# CanIEat - Privacy Policy

**Last Updated:** March 1, 2026

## 1. Introduction

CanIEat ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("the App").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the application.

## 2. Information We Collect

### 2.1 Information You Provide

**Search Queries**
- Food items you search for within the App
- This information is used solely to provide you with food safety recommendations
- Search queries are processed through our secure backend API and are not permanently stored

**Subscription Information**
- Subscription status and purchase history are managed by Apple's App Store
- We do not collect or store your payment information
- We only receive confirmation of subscription status from Apple

### 2.2 Automatically Collected Information

**Device Information**
- Device type and model
- Operating system and version
- App version
- Unique device identifiers (for crash reporting and analytics)

**Usage Data**
- App features accessed
- Search frequency and timing
- Error logs and crash reports
- Anonymous usage statistics

### 2.3 Information We Do NOT Collect

- Your name or contact information (unless you contact support)
- Your location or GPS data
- Your health records or medical history
- Your personal identifiable information
- Photos, contacts, or other personal device data

## 3. How We Use Your Information

### 3.1 To Provide the Service

- **Process search requests**: Your food queries are sent to our AI-powered analysis system
- **Deliver personalized results**: Based on official UK medical guidelines
- **Maintain service quality**: Monitor performance and fix bugs

### 3.2 To Improve the App

- **Usage analytics**: Understand how features are used
- **Error tracking**: Identify and fix technical issues
- **Feature development**: Develop new features based on usage patterns

### 3.3 To Manage Subscriptions

- **Verify subscription status**: Check if you have access to premium features
- **Process renewals**: Manage auto-renewal through Apple App Store
- **Provide trial periods**: Track trial start and end dates

### 3.4 Legal Compliance

- **Respond to legal requests**: Comply with applicable laws and regulations
- **Protect rights**: Enforce our Terms of Use
- **Prevent fraud**: Detect and prevent abusive behavior

## 4. How We Share Your Information

### 4.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

**OpenAI (AI Processing)**
- Food safety queries are sent to OpenAI's API through our secure backend
- OpenAI processes the query and returns a response
- OpenAI's use of data is governed by their privacy policy
- Learn more: https://openai.com/privacy

**Apple App Store (Subscription Management)**
- Subscription purchases and management are handled by Apple
- Apple's use of data is governed by their privacy policy
- Learn more: https://www.apple.com/legal/privacy/

**Google Cloud Platform (Hosting)**
- Our backend API is hosted on Google Cloud Platform
- GCP provides infrastructure and security
- GCP's use of data is governed by their privacy policy
- Learn more: https://cloud.google.com/privacy

### 4.2 Analytics Providers

We use analytics services to understand App usage:
- Expo Analytics (built into Expo framework)
- These services collect anonymous usage statistics
- No personally identifiable information is shared

### 4.3 We Do NOT Sell Your Data

- We will never sell your personal information to third parties
- We will never share your search queries with advertisers
- We do not use your data for targeted advertising

## 5. Data Security

### 5.1 Security Measures

We implement appropriate security measures to protect your information:

**Encryption**
- All data transmitted between the App and our servers uses HTTPS/TLS encryption
- API requests are authenticated using secure tokens
- No plain-text transmission of sensitive data

**Backend Security**
- Our backend API uses industry-standard security practices
- Rate limiting to prevent abuse
- Authentication required for all API requests
- Regular security updates and monitoring

**Access Controls**
- Limited access to backend systems
- Secure credential management
- Audit logging of system access

### 5.2 Data Retention

**Search Queries**
- Processed in real-time and not permanently stored
- Temporary caching may occur for performance (< 24 hours)

**Usage Analytics**
- Anonymous usage statistics retained for up to 12 months
- Used solely for App improvement

**Subscription Data**
- Managed by Apple App Store according to their retention policies
- We only retain subscription status information

### 5.3 Security Limitations

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

## 6. Your Rights and Choices

### 6.1 Access and Control

**Subscription Management**
- View and cancel subscriptions through your Apple App Store account settings
- Settings > [Your Name] > Subscriptions

**Data Deletion**
- Uninstalling the App will remove all locally stored data
- To request deletion of any data we hold, contact us at support@canieat.app

### 6.2 Marketing Communications

- We do not send marketing emails or notifications
- You may receive transactional notifications related to your subscription
- You can disable notifications in your device settings

### 6.3 Rights Under Data Protection Laws

Depending on your location, you may have rights including:
- **Right to access**: Request a copy of data we hold about you
- **Right to correction**: Request correction of inaccurate data
- **Right to deletion**: Request deletion of your data
- **Right to data portability**: Receive your data in a portable format
- **Right to object**: Object to certain processing activities

To exercise these rights, contact us at support@canieat.app.

## 7. Children's Privacy

CanIEat is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately.

## 8. International Data Transfers

Our backend services are hosted on Google Cloud Platform servers, which may be located in various countries. By using the App, you consent to the transfer of your information to countries outside your country of residence, which may have different data protection laws.

## 9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:
- Updating the "Last Updated" date at the top of this policy
- Posting a notice in the App
- Sending you a notification (for material changes)

Your continued use of the App after changes constitutes acceptance of the updated Privacy Policy.

## 10. Third-Party Links and Services

The App may contain links to third-party websites or services (e.g., NHS guidelines). This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party sites you visit.

## 11. UK GDPR Compliance

As a UK-based service referencing UK medical guidelines, we comply with the UK General Data Protection Regulation (UK GDPR):

**Legal Basis for Processing**
- **Contract performance**: Processing necessary to provide the service you requested
- **Legitimate interests**: Improving the App and preventing fraud
- **Consent**: Where required, we obtain your explicit consent

**Data Controller**
- CanIEat acts as the data controller for information collected through the App

## 12. California Privacy Rights

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):
- Right to know what personal information is collected
- Right to know if personal information is sold or disclosed
- Right to opt-out of the sale of personal information
- Right to request deletion of personal information
- Right to non-discrimination for exercising CCPA rights

**Note**: We do not sell personal information to third parties.

## 13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

**Email**: support@canieat.app
**GitHub**: https://github.com/olgagorskikh/canieat
**Support**: https://raw.githubusercontent.com/olgagorskikh/canieat/main/docs/SUPPORT.md

For privacy-specific inquiries, please include "Privacy" in your subject line.

## 14. Data Protection Officer

For data protection inquiries or to exercise your rights under data protection laws, you may contact our privacy team:

**Email**: privacy@canieat.app
**Response Time**: We aim to respond to all privacy requests within 30 days

## 15. Complaints

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a supervisory authority:

**UK**: Information Commissioner's Office (ICO)
- Website: https://ico.org.uk/
- Phone: 0303 123 1113

**EU**: Your local data protection authority

---

**By using CanIEat, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.**