Privacy Policy - FoodReveal: Food Scanner

1. Controller and scope

This notice describes the processing of personal data in the FoodReveal: Food Scanner mobile app, developed and operated by Adam Chierici. The reference website and contact point are foodreveal.app and the Contact page. We do not publish a physical address because the controller works remotely.

For privacy requests, use the Contact page or the email already present in the project: Luminatens@mail.com.

2. Account and authentication

Registration and sign-in use Firebase Authentication. We may process your email address, Firebase UID, email verification status and technical data needed to keep access secure. If you use an external sign-in provider, Firebase receives the data needed to complete authentication according to that provider's settings. FoodReveal does not store your password in readable form.

You can request account deletion from the app. The process schedules deletion of data associated with the account.

3. Photos, OCR and food analysis

When you use the scanner, you may provide photos of a nutrition table, ingredient list, package or dish. The app may use the camera, image library and text recognition to extract information from the image. Extracted text and data needed for analysis may be sent to FoodReveal backends and Cloud Functions.

The analysis may include product name, brand, ingredients, allergens, nutrition values, NOVA classification, scores, warnings, alternatives and explanations. Results are informational and are not a diagnosis, treatment or medical advice. Always compare the result with the original label and consult a professional when necessary.

4. Preferences and personalization

If you choose to provide them, we may process dietary preferences, allergies, intolerances, goals and other personal information needed to personalize scores, warnings and suggestions. Health-related information is considered only when you voluntarily enter it and only for the requested app functions.

5. History and Recall Radar

Scanned products and related results may be saved in your account history. Uploaded images and other scan data may be stored in Firebase services associated with your account to provide the requested feature.

When applicable, Recall Radar compares product, brand, ingredients and allergens with food-recall data and recall matches associated with the account. Alerts may come from official or public sources made available through the service. FoodReveal does not replace the original notice: always check the recall source.

If you enable notifications, we use Firebase Cloud Messaging and the device token to send relevant notifications, such as a recall associated with a scanned product. You can disable notifications in your device or app settings when available.

6. Advertising and consent

The app uses Google AdMob and the Google Mobile Ads SDK. Depending on the configuration and app version, the app may show banner, native, interstitial, app-open and rewarded ads.

Rewarded ads are optional. In the current configuration, a Free user may receive up to 5 rewarded scan credits per day and up to 3 rewarded ingredient-detail unlocks per day, if an ad is available and the reward is successfully verified. A reward is not guaranteed if the ad is interrupted or verification is not completed.

Google AdMob and its partners may process, where provided by the SDK configuration and device settings, advertising identifiers, Advertising ID or IDFA, IP address, device and operating-system information, app version, diagnostics, impressions, clicks and other advertising interactions. These data may be used for ad delivery, measurement, fraud prevention and personalization where permitted.

For users subject to applicable regulations, consent is collected through Google UMP. On iOS, consent for tracking may also be requested through AppTrackingTransparency (ATT). You can change or withdraw advertising preferences through the app privacy options or device settings when available. Users with an active Pro entitlement should not see the product's configured advertising placements when the entitlement is correctly recognized.

7. Analytics and diagnostics

When analytics consent is enabled, the app may use Firebase Analytics for usage, performance and operational events. The tracking code filters personal data and does not send email, brand, product name, ingredient text, allergen labels or condition labels in analytics events. It may send technical data, language, platform, app version and derived indicators needed for measurement.

We also use Firebase Crashlytics to collect technical information about errors, crashes and performance needed to diagnose and improve the app. Retention by Firebase and Google services depends on their applicable policies and configured settings.

8. Purchases and Pro subscription

Pro subscriptions are purchased through the Apple App Store or Google Play. We use RevenueCat to validate purchases, renewals, cancellations and Pro entitlement status. We may process technical account identifiers, entitlement data, subscription status and information needed to operate the service. Payment-card and payment-method details are handled by the relevant store and are not collected by FoodReveal.

9. Services and recipients

To provide the features described above, we may use Firebase Authentication, Realtime Database, Firestore, Cloud Storage, Cloud Functions, App Check, Cloud Messaging, Analytics and Crashlytics, as well as Google AdMob, Apple App Store, Google Play and RevenueCat. These providers process data according to their roles, configurations and applicable notices. Data may be transferred to or processed in countries other than the user's country, subject to applicable safeguards and provider terms.

10. Retention and deletion

An explicit deletion request from the app starts a scheduled process with a technical window of 15 days. At the end of that process, the backend deletes, where present, the user's data from Firebase Authentication, Realtime Database, Firestore and the Firebase Storage image folders associated with the account.

If you have given research consent at deletion, the backend may retain aggregated and anonymized scan data without images or direct identifiers for statistical purposes. Provider technical data and data needed for security, fraud prevention, accounting or legal obligations may be retained under the applicable rules. Expired subscription data may be archived separately for administrative management.

The code also includes a periodic process for accounts inactive for at least 365 days, excluding accounts with an active paid subscription. The effective timing may depend on job execution and the data present in the account.

11. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, withdrawal of consent and, where applicable, data portability. You may also complain to the competent supervisory authority. To exercise your rights, contact Adam Chierici through the Contact page or Luminatens@mail.com.

12. Updates

This notice may be updated when the app, services or applicable obligations change. The version published on this page shows the date of the latest update.