Privacy Policy
Last updated: 24 September 2026
This Privacy Policy explains how Verify Veg (“we”, “us”, “our”) processes personal data when you use:
- the Verify Veg iPhone app;
- the Verify Veg Android app, when it is released (it will follow the practices described here); and
- the website https://verify-veg.com (the marketing site, dish directory, blog, and related pages).
Together, these are the “Service”. Our Terms govern use of the Service. This policy is written under the EU General Data Protection Regulation (GDPR) and Dutch law. The app is also offered to people outside the European Economic Area (EEA). If a local law gives you additional rights, you can still contact us as described below.
This English text is the original. If we later publish a translation, the English version prevails if there is a conflict.
1. Who we are
Controller: Verify Veg, Netherlands.
Contact: support@verify-veg.com
We have not appointed a data protection officer. Our lead supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority): autoriteitpersoonsgegevens.nl.
Please contact us by email. We do not publish a postal address.
2. Summary in plain language
Verify Veg helps you check packaged-food ingredient lists against diets you choose (for example vegan, vegetarian, halal, kosher, gluten-free) and optional custom “avoid” items. You can scan a barcode or photograph (or pick) an ingredient label. There is no user-facing login: you never type a name, password, or required email to use the scanner.
What we do not do (this is intentional):
- We do not require your real name or a personal email address to use the app.
- We do not use advertising identifiers or ask for App Tracking Transparency permission in order to advertise to you.
- We do not collect phone numbers or operate an in-app messaging product.
- We do not collect precise location.
- We do not sell personal data for advertising, and we do not use advertising SDKs or track you across other companies’ apps.
- We do not operate a public social feed or let other users browse your scans.
- This app does not upload your scan photos to Open Food Facts. Barcode lookups query Open Food Facts; they do not contribute your photos to that database.
We do create a silent, device-bound backend profile so credits, Pro status, and feedback can persist. If you run an online AI label scan, a downscaled photo of the label is sent to our processors so an AI model can read the ingredient list. Offline mode keeps that work on the device.
Diet choices can say something about health or religion. We treat that as special-category data. You choose those diets yourself.
3. Data we process, by category
Depending on how you use the Service, we may process:
- Device and install identifiers — a device-bound identifier stored using the operating system’s secure storage. These are used to create and recognise the silent backend profile.
- Backend user id — a technical identifier on our servers. It is not shown to you as an “account”.
- Internal technical identifier — our backend auth uses an internal, pseudonymised technical account identifier bound to your device. It is not a mailbox you own and is not used to email you.
- Camera and photo-library images — when you scan or pick a label. See section 4.
- Barcode values and product data returned by Open Food Facts. See section 5.
- Ingredient text extracted or looked up, and translations of that text into English for matching.
- Diet and avoid-list preferences — names of built-in diets you select, and custom items you type (stored locally; a count of custom items may be sent with some feedback). See section 6.
- Local scan history — verdict, timestamp, selected diets, English ingredient string, product name, reasons, photos, favourite flag, rating flags, scan source, whether the scan was offline. See section 3.1.
- Credits, subscription tier, referral code, and purchase metadata — enough to unlock Pro and AI-scan credits. We do not receive your Apple or Google password or full payment-card number. See section 7.
- App analytics events — for example app open, screens we track, scan started/completed/failed, paywall, purchase, diet selected, camera-permission result, locale, offline mode, tier, scan outcome, and similar product events. See section 8.
- iOS session-replay screenshots and in-app surveys — iOS only; see section 8.
- Feedback you submit — ratings, optional comments, optional email if you want a reply. See section 9.
- Support correspondence — if you email us.
- Website data — if you visit verify-veg.com: technical request data, page views before you choose a cookie setting, fuller analytics only after you accept, and (if you join the Android waitlist) your email. See section 10.
- Technical logs — IP address, device/OS, app or browser version, and similar diagnostics that our hosts and analytics tools typically receive when a request is made.
We do not collect your name, or a personal email, as a condition of using the scanner. Email appears only if you optionally provide it on a feedback form, join the website waitlist, or write to support.
3.1 Local scan history
Saved scans stay on your device (JPEG files in the app sandbox plus metadata in a local history file). History is not synced as a cloud photo library. You can delete individual scans in History in the app, where that control is available. Uninstalling the app deletes local history. Feedback or ratings you already sent to our servers are not deleted by uninstalling; see section 15.
4. Photos, camera, and AI label reading
The app asks for:
- Camera — to scan barcodes and photograph ingredient labels. iOS usage text: “We use the camera to scan barcodes on food products and analyze ingredients for your diet and allergy needs.”
- Photo library — so you can pick an existing product or label photo. iOS usage text: “We need access to your photo library to select product images for scanning.”
You can revoke those permissions in system settings. We do not request microphone, contacts, or location permission.
Withdrawing camera or library permission stops new captures or picks. It does not erase scans already saved on the device or the silent backend profile.
4.1 What happens to a photo
On the device (if a scan is saved): a JPEG is stored locally with the history described above. Original full-resolution camera frames are not what we upload.
Online AI extract (cloud AI label scan): a downscaled and compressed image of the label area is transmitted to our cloud backend hosted on Supabase and processed using Google Gemini to extract the printed ingredient list. This uses an AI scan credit. Limited free AI scans are described in the app; barcode checks and offline checks are not billed as AI scans in the same way.
The downscaled photo is transmitted to our processor (Supabase) and to Google Gemini for extraction. We do not keep that JPEG in our database after extraction, and we do not use scans to build a public product database. We use Google’s Gemini API on paid terms that do not allow Google to use that content to train its models. Google may still process the image outside the EEA in order to return the ingredient list.
Offline mode: cloud extract is skipped. On-device optical character recognition (OCR) runs instead:
- iOS: Apple Vision
- Android: Google ML Kit (multi-script)
Photos are not uploaded for that path. Apple and Google may apply their own on-device processing rules; we do not send those OCR frames to our servers when offline mode (or the on-device fallback) is used.
Ingredient text and custom avoid-list items may be translated into English for matching. The app prefers on-device translation (Apple Translation on iOS; ML Kit on Android). If you are online and on-device translation is not enough, text (not the photo) may be sent to our cloud translation service on Supabase, which uses Google Gemini. Offline mode avoids the cloud translation fallback where the code path allows.
5. Barcodes and Open Food Facts
When you scan a barcode, the app requests product data from the Open Food Facts API (for example https://world.openfoodfacts.net/api/v2/product/{barcode}.json). The request identifies the app and support@verify-veg.com in the User-Agent, which is Open Food Facts’ usual polite-use requirement.
If a product is found, the app may download product images from Open Food Facts content-delivery networks (for example images.openfoodfacts.net) to display locally.
Open Food Facts is an independent third party. We do not operate it. Their practices are described in their own policy: Open Food Facts privacy.
If ingredient text from Open Food Facts is not in English, the app may send that text (not a photo) to our cloud translation service, as in section 4.
6. Diet and food-avoidance preferences
Built-in modes include vegan, vegetarian, halal, kosher, Jain, no beef, no pork, gluten-free, lactose-free, and nut-free, plus custom avoid-list items you type (Pro can store up to a larger number of custom items; the current limit is shown in the app).
Those preferences are stored on the device so the app can check a product against the rules you chose. Generic dietary rules (ingredient lists that are not about you) may be downloaded by the app so matching criteria remain up to date.
We also:
- send selected diet names and a count of those diets to PostHog as person properties; and
- include diet names, names of flagged (“violating”) ingredients, product name, and a cryptographic hash of the ingredient text (which confirms matches without storing raw text) on feedback we receive.
Selecting a diet can reveal information about health (for example gluten-free, nut-free, lactose-free) or religious practice (for example halal, kosher, Jain). Under GDPR that can be special-category data (Article 9). We rely on your explicit consent (Article 9(2)(a)), given by you choosing those diets in the app. This is not ordinary “usage statistics”.
You can withdraw that consent by deselecting the diet, deleting local history (where available), uninstalling the app, and/or emailing us to ask that server-side copies (analytics person properties, feedback) be erased or anonymised. Uninstalling does not by itself delete data already sent to our servers.
Verify Veg is a labelling aid. It is not a medical device and does not provide a diagnosis, treatment, or a guarantee that a product is safe for allergies or coeliac disease. Our in-app FAQ states that gluten-free and nut-free modes are not a medical safety tool. Do not rely on the app as the sole check if a mistake could harm you.
7. Device account, credits, and purchases
On first use the app generates or reads a device-bound identifier, stores it using the operating system’s secure storage, and signs up or signs in to Supabase Auth with the internal, pseudonymised technical account identifier described in section 3. That creates a persistent backend user id used for credits, subscription sync, and feedback. You cannot sign in with a personal email and password. The app has no screen for viewing or deleting that silent backend profile; email us instead (section 15).
Our backend stores, for that silent profile: tier (Free or Pro), AI scan credits, referral code, and subscription records.
iOS: purchases go through Apple StoreKit 2 / the App Store. After purchase or restore, the app sends Apple transaction identifiers, product id, status, and expiry to our backend verification service.
Android: purchases go through Google Play Billing. Purchase tokens and product ids are sent to our backend verification service.
Apple and Google process checkout under their own terms. We receive what we need to unlock Pro and credits. We cannot erase Apple’s or Google’s own purchase records if you ask us to delete your Verify Veg data.
Apple’s privacy information: apple.com/legal/privacy. Google’s: policies.google.com/privacy.
8. Analytics, feature flags, surveys, and session replay
We use PostHog on the EU cloud (https://eu.i.posthog.com / eu.posthog.com) for product analytics and feature flags. We do not use PostHog to advertise to you or to track you across other companies’ apps.
If analytics configuration is missing, analytics is disabled. Production builds include it.
Typical data includes the kinds of events listed in section 3; language; whether the app is offline; subscription tier; diet profile names and count; scan outcome (compliant / not / uncertain); whether ingredients were extracted and how (on-device, barcode database, or cloud AI); a device/install id; and our backend user id. PostHog’s SDK also typically receives IP address, device/OS, and app version.
We associate analytics with the same silent backend profile used for credits and purchases, so usage is not split across two unrelated records.
Person properties may include an anonymous user identifier, selected diet names and count, language/locale, subscription tier, onboarding status, permission status, first-scan / compliance flags, and on iOS trial status.
We do not send full photos or typed passwords to PostHog as event properties. Feedback-related events record whether a comment or email was provided, not the email body or comment text.
8.1 iOS
On iOS we also enable application lifecycle events, in-app surveys, and session replay. Text input fields and images in replay are masked. Other on-screen text — diet chips, product names, ingredient lists shown as ordinary labels — can appear in replay screenshots. We do not claim that ingredient lists never appear in analytics.
Feature flags are evaluated through PostHog.
8.2 Android
Android currently sends events only. There is no session replay and no PostHog surveys SDK in the current Android wiring. Screens are tracked as events we send ourselves, not by automatically capturing every screen name.
8.3 No in-app analytics opt-out
The app does not currently include a setting to turn analytics, surveys, or iOS session replay off. If you object to this processing, email support@verify-veg.com. We will honour GDPR objections and erasure requests as described in section 15, including asking PostHog to delete the person we can identify. We intend to improve this (a consent prompt or in-app opt-out, especially for replay and surveys) in a later app release.
The website is different: cookies, click tracking, heatmaps, and session replay start only after you accept. Before you choose, we only count page views without an analytics cookie. If you decline, that stops too. See section 10.
9. Feedback and optional email
Scan rating (thumbs): we store rating, optional comment (on iOS; some Android builds rate without a comment field), scan id, compliance result, product name, a cryptographic hash of the ingredient text, flagged ingredient names, diet names, locale, tier, app version, and timestamps with your feedback. In-app copy asks you not to include personal information in rating comments.
App feedback / inaccuracy reports: optional email, comment, category, locale, tier, scan count, app version, and optional scan context. Email is optional and only if you want a reply.
If you share results using the system share sheet, that share is started by you. We do not operate a public feed of shared results.
10. Website (verify-veg.com)
The marketing site is hosted on Cloudflare. Cloudflare processes IP addresses and standard request metadata to deliver pages, protect the site, and (for the waitlist) apply a short rate limit. Cloudflare’s policy: cloudflare.com/privacypolicy.
10.1 Cookies and similar technologies
A banner lets you accept or decline analytics cookies. “Cookie settings” in the footer reopens that choice. We store your choice in the browser (cookieConsent in localStorage). Theme preference (color-theme) is also stored locally so the site can respect light/dark mode; that is not used for advertising.
If you have not chosen yet, we still send a limited page measurement to PostHog through /ingest (PostHog’s EU cloud). That covers the page address, when you leave it, the referrer, browser and device type, site language, and an approximate country derived from your IP address. We do not set a PostHog cookie or write PostHog data to localStorage for this. We do not record clicks, heatmaps, JavaScript errors, performance timing, session replay, or surveys, and we do not create an analytics person profile. The identifier for that measurement stays in memory for the current page load and is not kept after a reload, so it is not a cross-visit profile. Referral codes in the address (the code parameter) are removed from these events. This is audience measurement without an analytics cookie. Decline the banner, or email us, to object.
If you decline, we stop that measurement. If PostHog was already running, we stop capturing, stop session recording, and reset the analytics client. We do not keep counting you after you decline. Page measurements already sent stay as anonymous statistics; declining does not delete them.
If you accept, we keep using PostHog through /ingest. That may set PostHog cookies and/or localStorage (typically names beginning with ph_). After consent we may collect page views, clicks we track (for example store-badge clicks, language switches, waitlist open/submit without the email address), autocapture (with some store and waitlist buttons excluded from duplicate autocapture), heatmaps, dead clicks, JavaScript exceptions, performance timing, session replay (text inputs masked), and surveys if we configure them. Replay on the website can include on-screen text of public pages.
| Name / type | Purpose | When |
|---|---|---|
cookieConsent (localStorage) |
Remember accept or decline | Necessary to honour your choice |
color-theme (localStorage) |
Light / dark theme | Necessary for site appearance |
PostHog cookies / storage (e.g. ph_*) |
Analytics, replay, feature flags, surveys on the website | Only after you accept |
Cloudflare, as host, may also process technical data on each request independently of that banner. We do not use the site for third-party advertising cookies.
10.2 Android waitlist
The homepage can collect an email so we can notify you when Android launches. On-site copy states: “We'll only email you about the Android launch.” Submitting the form is consent to that use.
There is no separate email-service provider. A Cloudflare Worker receives the address, rate-limits by IP for a short window, and stores it on a PostHog EU person record as an Android waitlist signup. The related analytics event does not include the email address.
There is no self-serve unsubscribe link today. To be removed, email support@verify-veg.com.
10.3 Referral and deep links
Links such as https://verify-veg.com/l?code= and the app scheme verifyveg:// can open the app to redeem a code. Clicking such a link is not extra tracking by itself. If you have not chosen yet, a page view may still be counted, without the referral code. If you have accepted website analytics, a page view of that URL may be recorded like any other page.
11. Processors and other recipients
We share personal data with the parties below to run the Service — not to sell it for advertising. “Processor” means they act on our instructions. Apple, Google (stores), and Open Food Facts also act as independent organisations for checkout or the public food database.
| Party | Role | Typical data | Region / notes |
|---|---|---|---|
| Supabase (privacy) | Processor (hosting, auth, edge functions, database, storage) | Silent device account, credits, purchase metadata, feedback, AI request payloads, matching-criteria updates | European Union |
| Google (Gemini) via our cloud AI services (privacy) | Subprocessor / AI provider | Downscaled label JPEG (extract); ingredient or avoid-list text (translate); returned lists | May be processed in the United States. Paid Gemini API; not used to train Google’s models; we do not keep the JPEG in our database after extraction |
| Google (ML Kit, Play Billing) | OS / store; on-device SDK; Play is required for paid Android features | On-device OCR/translation; Play purchase tokens | See Google’s privacy policy |
| Apple (Vision, Translation, StoreKit, App Store) (privacy) | OS / store | On-device processing; in-app purchases | Apple’s regions |
| PostHog (privacy) | Processor | App analytics and flags; iOS replay and surveys; website page views before a cookie choice, and website analytics after you accept; waitlist emails as person properties | EU cloud (eu.i.posthog.com) |
| Open Food Facts (privacy) | Independent third party | Barcode, User-Agent; product JSON and images returned | France / global volunteer database |
| Cloudflare (privacy) | Processor / host (website and waitlist Worker) | IP address, request metadata; waitlist submissions in transit | Global CDN; we use it to serve verify-veg.com |
| Apple iCloud Mail (privacy) | Independent mailbox provider | Support correspondence and optional feedback email sent to support@verify-veg.com | Apple’s regions |
If we sell or reorganise the business, personal data may transfer to the buyer or successor as part of that transaction. We will take steps so the recipient continues to protect it in line with this policy, and we will notify you of a material change of controller where the law requires.
We may disclose data if required by law, or to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Verify Veg, our users, or others.
12. Legal bases (GDPR)
We do not rely on “by using the Service you agree” as our legal basis. For EEA (and UK, where UK GDPR applies) users, we use:
| Purpose | Legal basis |
|---|---|
| Silent device profile, credits, Pro, restore purchases | Contract (Art. 6(1)(b)) — to provide the app you chose to use |
| Camera / photo library | Consent via the operating-system permission (Art. 6(1)(a)); the scan you start also needs those images to perform the contract |
| Cloud AI photo extract and cloud translation when you run an online AI scan | Contract (Art. 6(1)(b)) |
| Offline on-device OCR and translation | Contract (Art. 6(1)(b)) |
| Open Food Facts barcode lookup you start | Contract (Art. 6(1)(b)); alternatively legitimate interests (Art. 6(1)(f)) in completing the lookup |
| Diet preferences to perform the check on the device | Contract (Art. 6(1)(b)); special category: explicit consent (Art. 9(2)(a)) given by selecting the diet |
| Diet names on PostHog and on feedback you submit | Art. 6: legitimate interests in understanding how diets are used, and (for feedback) the request you send; Art. 9: explicit consent as above. You can object or withdraw as in sections 6 and 15 |
| In-app PostHog product analytics (events) | Legitimate interests (Art. 6(1)(f)) — to improve the app, fix bugs, and understand feature use. There is no in-app opt-out today; you may object by emailing us |
| iOS session replay and in-app surveys | Currently enabled with in-app analytics (no separate prompt). You may object by email. We treat this as a gap and aim to add a dedicated consent or opt-out |
| Optional feedback email | Consent (Art. 6(1)(a)) |
| Website page views before you accept or decline | Legitimate interests (Art. 6(1)(f)) — to see which pages are used without storing an analytics cookie. No replay, clicks, or surveys. Decline the banner or email us to object |
| Website analytics cookies, click tracking, heatmaps, replay, and surveys | Consent (Art. 6(1)(a)) via the cookie banner |
| Website Android waitlist | Consent (Art. 6(1)(a)) |
| Support email | Contract and/or legitimate interests — to answer you |
| Legal, tax, and store records | Legal obligation (Art. 6(1)(c)) and/or contract |
| Security, fraud, and abuse prevention | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, you may object (section 15). Where we rely on consent, you may withdraw it. Withdrawal does not affect processing already carried out.
13. International transfers
PostHog for this product is configured for EU hosting.
Photos and text sent for AI extraction or cloud translation may be processed by Google, which may take place outside the EEA (including the United States).
Apple and Google process payments in the regions where they operate. Open Food Facts is queried on the public internet. Cloudflare operates a global network to serve the website.
These vendors process data under their own terms. Where personal data is transferred outside the EEA, we rely on the lawful transfer tools those vendors make available (including Standard Contractual Clauses where they offer them). We have not published a separate list of signed data-processing agreements.
14. Retention
We keep personal data only as long as needed for the purposes above. Periods below are maxima (“up to”). We may delete or anonymise sooner.
| Category | Period |
|---|---|
| Local scan history and photos | Until you delete the scan (where that control exists) or uninstall the app |
| Silent Supabase profile, credits, tier, transaction metadata | For the life of the install relationship, then up to 12 months after last activity, or until a valid erasure request |
| Feedback and scan ratings | Up to 12 months unless needed for a dispute |
| PostHog events / persons | Up to 12 months |
| iOS (and website) session replay | Shorter than events; up to 30 days (PostHog recording retention) |
| Support emails | Up to 12 months after the thread is closed |
| Waitlist emails | Until we have sent the Android launch notice plus up to 3 months, or until you ask to be removed |
| Purchase records | As long as tax and commercial law require (often longer than 12 months) |
| AI image payload on Supabase / Google | Not kept in our database after extraction; sent to Gemini only to read the label |
We may keep data longer if the law requires it, if we need it to establish, exercise, or defend legal claims, or if you ask us to keep something. Residual copies may remain in encrypted backups for a limited backup window and are not restored except for security, disaster recovery, or legal compliance. When we anonymise data so it can no longer identify you, we may keep that anonymous form for statistics.
15. Your rights and how to exercise them
If GDPR (or UK GDPR) applies to you, you may request: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You also have the right not to be subject to certain automated decisions that produce legal or similarly significant effects. We do not use the Service to make such decisions about you (scan verdicts are a product feature you requested, not a legal decision about you).
To exercise these rights, email support@verify-veg.com. We will respond within one month (we may extend by two further months for complex requests, and will tell you if so). We may need to verify the request.
There is no in-app screen to view, export, or delete the silent backend profile. Uninstalling deletes local history only.
If you never gave us a personal email, we may not be able to match you to a device profile unless you send enough install/device context (for example what we ask for in a support reply: platform, approximate install date, subscription status, a screenshot of a scan id, or other details we specify). Do not send photos of unrelated people or documents we do not need.
What we can typically do: delete or anonymise the Supabase user we can identify; ask PostHog to delete that person; delete waitlist or feedback rows we can match. What we cannot do: erase Apple or Google purchase history; erase Open Food Facts’ own database; reach backups instantly; identify you with certainty if you provide nothing that links to the silent profile.
Complaints: you may lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or with your local EEA supervisory authority.
15.1 People outside the EEA
This policy still describes what we do. We are not a US-incorporated business. We do not sell personal data for ads and we do not operate a “do not sell” toggle in the app, because we do not sell data in that sense. If a law in your country (including some US states) gives you specific rights, email us and we will consider the request in good faith.
16. Children
The Service is not directed at anyone under 16. We do not knowingly collect personal data from children under 16. Camera and diet features are not designed for children. If you are a parent or guardian and believe your child has provided data, contact us. If we learn we have collected personal data from anyone under 16 without appropriate consent, we will take steps to delete it.
17. Security
We use commercially reasonable measures appropriate to a small consumer app (including storing device-bound credentials in the operating system’s secure storage, TLS in transit to our backend, and access controls at our processors). No method of transmission or storage is completely secure. We cannot guarantee absolute security.
18. Third-party links
The Service may link to other sites (App Store, Play, Open Food Facts, our social profiles). We do not control those sites. Their privacy policies apply when you leave our Service.
19. Changes
We may update this Privacy Policy. We will post the new version on this page and change the “Last updated” date. For a material change, if we have a contact address for you (for example waitlist or support email), we may also notify you. Continued use after a change means the new policy applies to subsequent processing; it does not replace the legal bases described above.
This page: https://verify-veg.com/privacy/
20. Contact
Questions, objections, and rights requests:
- Email: support@verify-veg.com
- Terms: https://verify-veg.com/terms/