Privacy Policy

Gluten Free Scanner is operated by Food Barcode Scanner Ltd ("we"), a company registered in England and Wales with company number 14560869, whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Food Barcode Scanner Ltd is the controller of the personal data described in this policy and is registered with the UK Information Commissioner's Office under registration reference ZC221611.

This policy explains what we collect when you use the app and the glutenfreescanner.app website, why, and the choices you have. You can contact us about anything in this policy, including to exercise any of your rights, at support@glutenfreescanner.app or by writing to us at the address above. We aim to respond within one month.

The Short Version

You do not create an account. The app identifies your device with a random device identifier, not your name or email. When you scan a barcode we look the product up and record the scan so your Scan History works. If you add a missing product you send us photos of the packaging, which are read by AI to extract the product name and the ingredients. Product results and the explanations shown with them are generated by automated AI analysis of the product information we hold. We do not sell your data for money, and we never give your scans or anything about your health to our advertising partners. The free version of the app shows adverts, and a Premium subscription removes them. To supply them, our advertising partners receive information about your device, including its advertising identifier where it is available, as explained below. If your device's region is set to the UK, a country in the EU or the EEA, Switzerland, or one of the closely linked places listed under How the app decides where you are, the app does not start its advertising service and shows no adverts from our advertising partners; it shows our own messages about Premium instead.

What We Collect

• A device identifier. An identifier that your phone's operating system provides to apps from the same developer, so it can be the same in our other apps on the same phone. We use it to register your device, deliver your Scan History and, if you subscribe, recognise your subscription. It is also the user identifier in our app analytics and at RevenueCat, and the reference number in emails you send us from the app. It is not your name, email address or phone number, and the app never asks for those.
• Your scans. The barcode, the matched product, the result we showed you, and when. We record scans on our servers for every user, including users without a Premium subscription, so that your Scan History is there if you subscribe. Scan History is only viewable in the app with Premium.
• Product contributions. If you add a missing product or its ingredients, we receive the photos you take (barcode, product name, ingredients list) and any product name you type. Those photos are read by AI to extract the product name and the ingredients. Contributions become part of our shared product database so the next person who scans that product gets an answer. Please photograph only the packaging.
• Subscription status. When you open the app it registers your device identifier with RevenueCat, our subscription management provider, whether or not you ever subscribe, so that it can tell us whether a Premium subscription is active for your device. If you buy Premium, Apple or Google takes the payment and the purchase record is passed to RevenueCat, which checks it and tells us that your subscription is active. We use that to unlock Premium features. We never see or store your payment card details.
• Technical logs. Standard request logs for security, rate limiting and debugging: your IP address and the country derived from it, your device identifier, app version, the request method, path and result, request headers and, for some requests, the contents of the request. We do not use these logs to build a profile of you.
• If you email us. If you email us, including from the Contact Us option and the other email links in the app, we receive your email address, your name if your email shows it, and whatever you write. Emails sent from the app include a reference number, which is your device identifier, so that we can find your records and help you. We use this only to answer you and deal with your request.
• Usage analytics and diagnostics. App events (for example each scan, with the barcode, the product name and the result), screen views, crash reports and app performance measurements, collected through Google Firebase Analytics, Firebase Crashlytics and Firebase Performance Monitoring. These are linked to the same random device identifier described above, so they are pseudonymous rather than anonymous. We also use Firebase Remote Config to change app settings without shipping an update.
• Your advertising identifier, in our app analytics. Google Analytics for Firebase, which runs our app analytics, does not read your device's advertising identifier (the Advertising ID on Android or the IDFA on iOS), whether or not you subscribe to Premium and whether or not you allow tracking. We do not pass anything from our analytics to our advertising partners. Usage and crash reports are switched on when you install the app. Turning them off with the “Usage and crash reports” switch in the app’s Settings stops Google Analytics for Firebase collecting anything for our analytics from then on. This applies to version 4.1.0 of the app and later. In older copies of the app, Google Analytics for Firebase could read your advertising identifier while usage and crash reports were switched on: the Advertising ID on Android, and on iOS the IDFA, if you had allowed tracking when an earlier version of the app asked. Updating the app stops that, and in version 4.0 so does turning off the “Usage and crash reports” switch.
• Advert data sent to our advertising partners. Only in the free version of the app, which means only if you are not a Premium subscriber. The app starts its advertising service the first time you see a product result after opening the app, or earlier if you change the “Personalised adverts” switch in the app’s Settings, and it fetches an advert in advance so that one is ready when it is due. From then on our advertising partners receive your device's advertising identifier (the IDFA on iOS or the Advertising ID on Android), your IP address, coarse location derived from that IP address, device and app information, and records of the adverts you were shown and whether you interacted with them. This starts before you see your first advert, and happens even if you never see one. In the UK, the EU, the EEA and Switzerland the app never starts its advertising service and requests no adverts, as described below. On iOS the advertising identifier is only available if you allow tracking when the system asks. We do not send your scans, your Scan History, your contributions or anything about gluten or your health to any advertising partner. This describes version 4.1.0 of the app and later. Versions 3.1 and 4.0 contain none of our advertising partners’ software: they show no adverts from advertising partners, only our own messages about Premium, and send them nothing. Copies older than version 3.1 may still send advert requests to a previous advertising partner that is no longer listed in this policy.

What We Do With It

• Answer your scans: match the barcode, return the product's status and, where held, the reason.
• Maintain your Scan History and, for Premium, your offline database downloads.
• Build and maintain the product database: contributed photos and text, and the product data we hold from other sources, are analysed by AI services to read product names and ingredients and to classify whether a product contains gluten. The gluten result and the explanation shown with it are generated automatically. That classification is about the product, not about you, and it is not an automated decision about you within the meaning of Article 22 UK GDPR. Contributions are checked automatically, new products whose label the AI cannot read with confidence wait for our team to review them, and accepted contributions become part of the database serving all users.
• Protect our product database: each offline database download is marked so that, if a copy is shared in breach of our Terms and Conditions, we can tell which device it was issued to.
• Operate, secure and improve the service.

Show adverts in the free version. The free version of the app shows adverts, and a Premium subscription removes them. They are full-screen adverts, shown from time to time as you scan products, and they are supplied by our advertising partners, listed under Who We Share Data With below. At present they come through Unity LevelPlay, which runs an auction between advertising networks and shows the winning advert. To supply them our partners use your IP address and device information and, where that is allowed, your device's advertising identifier, to choose which adverts you see, to limit how often you see the same advert, and to prevent fraud. Because the app fetches an advert in advance, this happens from the moment its advertising service starts, as described above, and not only when an advert is on screen. The free version also shows our own messages about Premium, which are not targeted using your data, and Premium removes those too.

In the UK, the EU, the EEA and Switzerland there are no adverts from our advertising partners. There the app does not start its advertising service and does not request any advert. The same applies if your internet connection appears to come from one of those places. When an advert would otherwise be due, the app shows our own message about Premium instead. Because no advertising partner is involved, the app does not ask you an advert question, does not show the “Personalised adverts” switch and does not ask for Apple’s permission to track you. When the block comes from your internet connection rather than your device's region setting, the switch can still appear in Settings but has no effect, because no advertising partner is involved. App analytics are separate: they have their own switch in Settings, described under What We Collect.

How the app decides where you are. To decide whether to show adverts from our advertising partners at all, and whether to send the US opt-out signal described under For Users in the United States, the app goes by your device's region setting. Where this policy describes those things, “in the UK, the EU, the EEA and Switzerland” means a device set to one of those places, to a place closely linked to them (Gibraltar, the Isle of Man, Jersey, Guernsey, Andorra, Monaco, San Marino, Vatican City, the Faroe Islands, Greenland, Svalbard, the Åland Islands or a French overseas territory), and “a US device” means a device set to the United States. “A US connection” means an internet connection that our server places in the United States, as described next. Before it starts its advertising service, the app also asks our server which country your internet connection appears to come from. If that is the UK, the EU, the EEA, Switzerland or one of the closely linked places listed above, the app shows no adverts from our advertising partners. If the app cannot get an answer, and it has no answer from the last 24 hours, and your device or connection is set to the United States, it shows no adverts from our advertising partners until it gets one. The app does not store the answer: it keeps it only in memory while it is open. Our technical logs record the country of each request, as described under What We Collect.

What turning off personalised adverts does, and does not, change. If you turn off the “Personalised adverts” switch, you still see the same number of adverts. The app tells our advertising partners that you do not agree to your advertising identifier being used to personalise adverts, and a partner that acts on that signal chooses them from general information such as the country you are in and the fact that you are using a food scanning app, rather than from your advertising identifier. Not every partner reads that signal, as explained under Why We Are Allowed to Use Your Data. Turning it off does not limit any part of the app and does not cost you anything. If you would rather see no adverts at all, that is what a Premium subscription is for.

Changing your mind. You can turn the “Personalised adverts” switch in the app’s Settings off or back on at any time, and it takes effect immediately: any advert already fetched under the old setting is discarded and a fresh one requested under the new one. It cannot undo an advert you were already shown, and it does not reach data that our advertising partners already hold; to deal with that, use the device settings described under Your Rights and Choices and contact those companies directly using the links in this policy.

We do not sell your personal data for money, and we never send your scans, your Scan History, your product contributions or anything else about gluten or your health to an advertising partner. Adverts are never targeted using anything you have scanned.

A Note on Health

The app answers questions about products, not about you. We do not ask you for any health information, we never ask whether you have coeliac disease or any other condition, we do not build a health profile of you, and we do not use your scans to infer a diagnosis.

We recognise that a record of gluten-related scans may say something about your diet or your health. Because of that we deliberately hold scan data against a random device identifier rather than your name or email, we never use it for advertising or profiling, and we never share it with any advertising partner. Our app analytics also records each scan, including the barcode, the product name and the result, and Google Analytics for Firebase receives that, linked to the random device identifier rather than your advertising identifier, as described under What We Collect. Delete my data in the app’s Settings deletes the scan data held in our current systems and, in version 4.1.0 of the app and later, the Scan History stored on your device (see Your Rights and Choices for older copies). It does not delete analytics already sent to Google, including the copy in our analytics warehouse, which is kept as described under How Long We Keep Things, and you can stop further analytics at any time with the “Usage and crash reports” switch in the app’s Settings.

Gluten Free Scanner is an information tool. It is not a medical device and is not intended to diagnose, prevent, monitor, predict, treat or cure any disease or condition, including coeliac disease, gluten sensitivity or any allergy. Its results are informational only and are not medical advice - always check the packaging and speak to your doctor or dietitian about managing coeliac disease.

Who We Share Data With

Service providers. We use a small set of service providers under contract, who process data for us:

• Cloudflare - serves the app's API at the network edge and stores the product database and product photos. Product photos are held in EU storage. Some transient queue processing is not pinned to a single region.
• DigitalOcean - our primary databases, hosted in the United Kingdom (London).
• OpenAI - reads contributed product photos and text on our instructions, to extract the product name and ingredients, classify the product, and translate result explanations. We use OpenAI's business API under OpenAI's business terms, and under those terms the content we send is not used to train OpenAI's models. What we send is product packaging and product text, not information about you.
• RevenueCat - subscription management: it receives your device identifier and, if you subscribe, your purchase records from Apple or Google, and records whether your subscription is active. It does not take payment.
• Google Firebase / BigQuery - app analytics, crash reporting, performance monitoring and remote configuration, and our analytics warehouse.
• Better Stack and Sentry - operational monitoring and error logs. Better Stack stores our logs in Germany.
• Google - our email service, which holds the emails you send us.

Apple and Google. If you buy Premium, Apple or Google handles the purchase and takes your payment through the App Store or Google Play, in some countries as our agent, as explained in our Terms and Conditions. They handle your payment details and their own records of the purchase under their own terms and privacy policies, and the purchase record is passed to RevenueCat so that we can recognise your subscription.

Older copies of the app. Copies of the app that have not been updated still connect to the previous version of our system, which runs on DigitalOcean servers in London and holds the same kinds of data described in this policy. It stores product photos in DigitalOcean storage in London and, as well as the providers above, may use Google Cloud Vision to read the text in contributed photos and Sightengine to check whether contributed photos are clear enough to use. We are retiring that system, and updating the app moves you to the current one.

Independent advertising partners. In the free version of the app, outside the UK, the EU, the EEA and Switzerland, adverts are supplied by advertising partners. Unlike the service providers above, our advertising partners, including every network that bids for an advert in the app, act as independent controllers of the advertising data they receive, which means they decide how they use it and answer for it under their own privacy policies. Pangle is also a joint controller with us for one step, as explained below. The partners the app is built to work with are:

• Unity (Unity LevelPlay, Unity Ads and ironSource) - runs the auction between advertising networks that decides which advert you see, and supplies adverts itself through its Unity Ads and ironSource networks. Its privacy policy is at unity.com/legal/privacy-policy.
• Meta Audience Network (Meta Platforms) - bids in that auction and supplies adverts when it wins. Meta's privacy policy is at facebook.com/privacy/policy. On a US device or a US connection we tell Meta to apply its Limited Data Use setting, which restricts how it uses data from that request.
• Pangle (ByteDance) - bids in that auction and supplies adverts when it wins. The app uses Pangle’s software, which enables the collection of personal data and its transmission to Pangle for advertising. Under Pangle’s terms, “TikTok Pangle is a Joint Controller of the Joint Processing”: that is, Pangle and we are joint controllers of that collection and transmission, and after that Pangle is an independent controller of the data it receives. Those terms set out our respective responsibilities: we are responsible for telling you about that collection, which we do in this policy, and Pangle is responsible for your rights over the data it holds after that step. You can also exercise your rights about it with us. Further information on how Pangle processes personal data, including the legal basis it relies on, and the ways to exercise your rights against Pangle, can be found in Pangle’s privacy policy at pangleglobal.com/privacy/enduser-en.

None of our advertising partners is given your scans, your Scan History, your contributions, or anything about gluten or your health. We keep this list current. Our advertising partners can change over time, and a copy of the app that has not been updated may still send advert requests to a partner that is no longer listed here.

Other disclosures. We may disclose data where the law requires it, for example to comply with a court order or a lawful request from a regulator or law enforcement, or where it is necessary to establish, exercise or defend a legal claim. If our business, or the part of it that runs the app, is sold or transferred, your data may be passed to the new owner so that the app can carry on. They would have to use it in line with this policy, and we will tell you in the app or on this page if that happens.

Where Your Data Is Processed

Our primary databases are hosted in the United Kingdom. Product photos sent from the current app are held in EU storage, and product photos sent from older copies of the app are also held in DigitalOcean storage in London. Some of our providers process data outside the UK and the EEA, mainly in the United States: this applies to Cloudflare's edge and queue processing, OpenAI, Google, RevenueCat, Sentry and, in the free version of the app outside the UK, the EU, the EEA and Switzerland, our advertising partners, including Unity, Meta and the other networks that bid for adverts. Pangle is operated by ByteDance and may process advertising data in Singapore and the United States. Better Stack stores our operational logs in Germany.

Where that happens we rely on appropriate safeguards: for providers certified under them, the UK-US data bridge and, for people in the EU, the EU-US Data Privacy Framework and, for people in Switzerland, the Swiss-US Data Privacy Framework; otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses. In each case we also rely on the providers' own UK and EU data processing terms, together with technical and organisational measures including encryption in transit and data minimisation. You can ask us for a copy of the safeguards that apply to a particular provider by emailing support@glutenfreescanner.app.

How We Protect Your Data

Traffic between the app and our servers is encrypted in transit, and our hosting providers encrypt stored data at rest. Access to our production systems is limited to the small number of people who need it and is protected by strong authentication. No system is perfectly secure, but if a breach happens that is likely to result in a risk to your rights we will report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it, and tell affected users where the law requires.

How Long We Keep Things

• Device identifier and scan history: kept until you delete your data in the app or ask us to delete it. This includes scan history recorded by earlier versions of the app, which we copy into our current systems so that it appears in your Scan History. We have not yet set an automatic deletion period for devices that stop using the app; when we do, we will state it here. Older copies held in the previous version of our system are deleted when that system is retired.
• Subscription records: those in our own database are kept on the same basis as your device identifier above, including after a subscription ends, and are removed when you delete your data in the app. The purchase and billing records held by our subscription management provider RevenueCat and by Apple or Google are kept by them for accounting, tax and fraud prevention, under their own retention policies. Separately, RevenueCat creates a customer record for your device, keyed to your device identifier, when the app registers it, whether or not you ever subscribe. That record holds your device identifier, when the app first and last contacted RevenueCat, the country worked out from your IP address (RevenueCat does not keep the IP address itself), details of the app and device such as the app version and platform, and, if you subscribe, your purchase history. We do not delete that record automatically and Delete my data does not delete it; you can ask us to, as described under Your Rights and Choices.
• Technical request logs: kept for as long as we need them for security, rate limiting and debugging, and deleted when they are no longer needed. Request logs held by our monitoring providers are deleted automatically after no more than 90 days.
• Analytics, performance and crash reports: retained on the standard Google Firebase and Google Analytics retention schedule. A copy of the analytics events is also exported to our own analytics warehouse in Google BigQuery, stored in London, where each event is kept as an individual record linked to your device identifier and used for our reporting. We have not yet set a fixed deletion period for the copy in our analytics warehouse; when we do, we will state it here.
• Advertising data: the advertising identifier and the advert records that our advertising partners receive are held by them, on their own retention schedules, and you can control that identifier at any time in your device settings as described below. Our own app analytics also record when an advert was shown, tapped or closed, the revenue it earned and when you turned the “Personalised adverts” switch on or off, linked to the same random device identifier as our other analytics, and are kept on the same schedule.
• Product contributions: retained as part of the shared product database, because they describe a product rather than a person.
• Emails you send us: kept for as long as we need them to deal with your request and any follow-up.
• Deletion requests: we keep a record of the request itself (your device identifier, the date and the IP address the request came from) and a minimal suppression record, whose only purpose is to make sure deleted data is not re-imported by later data processing, for as long as the service operates. We have to be able to show that we acted on your request, and re-import would defeat the erasure. Neither record is used for any other purpose and neither is used to build a profile.

Why We Are Allowed to Use Your Data

We use your data for the following purposes, on the following legal bases:

• Registering your device, answering your scans and returning a product result: performance of our contract with you, namely the Terms and Conditions you accept when you use the app.
• Maintaining your Scan History and, for Premium, your offline database downloads: performance of our contract with you.
• Recognising and managing your Premium subscription: performance of our contract with you.
• Recording scans for users who do not have Premium: our legitimate interests in having your history ready if you subscribe.
• Reviewing, analysing and publishing product contributions in the shared database: our legitimate interests in building and maintaining an accurate gluten database, and the interests of other users in getting an accurate answer about a product.
• Security, rate limiting, fraud prevention and debugging: our legitimate interests in keeping the service available, safe and free from abuse.
• Marking offline downloads so that copies shared in breach of our terms can be traced: our legitimate interests in protecting our product database.
• Answering emails you send us: our legitimate interests in helping you and dealing with your request or, where you are exercising a right described under Your Rights and Choices, compliance with a legal obligation.
• Analytics, performance monitoring and crash reporting: our legitimate interests in understanding crashes and feature use. These are switched on when you install the app, and you can turn them off yourself at any time with the “Usage and crash reports” switch in the app’s Settings, or ask us to stop by emailing us. What our analytics collects is described under What We Collect.
• Letting our advertising partners use your advertising identifier to choose which adverts you see, to limit how often you see the same advert and to prevent fraud: our legitimate interests in funding a service that is otherwise free to use and in keeping its advertising free from fraud. This happens only outside the UK, the EU, the EEA and Switzerland, because the app shows no adverts from our advertising partners in those places.
• Showing adverts that are not chosen using your advertising identifier: our legitimate interests in funding a service that is otherwise free to use. Refusing personalisation, or withdrawing it later, does not stop you using any part of the app.
• Outside the UK, the EU, the EEA and Switzerland: the free version of the app has a “Personalised adverts” switch in its Settings, which starts switched on. On a US device or a US connection the app also sends the opt-out signal described under For Users in the United States, whichever way the switch is set. Turning it off sends our advertising partners a signal, with every advert the app fetches from then on, that you do not agree to your advertising identifier being used to personalise adverts, and on iOS it also means the app will not ask for permission to track you. Each partner decides how to act on that signal under its own policy, and not every partner reads it, so we cannot guarantee what every partner does. To stop apps on your device using your advertising identifier at all, use the device settings described under Your Rights and Choices.
• Complying with our legal obligations, for example tax and accounting records for subscriptions: compliance with a legal obligation.

Where we rely on legitimate interests, the interests we rely on are the ones stated above for each purpose. You can ask us for more information about them, and you can object, as explained below.

You do not have to give us any of this data, but the app cannot look up a product without receiving the barcode, and Scan History and Offline Mode cannot work without a device identifier.

Your right to object. You have the right to object at any time, on grounds relating to your particular situation, to our use of your data where we rely on legitimate interests. Email support@glutenfreescanner.app and we will stop unless we have compelling legitimate grounds that override your interests.

Withdrawing consent. Where we rely on your consent you can withdraw it at any time, and withdrawing it does not affect anything we did before you withdrew it.

Automated decisions. We use AI to read product labels and to classify products. Those decisions are about products, not about you, they do not produce legal effects for you or similarly significantly affect you, and we do not make automated decisions about you within the meaning of Article 22 UK GDPR.

Your Rights and Choices

Under UK and EU data protection law you can ask for access, correction, deletion, restriction, or portability of your data, and object to processing. Email support@glutenfreescanner.app and we will respond within one month.

Delete my data: use the option in the app's settings. Your data is marked for deletion straight away and permanently erased from our current systems after a 30 day recovery window, during which you can contact us to cancel the request. Erasure removes your device identity, your scan history, your offline download records and the subscription records held in our own database, and it removes the link between your device and your product contributions, which stay in the shared database. In version 4.1.0 of the app and later, once we have accepted the request, the app also clears the Scan History stored on your device and any scans from Offline Mode that are still waiting to be sent to us, so they are not sent afterwards. If you used an older version of the app, older copies of some of this data are also held in the previous version of our system, which copies of the app that have not been updated still use. The option in the app does not reach those copies. They will be deleted when that system is retired, and if you want them deleted sooner, email support@glutenfreescanner.app and we will delete them.

Some things are kept by design. Delete my data does not delete the record that RevenueCat, our subscription management provider, holds for your device, which exists whether or not you ever subscribed and is described under How Long We Keep Things; you can ask for it to be deleted by emailing support@glutenfreescanner.app. Emails you have sent us are not removed by this request either, and are kept as described under How Long We Keep Things. The purchase and billing records held by RevenueCat and by Apple or Google are retained for accounting, tax and fraud prevention, and are also what lets you restore a subscription on a new device. Usage analytics held in Google Firebase, and the copy in our analytics warehouse, are retained as described under How Long We Keep Things and are not removed by this request. We keep a record of your deletion request and a minimal suppression record whose only purpose is to make sure deleted data is not re-imported by any later data processing; without it, a re-import would defeat the erasure. Deleting your data does not cancel an App Store or Google Play subscription.

Adverts: a Premium subscription removes them completely. In the UK, the EU, the EEA and Switzerland the app shows no adverts from our advertising partners, as explained above. Elsewhere, you can also limit what advertisers learn about you without subscribing: turning off the “Personalised adverts” switch in the app’s Settings tells our advertising partners that you do not agree to personalised adverts (what that does, and does not, do is explained above). Your device settings control the advertising identifier itself, for every app. On iOS, Settings, then Privacy & Security, then Tracking lets you refuse tracking for this app. The app asks for that permission when you open it, and only when it could show you adverts from our advertising partners and the “Personalised adverts” switch is on, so never in the UK, the EU, the EEA and Switzerland. If you turn the switch back on later, the app does not ask straight away; it asks the next time you open it. iOS lets an app ask only once. On Android, the Ads page in your device settings (often Settings, then Google, then Ads, although the path varies by device) lets you reset your advertising ID and, on recent versions of Android, delete it, after which apps, including this one, can no longer read it.

Your contributions: contributed photos and product text describe a product, not a person, and are retained as part of the shared database that other users rely on for a food safety decision. Where a contribution does contain personal data, for example a face, a hand, a name or anything else that identifies someone, tell us and we will remove or redact it, and we also do this on our own initiative when we spot it during review.

If you are unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, to your local supervisory authority, or, if you are in Switzerland, to the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

For Users in the United States

We do not sell your personal information for money. The free version of the app shows adverts, and a Premium subscription removes them. US state privacy laws treat passing an advertising identifier to an advertising partner as “sharing” for cross-context behavioural advertising. Because of that we send an opt-out signal with every advert request from a US device or a US connection by default, which instructs our advertising partners not to sell or share your information and not to use it for cross-context behavioural advertising. You do not have to do anything to switch that on. Each of our advertising partners applies that signal under its own policy. We do not ourselves use your information to infer characteristics about you. We never give your scans, your Scan History, your contributions or anything about gluten or your health to an advertising partner. Google receives scan events as the provider of our app analytics, as described under What We Collect. If the law of your state gives you rights to know what we collect, to obtain a copy of your data, or to correct, delete or appeal, you can exercise them using the contact details in this policy, and we will not treat you differently for doing so.

Children

The app is a general-audience shopping tool and is not directed at children under 13. Where the law of the country in which you live sets a higher age for children to use online services without a parent's permission, which is 16 in several EU countries including Ireland, Germany and the Netherlands and 15 in France, we do not knowingly collect data from children below that age without a parent's permission. There are no accounts in the app, so we cannot verify age, and an app store age rating does not stop younger children downloading the app. Our Terms and Conditions require users to be at least 13, and we rely on users, and on parents and guardians, including through the parental controls that Apple and Google offer, to make sure of that.

We know that children and teenagers live with coeliac disease and may use the app, so we design it to be low risk for them: there are no accounts or profiles, no profiling by us, and no messaging between users.

The free version of the app shows adverts, and a Premium subscription removes them. Because the app is a general-audience app, we tell our advertising partners so, which means the restrictions they apply to apps made for children do not apply to it. Outside the UK, the EU, the EEA, Switzerland and the United States its adverts may be chosen using the device's advertising identifier by default. On a US device or a US connection the app tells our advertising partners by default not to use it for cross-context behavioural advertising (see For Users in the United States). In the UK, the EU, the EEA and Switzerland the app shows no adverts from our advertising partners. The individual advertisements are supplied by third parties and we do not choose them.

If you believe a child has provided us with personal information, contact us at support@glutenfreescanner.app and we will delete it.

This Website

This policy also covers the glutenfreescanner.app website. We set no cookies of our own on it, except one: when a translation is requested, as described under Translation below, we set a cookie called googtrans that tells Google's translation service which language to show. It is deleted when you close your browser. Nothing beyond what is needed to show you a page is loaded unless you ask for it or agree to it first, and the only third-party things the site can load at all are Google Analytics and Google Translate, both described below.

Analytics. We would like to use Google Analytics to count visits and see which pages are useful. On your first visit a banner asks whether you agree, with an Accept option and a Reject option that are equally easy to use. Until you press Accept, Google Analytics is not requested at all: no script is fetched from Google, no analytics cookie is set, and no request carrying your IP address is made. We also set Google's Consent Mode v2 signals to denied by default, so that analytics, advertising and personalisation storage start switched off. If you press Reject, or close the banner without choosing, nothing loads. If you press Accept, Google Analytics loads and sets its own cookies to recognise your browser on later visits. We do not use it to build a profile of you and we do not use it for advertising.

Your choice, and changing it. Your answer is stored in your browser's local storage on your own device, not in a cookie, and it is not sent to us. You can change it at any time using the Cookie settings link in the footer of this site, which brings the banner back. If you switch from Accept to Reject we turn analytics storage off and delete the Google Analytics cookies already on your device. You can also block anything you like using your browser's cookie and script settings or a tracking blocker.

Fonts. The typeface used on this site is served from our own website, so simply opening a page does not make a request to Google or to any other font service.

Translation. Our legal pages offer a Google Translate option. Google's translation service is only loaded when you press Translate this page, or when you open the page from a link that already asks for a particular language, which is how the app opens these pages in the language you use it in (if the app is in English, nothing is loaded until you press the button). Doing either sends your request to Google, sets the googtrans cookie described above, and lets Google set its own cookies. If you do not ask for a translation, nothing is loaded from Google's translation service.

App store buttons. The App Store and Google Play buttons on this site go through our own link service at go.glutenfreescanner.app before sending you to the store. It records the time, which button you pressed, the type of device, the store it sent you to, your country and, where your browser sends it, the website you came from. What it records does not include your IP address, and it sets no cookie. Cloudflare, which runs the link service for us, keeps a technical log of each request for up to 7 days, for security and debugging. That log includes your IP address, your browser details and your approximate location, and Cloudflare may process it in the United States.

Server logs. Our website is hosted by GitHub, which keeps standard server logs, including IP addresses, to deliver the pages and protect the site from abuse, and may process them in the United States.

You can ask us anything about this at support@glutenfreescanner.app. The mobile app does not use cookies of its own. It does store settings and identifiers on your device, and the analytics and advertising services built into it store and read information on your device too, as described above.

Product Data Sources

Product information comes from our own community of contributors and from Open Food Facts. Open Food Facts data is copyright Open Food Facts contributors and is used under the Open Database License (ODbL) v1.0, available at opendatacommons.org/licenses/odbl/1-0/.

Language

This policy is written in English. Translations are produced automatically by a third-party translation service when you ask for one, and are provided for convenience only. If anything is unclear in your language, email support@glutenfreescanner.app and we will explain it.

Changes

We will update this policy when the service changes and revise the date above. Material changes will be highlighted in the app or on this page.

What changed on 14th October 2026. We updated this policy for version 4.1.0 of the app. It now explains that in the UK, the EU, the EEA, Switzerland and the closely linked places listed under How the app decides where you are, the app shows no adverts from our advertising partners and shows our own messages about Premium instead; that the app also checks which country your internet connection appears to come from; that our app analytics do not read your device’s advertising identifier; when the app asks for Apple’s permission to track you; that Pangle is a joint controller with us for one step; that Delete my data also clears the Scan History stored on your device; and how copies of the app older than version 4.1.0 differ.

What changed on 5th October 2026. We added a complaints route and a transfer safeguard for people in Switzerland, and made clear that opening a legal page from the app in English does not load Google's translation service.

What changed on 26th September 2026. The App Store and Google Play buttons on this website now go through our link service on computers too, not only on phones and tablets.

What changed on 23rd September 2026. We updated this policy to cover adverts. The free version of the app shows adverts, and a Premium subscription removes them. We also made this policy more precise: the app decides which advert rules apply from your device's region settings, while which advertising networks may bid is decided by our advertising mediation provider; RevenueCat keeps a record for your device whether or not you subscribe, and Delete my data does not delete it; Apple and Google handle payment details under their own privacy policies; we explain what we receive when you email us, that offline downloads are marked, and when we may disclose data to others; Delete my data does not reach older copies of your data held in the previous version of our system, which we will delete on request; we corrected why we record scans, how long we keep scan history and technical logs, what our analytics warehouse holds and where Better Stack stores our logs; and we describe the one cookie this website sets for translations, the link service behind our app store buttons and who hosts this website. This policy describes the latest version of the app, and a copy of the app that has not been updated can work differently.

Contact Us

If you have any questions or requests about this Privacy Policy or your data, contact us at support@glutenfreescanner.app.

Food Barcode Scanner Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. Registered in England and Wales, company number 14560869. ICO registration reference ZC221611.