbox where our email provider keeps your messages moves data under that provider's own privacy policy. With the company that hosts our servers in Singapore, no Standard Contractual Clauses are in place yet; it sees your network address only as §2 describes.
9. Your rights
Wherever you live, you can ask us what we hold about you, to correct it, to delete it or to receive a copy, and you can object to our legitimate-interest uses. Most of your data is only on your iPhone, where you control it: "Delete my data", "Clear scan history" and the CSV file in Settings › Data. For anything we hold, write to the contact above; we answer within one month.
- EEA, UK and Switzerland: you also have the rights to restrict processing, to data portability, and to withdraw a permission at any time, and you can complain to your data protection authority.
- California and other US states: you can ask to know, delete and correct personal information. We don't sell personal information and don't share it for cross-context behavioral advertising, so there is nothing to opt out of; we don't collect sensitive personal information; and we won't treat you differently for using these rights.
Changing your mind. You can withdraw what you agreed to at any time, as easily as you gave it; withdrawing stops what comes next and doesn't undo what was sent before:
- usage data: turn off "Share usage data" in Settings › Data;
- notifications: the switches in afs's Settings › Notifications (the Family switch for family notifications), or iOS Settings › Notifications › AI Food Scan;
- the camera and Photos: iOS Settings › Apps › AI Food Scan;
- family sharing: leave the family in Settings › Family, sign out in Settings › Account, or delete your account there, or stop using Sign in with Apple for afs in your iPhone's Settings, which signs you out and asks our servers to delete it the next time afs opens (§6);
- everything afs keeps on this iPhone: "Delete my data" (§5).
Asking us to delete what your iPhone can't. "Delete account" removes your family data at once (§6). For anything else we or our providers hold, write to the contact above; for subscription records, include the App User ID shown in Settings before you use "Delete my data" (§5). Usage data already sent and ingredient text kept without a name can't be found again, because nothing in them points to you (§5).
10. Children
afs is for a general audience. It is not directed to children, and it doesn't ask anyone's age. On your own you need no account, and your scans stay on your iPhone (§1).
A family account is for people aged 13 or over (or the age of digital consent where they live, if that is higher), so a member of a family may still be under 18. A family account keeps the same things for every member, whatever their age: their first name, the id Apple gives afs, the scans they share with the family (with the time zone of each), and, if they allow notifications, their iPhone's push token and time zone (§2). Everyone in the family sees their first name and the scans they share, and their first name can appear in the family notifications other members get, sent through our delivery provider in the United States; no other afs user does, except someone holding a valid invite to the family, who can see the members' first names before joining (§2). A child can also have a subscription through Apple Family Sharing without an afs account.
If the family's owner removes a member, that member stops seeing the family's scans and gets no more family notifications, and the scans they shared stay with the family as "a former member", without their name. Their account stays until it is deleted. To delete a child's family account and the scans it shared:
- on the child's iPhone, use "Delete account" in Settings › Account (§6); or
- write to us at the contact above with the family's name and the first name the child uses in it. We delete the account, its name, its place in the family and the scans it shared (if the child owns the family, it passes to the member who joined first, or closes if no one else is in it). We may ask for details that show the request is about that account.
If you believe a child under 13 (or under the age of digital consent where they live) has a family account, write to us and we will delete it.
11. Security
Every connection uses encryption (HTTPS). Your family data is protected by rules that let only the members of a family read it. Our secret keys stay on our servers, never in the app; the app holds only the public keys these services are made to have in an app. No method is perfectly secure, but we keep the data we hold to the minimum the app needs.
12. Changes
When we change this policy we update the date at the top, and for a significant change we tell you in the app or in an app update's notes before it applies. This policy was first written on 27 October 2026 and takes effect on 2 November 2026.
13. Our website
This policy also covers our website, aifoodscan.app. The website sets no cookies of its own, has no forms or accounts, shows no ads, runs no analytics and loads nothing from other companies. Its one small script only runs the animations and sends nothing anywhere.
When you open a page, the company that hosts our website receives your network address and the page you asked for, as the host of any website does, to deliver the page and keep the website secure (§8). We keep no log of our own for the website. An invite page is the one place where a web address carries something of yours, the invite code (§2). If you email the address on our support page, "When you write to us" in §2 applies.
14. Contact
GlitchedLab. Email: support@aifoodscan.app.