Food Scanner
Privacy Policy
Last updated 11 September 2026
This policy explains what the Food Scanner iOS app (“the App”) collects, why, and what you can do about it. Food Scanner is published by Unikklab LLC (“we”, “us”), a New Mexico limited liability company, which is the data controller for everything described here.
The short version. You do not create an account and we never ask for your name, email or phone number. Photos you scan are sent to our backend and analysed by an AI vision provider, then deleted within 24 hours. Your dietary preferences and allergens are health-related, so we only process them with your explicit consent. The App shows no advertisements.
1. Photos you scan
- Scans are uploaded, not analysed on your device. When you photograph a product or a meal, the image is sent to our backend and passed to a third-party AI vision provider, which reads the ingredients and returns the analysis.
- We do not name the provider here because we change models as they improve. You can ask us for the current list at any time and we will send it.
- Images are deleted within 24 hours of the scan. We do not keep an archive of what you eat.
- We do not use your photos to train models, our own or anyone else’s.
- Processing takes place outside your country, including in the United States. See section 7.
The App asks for camera access when you take your first scan, and photo library access if you choose an existing picture instead. Both prompts appear only at the moment the feature needs them, and declining either does not stop the rest of the App from working.
2. Your dietary profile is health data
During onboarding you set a goal, a dietary preference and any allergens. Under the GDPR, allergen and dietary information is data concerning health, which is a special category.
- We process it only on the basis of your explicit consent, which you give by entering it.
- It is used for one purpose: adjusting your score and warning you about ingredients you asked to avoid.
- You can change or clear it at any time in the App’s settings, and deleting the App removes it from your device.
3. Everything else we collect
You do not give us
No name, no email address, no phone number, no postal address, no payment details, no contacts and no location. There is no account to create and no password to set.
Collected automatically
- A random device identifier. The App signs in anonymously, which produces a random id used to keep your settings and subscription attached to your device.
- Device and diagnostic data. Device model, iOS version, App version, language and region, crash reports and performance traces.
- Usage data. Which screens are opened and which features are used.
- Advertising identifier (IDFA). Only if you allow it through Apple’s App Tracking Transparency prompt, and only to measure which campaign led to an install. See section 4.
- Purchase events. Which subscription you hold and whether it is active. Apple handles the payment; we never see your card.
You give us if you choose to
- Support correspondence. If you email us we receive your message and your email address.
4. Advertising and tracking
Food Scanner shows no advertisements. There is no ad network in the App and no third party serves you content inside it.
We do ask for permission through Apple’s App Tracking Transparency prompt, for one narrow purpose: understanding which marketing campaign led to an install, so we know where to spend. If you decline, the App works exactly the same. You can change your answer at any time in Settings, then Privacy and Security, then Tracking.
Apple’s SKAdNetwork also reports campaign performance to us in an aggregated, privacy preserving form at the operating-system level, carrying no identifier for you.
5. Why we process it, and on what legal basis
| Purpose | What it covers | Legal basis under the GDPR |
|---|---|---|
| Analysing a scan | Uploading and reading your photo | Performance of a contract |
| Personalising your score | Goal, diet and allergen settings | Explicit consent (Article 9) |
| Keeping the App working | Crash reports, diagnostics, abuse prevention | Legitimate interests |
| Improving the App | Aggregate usage analytics | Legitimate interests |
| Subscriptions | Validating and restoring entitlements | Performance of a contract |
| Marketing measurement | Attributing an install to a campaign | Consent, via the ATT prompt |
6. Who receives data
| Provider | What it is for | Their policy |
|---|---|---|
| Apple | App distribution, in-app purchases, SKAdNetwork | apple.com/legal/privacy |
| Google Firebase | Anonymous sign-in, backend functions, storage, analytics, crash reporting, remote configuration | firebase.google.com/support/privacy |
| RevenueCat | Subscription management and receipt validation | revenuecat.com/privacy |
| AI vision provider | Reading the ingredients in your scan | List available on request |
7. How long we keep things
| Data | Retention |
|---|---|
| Scan images | Deleted within 24 hours |
| Scan results and history | On your device, until you delete them or remove the App |
| Dietary profile and allergens | On your device, until you change or clear them |
| Crash and diagnostic data | Up to 90 days |
| Aggregate usage analytics | Up to 14 months, in aggregate form |
| Subscription records | For the life of the subscription plus the period tax law requires |
| Support email | Until the matter is closed, then up to 12 months |
Deleting the App stops all further collection from your device immediately.
8. International transfers
We are a United States company, and our providers process data in the United States and in other countries. Where data leaves the European Economic Area or the United Kingdom, those transfers rely on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses.
9. Your rights
Wherever you live, you can write to [email protected] and ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or stop using it altogether. We answer within 30 days and we do not charge for it. You may also withdraw your consent to the processing of your dietary and allergen data at any time, by clearing it in the App.
- EEA and UK: these are your rights under Articles 15 to 22 of the GDPR, and you may complain to your national supervisory authority.
- California: you may request disclosure and deletion under the CCPA and CPRA, and we will not treat you differently for asking.
We do not sell or share personal data for money or for cross-context behavioural advertising. The App carries no advertising.
Because there is no account, the fastest way to identify your data is to send us the device identifier shown in the App under Settings.
10. Data categories
| Category | What we hold | Basis |
|---|---|---|
| Visual records | The scan photo, deleted within 24 hours | Performance of a contract |
| Health | Dietary preference and allergens | Explicit consent |
| Transaction security | Device id, IP address, crash and diagnostic logs | Legitimate interest, legal obligation |
| Customer transaction | Subscription plan and status | Performance of a contract |
| Marketing | Advertising identifier, campaign attribution | Explicit consent |
We hold no identity information, because we never ask for it.
11. Children
Food Scanner is not directed at children under 13, or under the higher age of digital consent where your country sets one, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, write to us and we will delete it.
12. Security
Data is encrypted in transit. Access to our backend is limited to the people who need it, and scan images are deleted automatically rather than left to be cleaned up by hand. No system is completely secure and we cannot promise absolute security.
13. Changes
We may update this policy. The date at the top always reflects the current version, and we will announce material changes in the App before they take effect.
14. Contact
Unikklab LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110
United States
[email protected]