Privacy Policy

What we collect and why.

• Your setup answers — allergen selections, ingredients to avoid, dietary patterns, nutrition priorities, health choices (the goals and stances you pick so the score weighs what matters to you — never a diagnosis, and Aware never gives medical advice), the people in your household (first names, age groups and the same choices you enter for them), ZIP code, and the stores you name — exist to personalise scans and alerts.
• Your activity — scan history, pantry items, shopping list, saved alerts — exists so Aware can re-check what you already bought when official records change.
• Your account — an email address, or an Apple or Google identifier, when you choose to sign in — exists to back your data up and restore it. A guest account has no email.
• Subscription status comes from Apple through our purchases processor (RevenueCat). We never see your payment card.
• What you log in Health — the foods, calories, protein and added sugar you log, your weigh-ins, and the height, age, sex, activity level and goal you may enter — exists to show your own numbers back to you. It is stored on your phone only. It is not backed up to an account, not sent to Aware and not part of any usage data. It leaves your phone only if you export your data yourself. The targets it shows are estimates for general guidance, not medical advice.
• What Aware writes and reads for you with AI. To write the "Aware says" paragraph on a result, the facts about the product are sent to Aware's server and on to an AI model provider, which puts them into words: its ingredients, its Nutrition Facts, the allergens printed on its label, its category and the reasons behind its score. Nothing about you or your household is sent for this: no first name, no household size, no allergen anyone avoids, no diet, no goal, no weight and no account. The sentences about your own household ("Maya should skip this one") are put together on your phone, from a version of the paragraph that names nobody. That version is kept on Aware's server for up to 30 days under a code made from the product alone, so the next person who scans the same product gets the same words. When you photograph a label or a food so Aware can read it, the photo is sent to Aware's server and passed to the AI model provider to be read; Aware does not keep that photo unless you choose to send it for review (see "Photos you send"). A random install ID travels with photo requests and is used only to limit how many can be made in a day; for "Aware says" a code that changes every day is used instead.
• Notifications — if you allow them, your phone's push token, a random install ID, your US state (worked out from your ZIP code) and whether you have Aware+ are stored on Aware's database, so a recall alert for your state can be sent to your phone. Recall alerts are part of Aware+: the record is made when you subscribe and switched off when a subscription ends. Alerts are delivered through Expo's push service and Apple's. Which allergens you watch is never sent for this: that part of an alert is added on your phone. Turning notifications off, or deleting your data, removes this record.
• Anonymous usage data — counts of which screens and buttons get used, and of errors — exists to fix problems and to see what is confusing. Each count carries a random ID made on your phone for this purpose only, the app version, your country, and whether you have Aware+. It never carries your name, email, account, allergens, health choices, household, weight, anything you log in Health, your location, your ZIP code, or anything you type, and it carries no advertising identifier. One exception: when you scan a product Aware does not have, its barcode is sent so the product can be added. This data goes to Aware's own database (Supabase, United States), not to an analytics company, and is deleted after 13 months. You can turn it off, or get a new random ID, in Settings → Privacy and data.
• Feedback you send. When you use "Tell us" to report a problem, a wrong product or an idea, Aware receives what you typed and the kind of feedback you chose, and with it the app build, your iOS version and your phone model, so the problem can be found. For a report about a product, its barcode and name are sent too. Your email address is sent only if you type it in because you want a reply, and it is used only to reply to you. A screenshot is sent only if you add one. Your household, allergens, health choices, goals, weight and anything you log in Health are not sent with feedback; please do not type health details into it. Feedback is filed under a code made from your phone's random install ID, not under your name or account; the code is used to limit how many can be sent in a day and to delete your feedback when you delete your data. A person at Aware reads it. It is stored on Aware's own database (Supabase, United States), never shown to other people using Aware, and kept until it is no longer needed to fix the problem or until you delete it.
• App Store ratings. Aware may sometimes show Apple's own rating prompt. The prompt is Apple's: Aware does not see whether you rated, what you chose or what you wrote. Aware keeps a count on your phone of when the prompt was last requested, so it is not shown often.

Services that see some of your data to do their job.

• Supabase — hosts Aware's database and server functions, including your account and backup if you make one (United States).
• An AI model provider (Anthropic, United States) — receives the product facts for an "Aware says" paragraph and the label or food photos you ask Aware to read, as described above. It receives no name, no household detail, no allergen you avoid, no diet, no goal, no account and no email.
• Expo — delivers push notifications to Apple for Aware, and delivers app updates. It receives your push token and the alert's text; for updates, the app version.
• Apple and RevenueCat — process subscriptions. RevenueCat receives a random install ID and your purchase status, never your name or card.
• Google Maps Platform — receives your ZIP code or map position to find grocery stores, and returns store details and photos.
• OpenStreetMap (the public Overpass service) — receives the map position when Google cannot answer, to find grocery stores. It receives nothing about who you are.
• Open Food Facts — receives the barcode you scan, to look up the product's label and picture.
• Aware's photo service (on Supabase) and UPCitemdb — receive the barcode you scan, or the name of a recalled product, to look up a picture of it; the photo service may pass the barcode on to Kroger's product catalogue. None of them receives who you are.
• Google's favicon service and Clearbit's logo service — receive a store chain's website address (for example the chain's own .com) to fetch its logo for the map. They receive nothing about you.
• Google Programmable Search — receives the name of a recalled product, to find a picture for the recall card. It never receives a barcode you scanned or anything about you.
• openFDA, FDA.gov, USDA FSIS and USDA FoodData Central — public government sources; Aware reads recall records, announcements and label data from them. When a product is not in Aware's catalog, the barcode you scanned may be sent to USDA FoodData Central to look it up. Nothing about who you are is sent.
• Resend — delivers sign-in codes to your email address.