Privacy Policy

What Zabihah AI collects, why, who it is shared with, how long it is kept and how to have it deleted.

Effective 9 October 2026 · Applies to version 3.0 of the app and later

What stays on your phone

Your scan history (product names, results and the photos of labels you took) is stored only on your device. It is not uploaded to us. Deleting a scan in the app removes it, and Settings › Delete my data removes all of it. Deleting the app also removes it.

The app uses your camera to read barcodes and to take photos of ingredient lists.

Photo scans

Before your first photo scan, the app shows a consent sheet explaining what is sent and why. Only if you agree:

• The photo of the ingredient list is sent over an encrypted (HTTPS) connection to our server, a Cloudflare Worker run by The Apptor, and from there to Google's Gemini API. Gemini reads the ingredients and rules on each one, and the result comes back to your phone. Your app language is sent too, so the result is in your language.
• We do not store or log the photo on our server.
• Google processes the photo under the Gemini API Additional Terms of Service, and may keep it for a limited period to monitor for abuse, as those terms allow.

You can withdraw your consent at any time in the app's Settings. Photo scans then stop working; barcode scans keep working.

Barcode scans

When you scan a barcode, the barcode number is sent to our server. Our server looks the product up on Open Food Facts (openfoodfacts.org) and, if it is not found there, on go-upc.com. It then sends the product's ingredient text to Google's Gemini API for the ruling. No photo is sent for a barcode scan.

A barcode number identifies a product, not you, so it is not personal data. We mention it so you know exactly what leaves your phone.

Install ID and our server

Each install of the app creates a random install ID and sends it with its requests to our server. It is used only for rate limiting and preventing abuse. It is never used to profile you or to link scans to a person. Like any internet service, our server also sees your device's IP address while it handles a request, and uses it only for rate limiting and security.

Our server keeps no record of your scans.

Feedback on results

If you answer Was this result correct?, we store that result (the product name, ingredient list and verdict, never a photo) together with your answer and any comment you type. It is stored by The Apptor on Cloudflare for up to 12 months and used only to improve accuracy. It is not linked to you.

Contacting support

If you contact us through the support form in the app or on this website, we receive your email address, your name if you give it, and your message. In the app, if you leave Include app details on, we also receive your app version, iOS version, device model, language and whether you have Premium. This is stored by The Apptor on Cloudflare and emailed to us so we can reply. We use it only to help you.

Usage analytics and crash reports

The app uses Google Firebase Analytics and Firebase Crashlytics, with Google acting as our processor.

• Analytics records app usage events such as screens viewed, scans completed and the Premium screen being shown, along with your device model, iOS version, approximate country and a random app instance ID. It does not use the advertising identifier, and ad personalisation is turned off. Analytics data is kept for 14 months.
• Crashlytics sends a crash report when the app crashes, so we can fix the problem. Crash reports are kept under Google's Crashlytics retention settings.

Purchases

Premium subscriptions are paid through Apple. Apple handles the payment, and we never see your card or payment details. RevenueCat (revenuecat.com) processes your purchase receipts, using an anonymous app user ID, so the app knows whether you have Premium and can restore it.

Who receives data

We do not sell or rent your data, and we do not share it for advertising. We may disclose information if the law requires it. Some of these companies process data outside the UK and the European Economic Area; where they do, they rely on legal safeguards such as standard contractual clauses.

Why we use your data

• Photo scans: your consent, which you can withdraw in Settings.
• Barcode scans and showing results: to provide the service you ask for.
• Install ID, rate limiting and security: our legitimate interest in keeping the service available and preventing abuse.
• Analytics, crash reports and result feedback: our legitimate interest in fixing problems and improving accuracy.
• Purchases: to provide the subscription you bought.
• Support messages: to answer you.

Children

Zabihah AI is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, email us and we will delete it.

Your rights

Under UK GDPR and the EU GDPR you can ask us for access to your data, to correct or delete it, to restrict or object to how we use it, and to receive a copy of it. You can also withdraw consent at any time. Because the app has no account, much of what we hold is not linked to you; tell us what you sent and roughly when, and we will do what we can to find it.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live. We would appreciate the chance to put things right first.

How to delete your data

• On your phone: delete a scan in the app, use Settings › Delete my data, or delete the app.
• Feedback and support messages: ask us through the support form or by email to [email protected]. We delete them within 30 days.

More detail is on our Delete your data page.

Changes to this policy

When the app changes what it collects or how it uses data, we update this page and the effective date at the top.

Contact

The Apptor, [email protected]. You can also use the support form.