🌿 NatureScan

1. Who we are

NatureScan is operated by Berakah Innovations. This policy explains what information the app handles, why, who else processes it, and the choices you have. You can contact us at support.naturescan@gmail.com.

2. Information we collect

An anonymous account ID

When you first open the app it creates an anonymous account for your installation and gives it a random user ID. You do not have to enter a name or email to use the core scanning feature.

Optional sign-in

You can link your account to an email address and password, or to your Google account, so you can recover your data on another device. If you do, we (through Firebase Authentication) store your email address and, for Google sign-in, the display name your Google account provides.

What you scan

When you scan, the app sends either the photo of the ingredient list you took or chose, or the text you typed or pasted, to our servers, which pass it to an AI service (see section 4) to read and assess the ingredients. Our servers do not save the photo itself in our database. We do save the result of each scan under your account ID: the product name if detected, the ingredients with their assessments, safety alerts, the summary, the score, and any personalised flags described below.

Health-related preferences you choose to give us (optional)

During setup or later, you can tell us about food allergies, a dietary framework (for example halal, kosher, vegan or vegetarian), health conditions (eczema, psoriasis, rosacea, sensitive skin, asthma, diabetes, hypertension), pregnancy or breastfeeding status, cosmetic sensitivities, hair type and concerns, and wellness goals. These are stored on our servers under your account ID and used only to personalise the alerts and flags shown on your scan results. We ask for your consent before storing this — the in-app consent screen lists the same items — and we record that you gave it. You can edit your answers from your profile once your account is set up; to withdraw completely, request account deletion (section 6). When the wording of this consent changes materially, we ask existing users to review and confirm it again the next time they open the app. If you decline at that point, we stop using any health-related information you previously gave us to personalise your results. Some of this is health information, which many laws treat as especially sensitive.

Your saved lists and history

Your scan history and your My Healthy Choices and Products to Avoid lists are stored on your device. The scan results described above are also stored on our servers, and we keep a count of how many products you have saved in each list.

Subscriptions

Purchases are handled by Google Play. We store your subscription status, plan, start and expiry dates and whether it auto-renews, together with a hashed (not raw) form of the purchase token so a purchase can be tied to one account. We do not receive your payment card details.

Notifications

If you allow notifications, we store a push-notification token for your device. We may send reminders if you have not scanned for several days.

Reports you send us

If you use “Report an issue” on a scan result, we receive a copy of that result (product, score, ingredients, alerts and personalised flags — which can reflect the allergies or dietary preferences you set), your account ID, and the comment you write. Please do not put personal or sensitive details in the comment. A short excerpt of the comment is also pushed to our team’s device so we see it promptly.

Usage and technical data

• Analytics: we use Google’s Firebase Analytics to see, in aggregate, which features are used (for example scans started or completed, screens viewed, which alerts were shown). This includes standard device and app information collected automatically by the SDK, which can include an advertising identifier where your device has one.
• Security and abuse prevention: to limit misuse we keep request counters tied to your account ID, and to your network (IP) address. Your IP address is stored as it is, not scrambled, together with a shortened one-way code identifying the account(s) that used it. The counters restart when their time window passes, but the record for an IP address is not currently deleted automatically.
• Server logs: our servers keep operational logs. They record a shortened one-way code for your account rather than the account ID itself, and they do not record the text of what you scan. Google Cloud keeps these logs for 30 days and then deletes them automatically. Google’s own infrastructure-level request logs for our servers may separately record the calling IP address.

We do not show ads and do not sell your data.

3. How we use information

• To read ingredient lists and produce scores, alerts and comparisons.
• To personalise flags using preferences you provided.
• To provide and verify subscriptions.
• To send notifications you have allowed.
• To review reports and improve the accuracy of results.
• To keep the service secure and prevent abuse, and to understand aggregate usage.

4. Who else handles your information

We use Google services to run the app:

• Google Gemini API — receives the ingredient-list photo or text you scan, with our generic instructions, to read and assess the ingredients. We do not include your account ID or your profile in that request. We use the paid tier of the Gemini API (our project has an active Cloud Billing account). Under Google’s terms for paid services, Google does not use prompts or responses — including images — to improve its products; it logs them for a limited period solely to detect and prevent policy violations and to meet legal or regulatory disclosure requirements; and it processes them under its Data Processing Addendum. No other AI provider receives your scan data.
• Firebase / Google Cloud — Authentication, Firestore database, Cloud Functions, App Check (which uses Google Play Integrity to confirm requests come from the genuine app), Cloud Messaging and Analytics. Our database is hosted in the United States (Google’s “nam5” multi-region). The servers that process your scans run in Frankfurt, Germany, and the function that alerts our team when you send a report runs in the United States.
• Google Play — billing, in-app updates, and Google Sign-In if you choose it.

We do not sell or rent your information.

5. How long we keep information

This describes what happens today.

• Your scan results, profile and reports are kept until we delete them following a request from you (see section 6). We do not currently delete them automatically after a period of time.
• Server logs (which can include your account ID) are deleted automatically after 30 days.
• Security and abuse-prevention records (section 2) are not currently deleted automatically.
• Deletion requests: we keep a record of your request — your account ID and the time you made it.
• Subscription and purchase records may be kept after your account is deleted where we need them for tax, accounting or dispute purposes.
• Backups and recovery: Firestore point-in-time recovery is enabled, providing rolling recovery from accidental data loss or deletion for up to 7 days. It was switched on on 2026-09-20, so recovery is available back to that point of enablement and reaches the full 7 days from 2026-09-27; no longer-term scheduled backups are configured. This means data we delete can remain recoverable for up to 7 days after it is deleted, and is then removed.
• Analytics: retained according to our Firebase Analytics configuration.

6. Your choices and rights

• On your device: swipe to delete a scan or use the trash icon in My Health to clear your local history. This removes the copies on your device only.
• Notifications: you can turn them off in Android settings.
• Sign-out: signing out starts a new anonymous account.
• Deleting your account: you can ask us to delete it from inside the app. If you have signed in with an email or Google account, open your profile, go to Privacy, and tap Request account deletion. If you haven’t signed in, tap the small Request account deletion link at the bottom of the Welcome screen you reach from the profile icon. You will be asked to confirm. The confirmation says:

  We'll review your request and, within 30 business days, delete your account along with your scan results, your profile, and any reports you've sent us. This can't be undone once it's processed.
  
  Data saved only on your device stays there until you clear it or uninstall the app. If you have a subscription, cancel it separately in Google Play — deleting your account doesn't cancel it.

  When we process a request we delete the data in our database and your sign-in account itself (including any email address linked to it). Making a request does not sign you out or change anything until it is processed. After you make a request the app shows “Deletion requested” instead of the button, and offers it again after 45 days. Uninstalling the app does not delete what is stored on our servers.
  • If the app can’t send your request (for example you have no connection), it may still be delivered once you are back online, so please don’t submit it repeatedly.
  • What a deletion request does not immediately cover: server logs, which expire on their own after 30 days; database recovery copies, which expire on their own within 7 days of deletion (section 5); subscription and purchase records we may need to keep (section 5); and aggregate analytics data held by Google. Security and abuse-prevention records tied to your IP address, which we may retain for the reasons described in section 2.
  • If the in-app request doesn’t work for you, email support.naturescan@gmail.com and we will handle it manually. If you signed in with an email or Google account, we match your request to that address. Anonymous users who lose access to the app (uninstall, device loss, cleared data) may not be able to request deletion by email, since no identifier is ever shown to them; the in-app “Request account deletion” button is their only reliable path while they still have the app installed.
  Access and correction: beyond what you can already edit from your profile, email support.naturescan@gmail.com to ask what information we hold about you or to correct it, and we will assist you.
• Changing or withdrawing your health-related information: you can edit your answers from your profile once your account is set up. There is no separate switch to withdraw consent after you have given it; to withdraw completely, request account deletion (above).

7. Children

NatureScan is intended for users aged 18 and over only, in line with the target audience we have declared for the app on the Google Play Store. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us at support.naturescan@gmail.com and we will address it.

8. Permissions the app requests

• Camera — to photograph ingredient lists.
• Internet / network state — to send scans and receive results.
• Notifications — to send reminders and alerts you allow.
• Storage (older Android versions) — to save share-card images when you tap Share.
• Google Play Billing — for subscriptions.
• Advertising-ID / ad-services permissions — declared by the Firebase Analytics SDK; we do not show ads.
• Microphone — not requested. The app never records audio.

9. Security

Data travels over encrypted connections. Our database rules allow you to read only your own records, and changes to scan results and subscription data are made only by our servers. No system is perfectly secure, so we cannot guarantee absolute security.

10. Changes to this policy

If we make significant changes we will update the effective date and tell you in the app.

11. Disclaimer

NatureScan’s scores, alerts and estimates are informational, based on AI analysis, and are not a substitute for professional medical, nutritional or dermatological advice. Always consult a qualified professional for health decisions.

Contact

support.naturescan@gmail.com