Privacy Policy

Effective October 5, 2026

This policy explains what LabelFacts collects, who it is shared with, how long it is kept, and the choices you have. LabelFacts is provided by DealFlip Inc., which is the controller of your personal data. We do not sell your personal information for money.

What We Collect

Account: your email address, display name, and a profile photo if you upload one. If you use Sign in with Apple, we also store a token Apple issues so we can revoke the connection when you delete your account.

Scans: the barcodes, product names and scores of products you scan, with timestamps, stored in your account so your history syncs across devices. Our servers also keep a record of which products you looked up through them (used for the "Verified scan" badge on reviews).

Photos: photos you take in the app are stored on your device, in the app's documents folder, which iOS may include in your iCloud or device backups depending on your settings. When you use Photo Scan, the image is sent to our servers and to Anthropic to identify the product or read its ingredient list; we do not store the image on our servers. What was read from it (product name, ingredient list, nutrition values and an ingredient analysis) is stored with your account so you do not have to photograph it again.

Your activity in the app: food diary entries, favorites, scan streaks, the categories and health priorities you choose (these two are stored only on your device and are not sent to our servers), product reviews and star ratings (published with your display name), "helpful" votes, reviews you report, reviewers you block, and "Report incorrect data" submissions.

Subscription: your Pro status and purchase history, from Apple via RevenueCat. We never receive your card details.

Usage and diagnostics: app events (such as app opens, scans, paywall views and features used) and crash and error reports, linked to your account ID. Some events include the barcode of a product: when you share a score, compare two products, tap a suggested alternative, report incorrect data, submit, vote on or report a review, or block a reviewer.

Notifications are scheduled on your device; we do not collect a push token.

How We Use It

To run the service (look up and score products, read photos, sync your history, diary and favorites, moderate reviews, and unlock Pro); to keep it secure and working (rate limits, abuse prevention, debugging crashes); to understand which features are used and improve them; to communicate with you about your account; and, only if you allow tracking, to measure our own advertising through Meta (see below). We do not show ads in the app.

Who We Share It With

We use these service providers, each receiving only what its job needs:

• Google Firebase / Google Cloud — sign-in, database, file storage (profile photos), server functions and website hosting. Holds the account data described above.

• Anthropic (Claude) — receives Photo Scan images; the ingredient list and product name of products we analyze when you look them up; and the text of your review, your display name and the product name, for moderation.

• Perplexity — when no product database has an ingredient list, receives the product name and brand to search the web for one. It does not receive your account identity.

• Open Food Facts, NIH DSLD, USDA FoodData Central, FatSecret, Go-UPC and UPC ItemDB — product databases we query with a barcode or product name only, never your account identity.

• PostHog — product analytics, linked to your account ID, including the barcode-carrying events described above.

• Sentry — crash and error reporting, linked to your account ID, with device details and a short trail of recent app events (which can include barcodes).

• RevenueCat and Apple — subscription purchases, receipt validation and Pro status, linked to your account ID. On iOS, RevenueCat also collects Apple's AdServices attribution token, which tells us whether your install or subscription came from an Apple Search Ads campaign; the token contains no device identifier and does not require tracking permission. If you allow tracking (the same prompt as Meta below), RevenueCat additionally records your device's advertising identifier, vendor identifier and IP address with your subscription record so that subscription events can be matched to our Meta ads; if you decline or never answer, it does not.

• Meta (Facebook) — only if you tap Allow on the iOS App Tracking Transparency prompt. The Meta SDK is then switched on and sends Meta app events (installs, app opens and other automatically logged app events; account registration; that a scan was completed and whether by barcode or photo, never which product; and trial, subscription and purchase events with the plan and price) together with your device's advertising identifier. If you decline or never answer, the Meta SDK is never switched on and nothing is sent to Meta.

Meta Business Tools: when the Meta SDK is on, Meta may use the information it receives to provide measurement services and to target and personalize ads, including ads for other businesses, under Meta's own terms and Privacy Policy (facebook.com/privacy/policy). You can opt out at any time by turning off tracking for LabelFacts in iOS Settings, under Privacy & Security, Tracking; you can also manage how Meta uses activity from other apps in your Meta ad settings (facebook.com/adpreferences).

We may also disclose data if required by law, or to a successor as part of a merger or sale of the business, subject to this policy.

Selling and Sharing (California)

We do not sell personal information for money, and we never share the list of products you scan for advertising. However, if you allow tracking, the app events and advertising identifier sent to Meta (described above) may count as "sharing" for cross-context behavioral advertising, and possibly as a "sale", under California law. You can opt out at any time by turning off tracking for LabelFacts in iOS Settings; the Meta SDK then stays off. For users aged 13 to 15, this happens only if you opt in through the tracking prompt. We do not use sensitive personal information to infer characteristics about you. California residents may also request to know, correct or delete their personal information by emailing us, and we will not discriminate against you for using these rights.

Legal Bases and International Transfers

If you are in the EU, UK or a similar jurisdiction: we process account, scan, photo, diary and review data to provide the service you asked for (contract); analytics, crash reporting, security and review moderation on the basis of our legitimate interests in running a reliable, safe app; Meta ad measurement only with your consent (the tracking prompt), which you can withdraw in iOS Settings; and data we must keep to comply with the law (legal obligation). Our service providers are mostly in the United States, so your data is transferred there; where required we rely on the transfer safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

Your Rights

You can delete your account and data at any time from the Profile tab. Depending on where you live, you may also have the right to access, correct, export or restrict the use of your data, to object to processing based on legitimate interests, and to withdraw consent. To use these rights, email support@labelfacts.app. In the EU or UK you can also complain to your data protection authority.

Retention and Deletion

We keep your account data until you delete your account. Deleting your account from the Profile tab permanently removes from our systems: your account and profile, profile photo, scan history and scan records, food diary, favorites, streaks, blocklist, your reviews and the votes on them, your votes on other reviews, reviews you reported, your "Report incorrect data" submissions, moderation records about your reviews, and Photo Scan results stored with your account. It also deletes the scan photos the app stored on that device, and revokes Sign in with Apple access. Your health priorities and category choices are never on our systems: they stay in the app's storage on your device until you change them in the Profile tab or delete the app. Product information that is not about you (shared product records) is kept. Copies held by our service providers (analytics events in PostHog, crash reports in Sentry, purchase records at RevenueCat and Apple, and anything Meta received) are not removed by this button; they are deleted according to each provider's own retention periods, and you can email us to ask us to request deletion from them. Photos may also remain in your device or iCloud backups until those backups are replaced. Server logs are kept for a limited period for security and debugging.

Children

LabelFacts is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, please contact us and we will delete it.

Security

We use encryption in transit (HTTPS) and the encryption at rest provided by Google Cloud. No system is perfectly secure, so please use a strong password and enable device-level protections like Face ID.

Changes to This Policy

If we change how we handle your data, we will update this page and notify you in-app or by email when the change is material. Continued use after the effective date means you accept the new policy.

Privacy questions or requests? Email support@labelfacts.app. Controller: DealFlip Inc.