Privacy policy

These are kept in your browser's storage on your device, not in an account, and we don't receive them:

• Your household diary: the people and pets you keep it for (the names you type, life stage, birth year or month, allergens, sensitivities, pet species and food trials), what each had or had put on their skin, their reactions and check-ins, and your notes.
• Your own allergen and sensitivity lists, and your pet's life stage.
• Your ingredient bookmarks.
• Your last few product searches, so one can be repeated with a tap.
• Diary backups and CSV exports. Your browser creates them and saves them as a download, and restores a backup without uploading anything.

When you add to the diary, these leave the device, and nothing about who had it or how they were: the barcode, to look the product up, with a note that the lookup is for the diary; photos you take to add a product (one we can't answer for, one with no barcode, or one you say isn't the product we showed), sent once to be read, with whether it's food, pet food or a cosmetic; and your yes or no when you confirm a product. If you're signed in, a product you confirm or are the first to read is kept with your account, never who had it or how they were.

Also kept in your browser: the last 50 scans made here, your comparison bench and dry-matter shelf, prices you paid, your current Laboratory combination, the last scan result (until you close the tab) and display choices. Some of these features send information to our server when you use them; the next two sections say what.

Camera: the app asks for camera access only when you scan or photograph a label. Barcodes are decoded on your device and live video isn't uploaded; a photo you take is sent to be read. You can refuse camera access and choose a saved photo, or search for a product by name, instead. To keep the diary from being cleared, the app asks your browser to keep the site's storage, which some browsers show as a question. The app doesn't use your location, microphone or contacts.

Because this information isn't in an account, we can't see, recover or delete it for you, and signing out or deleting your account leaves it on the device. Your choices and rights says how to remove it.

With or without an account, these features send information to our server:

• Barcode lookups: the barcode digits, how they were read and why (a scan, a product page, a search, the diary or the comparison bench). For each product we keep a running count of lookups and the time of the last one, and daily totals by kind of lookup. A barcode we can't answer is kept as a "not found" record with its count. None of this records who asked.
• Label photos: made smaller on your device and sent through our server to Google Cloud Vision, which returns the text. If that fails, the label is read on your device. Photos you take to add a product from the diary, to name a product from its front, or of a pet food's analysis panel we couldn't read otherwise go through our server to Claude. We don't store photos. The whole photo is read, so photograph only the label: anything else in the frame, such as a face or a pharmacy sticker with a name on it, is sent too.
• Label text: when a barcode result appears, the label text goes to our server to look for a saved report. When a new score is written from it (you ask for a score and none is saved, or you're signed in and your photo replaces the list we held), the label text and the ingredients we recognised go to Claude. We don't add the brand, the product name or anything about you, but text read from a photo includes whatever was printed in the frame.
• Recognition notes: each label we read also sends our server a note of which ingredients we did and didn't recognise, with no photo and no account or identity attached. Words we didn't recognise are kept as they were read.
• Shared product information: when we don't hold a product's ingredients, the text read from your label photo, or a name you type, is saved automatically under its barcode, and a name, brand, pack size, nutrition panel or guaranteed analysis read from your photos (or confirmed by you) is added where the product is missing it. All of this is shown to everyone who looks the product up, including on its public page, which search engines can index. If you're signed in, your reading can also replace a list that another shopper or an open database supplied. A reading that would replace our own checked list, or one sent while signed out, doesn't change the catalog. From the scan screen it may be kept as a proposed correction: it goes to Claude with the current list for a first check and, if it looks like a real change, waits for our review.
• Product confirmations: your yes or no when you check that a product is the one you're holding.
• Score complaints: the product, the kind of problem and any comment you write when you tap "This score doesn't look right". The complaint isn't linked to your account. Please leave out personal details, including anything about your health or anyone else's.
• Content reports: when you tap "Report something on this page", the product, whether you're reporting its details or the name shown as who first read it, the reason and any comment. The report isn't linked to your account, and we don't keep a copy of the name you report. Please leave out personal details here too.
• Search: what you type in product search, to find matches. Our database doesn't keep it.
• Comparisons: the products on your comparison bench, to show their saved scores. Written comparisons are switched off at present; if they are switched on, asking for one sends both products' names, brands and reports, and the differences we counted, to Claude.
• Technical information: our hosting provider, Vercel, receives your IP address, browser type and the web address of each page or request, which can include a barcode or a search. Our own tables keep no IP address. To limit costly requests, and to count some things once a day (such as each pair of products compared), we keep short-lived keyed one-way hashes made from your IP address or, for plan limits, from your account ID.
• Email: if you write to support@ingredient.help, we receive your email address and what you write.

If you're signed in, your sign-in cookie goes with these requests. Our server reads it to decide whether your reading may replace a product's existing list, record you as the first to read a product, keep your confirmation with your account and credit any Ingredient Plus days it earns, run your account pages and, if they are switched on, apply plan limits.

You don't need an account to scan. If you create one, it runs on Supabase, and we keep:

• Your sign-in: your email address and password (stored in hashed form), or, with Continue with Google, the email address, name, profile picture and account ID Google shares. We use these to sign you in, and until you set a display name, your Profile page shows your Google name to you. We don't show it to anyone else, the app doesn't use your Google picture, and we don't share either. Also when you joined and last signed in.
• Sign-in records: Supabase's sign-in service records the IP address and browser type of your signed-in sessions and sign-ins, for security.
• Your scans: for each scan while you're signed in, the barcode, the product name, the label text read, a short summary and the time. No photos.
• Ingredient pages you open while signed in, and Laboratory combinations you save.
• Prices you save for products with a barcode. A price saved on this device before you signed in is added the next time you open that product while signed in.
• Products you were the first to read, and your product confirmations, with their dates.
• Ingredient Plus days you earn by adding and confirming products, and your founding-contributor place, if you hold one.
• Your display name, if you set one, and whether it appears on product pages.
• Your plan and until when it runs. If full-report limits are switched on, which products your account opened in full.
• Which version of the Terms and conditions you agreed to, and when.

We use these to give you your history on any device, show which products you scanned have changed recipe since, credit your contributions and apply your plan. When you sign up, we send an email to confirm your address. We don't send newsletters or marketing email.

Other people see your account only through your display name, and only if you set one. By default, a product you were the first to read says "a community member". If you set a name and keep it visible, the product's public page shows it with the month you read it, and search engines can index that page. You can change or hide it in Contributor identity at any time.

• To read labels, look products up and write the reports and comparisons you ask for.
• To build the shared product catalog from labels people read, and review proposed changes to it.
• To run your account and its features.
• To find ingredients we fail to recognise, review complaints about scores, and review reports about what's on a product's page.
• To limit misuse and control the cost of reading labels.
• To count, as daily totals, how much features are used.
• To answer your emails and privacy requests, and to comply with the law.
• To keep the service working and secure.

We don't use your information for advertising, and we don't build marketing profiles or draw inferences about you.

These service providers run parts of Ingredient.help:

• Supabase: our database and sign-in service. It holds account data, the shared product catalog and the records described above. When you're signed in, your browser talks to Supabase directly, so it receives your IP address and browser type.
• Vercel, our hosting provider: serves the site and runs our server, so it receives every request, including your IP address and the web address requested.
• Google Cloud Vision: receives label photos to read their text. We send it no account details.
• Anthropic (Claude): receives the photos and label text described under What we collect, to read labels and write reports. We send it no account details.
• Google sign-in, only if you choose Continue with Google: Google learns that you signed in to Ingredient.help and shares your email address, name, picture and account ID with Supabase.
• Open Food Facts: when our catalog doesn't know a barcode, our server asks the Open Food Facts databases (food, beauty and pet food), sending the barcode only. Product photos that come from Open Food Facts are loaded by your browser straight from its image servers. They receive your IP address, your browser type, the image's address, which identifies the product, and that the request came from Ingredient.help.
• Google Workspace, our email provider, for messages you send to support@ingredient.help.

Other users see only what is public: product information read from labels, confirmation counts, how many times a product was looked for, the month it was first read, and your display name if you show it.

We may also disclose information when the law requires it, to protect someone's safety or our rights, or to a company that takes over the service, which would then be bound by this policy.

We don't sell personal information, and we don't share it for targeted (cross-context behavioral) advertising. We don't disclose personal information to other companies for their own direct marketing.

• On your device: until you delete it or clear the site's data. The diary keeps up to 2,500 entries and 1,500 reactions per person or pet, dropping the oldest first. Your browser may also remove stored data, for example when storage runs low or, in Safari, after about a week without a visit, so keep a diary backup.
• Account data: until you delete it, where the app lets you, or delete the account. Inactive accounts aren't deleted automatically.
• Sign-in sessions and records: a session lasts until you sign out or it expires. Supabase keeps sign-in records for the period its service sets.
• Photos: not stored. They are held only while they are read.
• Shared product information (including "not found" barcode records), proposed corrections, saved reports and written comparisons, and recognition notes: kept while the catalog uses them, with no set end date.
• Score complaints: kept while we use them to review scores and the rules behind them, with no set end date.
• Content reports: kept while we review and act on them, and as a record of what we did, with no set end date.
• Products you were the first to read, and your confirmations: kept with the catalog. If you delete your account, they stay in the shared catalog, no longer linked to you, and your confirmations no longer count towards a product's Community verified status.
• Rate-limit and counting records (keyed hashes made from your IP address or account ID): set to expire after two hours, or two days for daily counts, and cleared as new records are written.
• Emails you send us: as long as we need them to help you. We keep a record of privacy requests and our answers for 24 months.
• Request logs and backups held by our service providers: kept for the periods their services set. Google and Anthropic handle what we send them under the terms that apply to our use of their services.

On this device, with or without an account:

• Edit or delete any diary entry. Removing a person or pet in Household removes their entries.
• Backup & export downloads a backup or a CSV, restores a backup, and has Erase everything, which deletes the diary and resets the household to just you.
• Erase everything doesn't clear your allergen and sensitivity lists, scan list, comparison bench, dry-matter shelf, prices, bookmarks, recent product searches or Laboratory combination. Each can be cleared where you use it, such as Sensitivities, History and the product search on the home page.
• To remove a saved price, open the product, tap Change, then Forget my price. If the price is also saved in your account, do this while signed in.
• Clearing ingredient.help's site data in your browser's settings removes everything the app keeps on the device. In our Android app, this data is kept by the browser that runs the app, usually Chrome, so clear ingredient.help's site data there. Uninstalling the app may not remove it.

With an account:

• Account & data: clear your scan history, saved combinations or recently viewed ingredients, download a copy of your account data, sign out, or delete the account.
• Delete your account works in any browser, without the app. Deletion is permanent and immediate. It removes your sign-in and the account data listed under If you create an account, except that products you were the first to read and your confirmations stay in the shared catalog, no longer linked to you; your confirmations then no longer count towards a product's Community verified status. Copies in our providers' backups, and the sign-in records Supabase keeps, may remain for the periods those services set.
• The download doesn't include the name, picture and account ID Google shares, or sign-in records. Email us for those.
• To correct your email address or anything else you can't change in the app, write to us.

You can also email support@ingredient.help to ask what personal information we hold about you, or to get a copy, correct it or delete it. We may ask you to confirm the request from the email address on the account. We can't act on information kept only on your device, because we don't hold it.

Depending on where you live, including California and other US states, the European Economic Area, the UK and Switzerland, you may have the right to know what personal information we hold and how we use it, to get a copy in a portable format, to correct it, to have it deleted, to object to or restrict some uses, and to complain to your data protection authority. To use these rights, or to ask on someone's behalf as their authorized agent, email support@ingredient.help. If you ask as an agent, we may ask for the person's signed permission and confirm their identity with them directly. We won't charge you more or give you a lesser service for using these rights.

We answer within 45 days (one month in the EEA and UK), and tell you if we need longer. If we turn a request down, you can appeal by replying to our answer with "Appeal" in the subject line. We answer appeals within 60 days, and if we still decline, you can contact your state attorney general.

In the terms US state privacy laws use, we collect:

• Identifiers: email address, account ID, IP address, your display name if you set one, and, with Continue with Google, the name, profile picture and account ID Google shares.
• Account sign-in details (email address and password), used only to sign you in and keep your account secure.
• Internet or other electronic network activity: requests to our server and, if you're signed in, your scans, the ingredient pages you open, the combinations you save, and the products you confirm or were the first to read.
• Commercial information: prices you save with your account, your plan and the Ingredient Plus days you earn.
• Visual information: photos of product labels you send to be read.

They come from you and your device, and from Google if you use Continue with Google. We use them for the purposes under Why we use it, disclose them only as described under Who else receives data, and keep them as described under How long we keep it. We don't collect precise location, and we don't draw inferences or build profiles about you. Health information you record in the diary is kept on your device, and we don't receive it.

In the past 12 months we haven't sold or shared personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. The only sensitive personal information we collect is your account sign-in, which we use only to sign you in and keep your account secure, so there is nothing to limit.

If you're in the EEA, the UK or Switzerland, we use your information to provide the account and features you ask for (our contract with you); for our legitimate interests in reading labels, building the shared catalog, limiting misuse and keeping the service working; and to comply with the law, for example to answer a privacy request or keep a record of one. You can object at any time to what we do on the basis of legitimate interests by emailing us. You don't need an account, or to give us your name or email address, to scan; we need an email address only to create an account. We don't make decisions about you based solely on automated processing: the scores Claude helps write are about products, not people.

We use no advertising or analytics cookies. The only cookies keep you signed in: Supabase's sign-in cookie, which is renewed while you use the app signed in and expires 400 days after it was last renewed, unless you sign out, and a one-time sign-in code cookie, set when you create an account or start Continue with Google and removed when sign-in completes. If sign-in isn't completed, that one can stay until you sign in or clear the site's data. None of these is set unless you sign up or sign in.

The app also uses your browser's local storage, IndexedDB and session storage for the information under What stays on your device, and keeps copies of public pages and of the on-device text reader so it can work offline. Signing out and deleting your account remove the stored page copies.

We don't track you across other websites or apps. The site loads no third-party scripts, ads or analytics. Apart from Open Food Facts' image servers, which receive the requests for product photos, and Google if you choose Continue with Google (see Who else receives data), no other company collects information about your activity through Ingredient.help. We don't sell or share personal information for targeted advertising. So there is nothing for a Do Not Track or Global Privacy Control signal to switch off, and the app works the same whether or not your browser sends one.

Ingredient.help is made for adults looking after themselves, their family and their pets. It isn't directed at children under 13, and we don't knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or sent us personal information, email support@ingredient.help and we will delete it.

Parents can keep diary records about their children: a name, life stage, birth year or month, allergens, what they had and how they were. Like the rest of the diary, these stay in the browser on the parent's device and aren't part of any account. The same goes for other adults you keep the diary for. Before you add another adult, an elderly parent or a pregnancy, the app asks you to check they're happy for you to keep their health information there.

• The site is served over HTTPS.
• In the database, each account can read only its own rows, and shared records can be reached only by our server.
• Our server takes your identity from your sign-in session, not from what a request says.
• Photos aren't stored. Our own tables keep no IP addresses, only the short-lived keyed hashes described above; Supabase's sign-in service records the IP address and browser of signed-in sessions.
• The site loads no third-party scripts. Apart from product photos and Google sign-in, its pages talk only to our server and Supabase.
• Our staff tools need a separate access key.

No system is perfectly secure. If a breach affects your personal information, we'll tell you as the law requires. Information on your device is protected by your device and browser, so use a screen lock, and keep diary backups and reports private: they contain health notes.

We're based in the United States. Information you send us is processed in the United States, and may also be processed in other countries where our service providers operate. If you use Ingredient.help from outside the United States, your information is transferred there.

When we change this policy, we'll post the new version here and update the date at the top. If a change affects information we already hold, we'll show a notice in the app before it takes effect. New features that change what we collect, such as payments or syncing the diary, will come with an updated policy.

Rasveda Labs, LLC, New York, United States. Email support@ingredient.help with questions about this policy or your information, and for privacy requests. To delete your account yourself, use Delete your account.