Privacy Policy

01Who we are

Nafroo is an app that checks food labels and dishes against your food profile and helps you keep track of what you eat. Nafroo is an independent app based in Singapore. In this policy, “Nafroo”, “we” and “us” mean the team that runs the Nafroo app and this website. We decide how your personal data is used, and we are responsible for it.

This policy covers the Nafroo app (in early access on Android) and the website nafroo.com. If you have a question or a request about your data, write to support@nafroo.com.

02What we collect

Your account

• If you sign in with Google: your name, email address and a link to your Google profile photo (we don’t copy the photo itself), and the fact that you signed in with Google.
• If you sign in with email: your email address and password. We store the password only as a one-way scrambled hash (bcrypt), never as readable text. We email you a 6-digit code to confirm it’s you.
• While a new email sign-up waits for its code: we hold your email address, the hashed password and a hashed copy of the code for up to 15 minutes. Your account is created only when you enter the right code, and the waiting sign-up is then deleted. Sign-ups that expire are deleted later.
• Your plan: whether you have no plan, a free trial, Standard or Premium, and when a trial ends.

Your food profile

Your food profile tells Nafroo what to check for. It can include the diet you follow, foods you avoid, allergies, intolerances, triggers, health concerns and nutrition goals, plus ingredients you add yourself and your own custom questions.

Some of these choices can say something sensitive about you, for example a diet linked to your faith, or a health condition such as diabetes. We treat this as sensitive information. We use it only to check food for you, and only you decide what goes in your profile. You can change or remove any choice at any time.

Family profiles

On Premium and during the free trial, you can add up to 4 family members. For each one we store a name (up to 40 characters) and their food profile choices. Family members don’t have their own account. When you scan for someone, the saved scan keeps their name, even if you remove that family member later, until you delete the scan. Only add someone if you are allowed to share their details, for example as their parent or guardian.

Scans and history

Each scan saves the photo (see Scan photos) and the result: product name, brand, score, verdict, the full AI analysis, a copy of the food profile it was checked against, who it was checked for, whether you marked it as a favourite, and when you scanned it. While a scan is running, we keep a temporary record of its progress, which is deleted once the app has collected the result.

Calorie tracking (optional)

If you turn on calorie tracking, we store what you tell us to set your goals: gender (male, female or not specified), date of birth, height, current and target weight, physique goal, weekly pace, how often you work out, your units, and your daily calorie, carb, fat, protein and water targets. We keep a history of changes to these settings.

We also store what you log. For each food entry: the date and time, the meal, the food name, calories, carbs, fat and protein, how much you ate, whether it came from a scan, and a link to that scan. For water: how much you drank each day. Your answers to the “motivation” questions during set-up are not saved.

Usage, badges and messages

• Daily counts of how many scans and AI estimates you make.
• The badges you earn and when, including badges our team gives you.
• Messages our team sends you in the app (title, text, when it was sent and when you read it), messages we send to everyone, and whether you dismissed them.

Sign-in and device information

• Our hosting provider’s sign-in service records the IP address and device details (the “user agent”) of your sign-in sessions. From these, our admins can see your type of device (for example Android or iPhone) and when it was last used.
• To keep your account signed in on one device at a time, we store the ID of your current session.
• To protect sign-in from abuse, we count wrong password attempts for each email address and sign-in requests from each IP address.

Kept on your phone only

Your language, theme, sound and other settings, the food facts you’ve seen and similar counters stay on your device. Your sign-in token is stored on the device, and Android backup is turned off for the app. Your chosen language is sent with each scan, estimate and translation request so that results come back in your language.

What we don’t collect

The app has no analytics, advertising, attribution or crash-reporting tools. We don’t take payments yet, so we hold no card or bank details. When payments arrive, they will go through Google Play or the App Store, and we will update this policy first.

03Scan photos

• When you scan, the app uploads the photo from your camera or gallery. Gallery photos are reduced to at most 1,200 pixels. The in-app camera does not record sound.
• Photos are stored privately, in a folder that belongs to your account. The app shows them through links that expire.
• A photo file can carry hidden details (metadata), such as when it was taken and, if your camera saves it, where. Nafroo removes these details only from larger photos (over about 450 KB) that it shrinks before upload. Smaller photos are sent and stored as they are. If you don’t want location details in your photos, turn off location tagging in your camera settings.
• Each scan photo is also sent to Google Gemini and SerpApi to analyse the food (see AI and image search).
• Photos from scans that failed, or that weren’t recognised as food, also stay in your private folder. “Clear scan history” in the app doesn’t remove these yet. They are deleted when your account is deleted, or sooner if you ask us.

04Approximate location

• After you sign in, the app asks for permission to use your approximate location (Android’s “approximate” setting, not precise GPS).
• If you allow it, we save your position rounded to 2 decimal places (about 1.1 km), your phone’s time zone and when it was saved. The app may update it when it starts.
• If you don’t allow it, we save only your time zone.
• Only Nafroo admins can see it, on an account page in our admin tools, so our team can see roughly where an account is used. We don’t use it to analyse your food, and we don’t send it to AI or search services.
• You can turn off location permission for Nafroo in your phone settings at any time. To remove a location we have already saved, email support@nafroo.com.

05How we use your information

• To create your account, sign you in, keep it secure and send you sign-in codes.
• To check the foods you scan against your food profile, or a family member’s, and explain the result.
• To save your scan history, calorie and water logs and goals, and work out your daily targets.
• To estimate nutrition from a description you type.
• To run your plan and free trial.
• To show badges and celebrations.
• To answer your messages and send you messages in the app.
• To prevent abuse, fix problems and keep Nafroo running.
• To translate the app’s own built-in text into your language.

We don’t use your information for advertising, and we don’t sell it.

Where the law asks us to have a reason (a “legal basis”) for using personal data, we rely on: what we need to provide the app you asked for; your consent, for example for approximate location and for sensitive food profile choices, which you can withdraw at any time; our legitimate interest in keeping Nafroo safe and working; and our legal obligations.

Google user data

If you sign in with Google, Nafroo receives only your name, email address and profile photo link (Google’s basic “openid”, “email” and “profile” permissions). We use them only to create your account, sign you in and show your name and photo in the app. We keep them with your account in our database (Supabase, in Singapore) until you delete your account. We don’t sell them, use them for advertising or share them with anyone other than the providers that run Nafroo (see Who we share it with).

Nafroo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

06AI and image search

Nafroo uses outside services to read labels and recognise food. They receive only what they need for the task, and never your name, email address or account ID.

When you scan

• Google Gemini (through Google Cloud Vertex AI, with the Google AI Studio Gemini API as a backup) receives the photo and, to check it, the food profile choices of the person you’re scanning for, ingredients you added, your custom questions (Premium), your language, and a default region (currently Singapore). Some steps let Gemini use Google Search and read web pages to check facts about the product.
• SerpApi receives the photo and a default country code (currently Singapore), and runs a Google Lens image search to find matching products. We use the results only as evidence for the analysis. This means the photo also reaches Google Lens through SerpApi.

When you use “Estimate with AI”

• Google Gemini receives the description you type and your language.

When the app is translated

• To show the app in your language, we send the app’s own built-in English text to Google Gemini. No personal data is included.

These providers process the data to return a result to us, under their own terms. When our backup Gemini service is used, Google may keep this content and use it to improve its products, and people at Google may review it.

AI can be wrong, so always check the pack yourself.

07Who we share it with

We share personal data only with the service providers below, to run Nafroo.

• Supabase

  Runs our database, sign-in, file storage, server functions and live updates, in Singapore.

  What it handles

  All the data described in this policy.

• Google Gemini

  Through Google Cloud Vertex AI and Google AI Studio. Analyses scans, estimates nutrition from text and translates the app’s text.

  What it handles

  Scan photos, food profile choices, added ingredients and custom questions, a default region, your language, and text you type for estimates.

• SerpApi

  Runs a Google Lens image search for each scan.

  What it handles

  Scan photos and a default country code.

• Resend

  Sends sign-in, sign-up and password reset codes by email.

  What it handles

  Your email address and the content of the email.

• Google Sign-In

  Lets you sign in with your Google account, if you choose to. Google’s own privacy policy applies to your Google account.

  What it handles

  Google shares your name, email address and profile photo link with us.

• Cloudflare

  Hosts this website and forwards emails sent to support@nafroo.com.

  What it handles

  Technical data from website visits, such as IP address, and the emails you send us.

• Gmail

  Our support inbox, which receives emails forwarded from support@nafroo.com.

  What it handles

  The emails you send us.

Other times your data leaves Nafroo

• Websites you open: when you open a source link in the app, the website loads inside the app and receives the usual information any website gets, such as your IP address.
• Things you share: if you save a result card to your gallery or share it, it goes where you choose.
• Legal reasons: we may disclose information if the law requires it, or to protect the safety and rights of our users, the public or Nafroo.
• If Nafroo changes hands: if Nafroo is merged or sold, your information may pass to the new owner under this policy, and we will tell you before that happens.

08What the Nafroo team can see

A small number of Nafroo admins can open an account to give support and run the service. They can see the profile, food profile, scan history with photos, plan, messages, last sign-in, type of device, approximate location and badges. Our admin tools don’t show body details, calorie and water logs or family profiles.

Every change an admin makes is recorded in a log with the admin’s email address and the email address of the account involved.

The people who maintain Nafroo’s database can technically reach all the data described in this policy. They use that access only when it is needed to run, fix or secure the service.

09Where your data is stored

Our main database and file storage are run by Supabase in Singapore. Our other providers (Google, SerpApi, Resend and Cloudflare) may process data in other countries, including the United States. Those countries may have different data protection laws from the place where you live. We share with each provider only what it needs for its task, as listed in Who we share it with.

10How long we keep it

• Your account, food profile, family profiles, scans, photos, logs and goals: for as long as you have an account, until you delete them or we delete your account. There is no automatic time limit.
• Email sign-ups waiting for a code: they expire after 15 minutes and are deleted later.
• Temporary scan records: deleted once the app has collected the result.
• Calorie entries from a scan: stay if you delete that scan; only the link to the scan is removed. Saved scans keep the name of the family member they were checked for.
• Photos from failed or non-food scans: until your account is deleted, or sooner if you ask us.
• Sign-in protection records (wrong password counts by email address, and sign-in request counts by IP address): used to stop abuse, and deleted automatically within 30 days.
• Our admin log: records of actions our team took on an account (for example plans given, messages sent, scans removed with the product name, and account deletions), with the email address of the account involved and the date. We keep them for 2 years as proof of what was done, then delete them.
• Dismissed announcements: after your account is deleted, the record of which team-wide messages you dismissed is linked only to an account ID that no longer exists, and is deleted within 30 days.
• Backups and logs: copies in Supabase’s backups and logs, and email logs at Resend, are deleted automatically within 30 days. Data sent to Google and SerpApi for analysis is handled under their own terms (see AI and image search).

11Deleting your data and account

In the app, you can delete a single scan (with its photo), clear your whole scan history from your Profile, delete calorie and water entries, and remove family profiles.

The app doesn’t have a delete-account button yet. To delete your account, follow the steps on our Delete my account page: email support@nafroo.com from the email address you sign in with. We will confirm your request and delete your account within 30 days.

Deleting your account removes your sign-in details, profile, food profile, family profiles, scans and all scan photos, logs, goals, location, badges, plan and messages. A few records stay, as listed in How long we keep it. Signing out or uninstalling the app does not delete your account.

12How we protect it

• Our database lets each account reach only its own data. Sensitive tables, such as passwords and sign-in records, can be reached only by our server functions.
• Passwords and sign-up codes are stored as bcrypt hashes, never as readable text.
• Scan photos are stored privately and shown only through links that expire.
• The app talks to our servers over encrypted connections (HTTPS).

No system is perfectly secure. If you think your account or data is at risk, email support@nafroo.com straight away.

13Children

Nafroo is not directed to children under 13, and children under 13 should not create an account. We don’t check age when you sign up. If you believe a child under 13 has given us personal data, email support@nafroo.com and we will delete it. If the law where you live sets a higher age for using apps like Nafroo on your own, you need permission from a parent or guardian.

Parents and guardians can add a child as a family profile to check food for them. That profile is part of the parent’s account, and the parent controls it.

14Your choices and rights

Depending on where you live, you may have the right to:

• see the personal data we hold about you, and get a copy;
• correct it (you can change most of it in the app yourself);
• delete it, or your whole account;
• withdraw your consent, for example by turning off location permission or removing sensitive choices from your food profile (this doesn’t affect what we did before);
• object to, or ask us to limit, how we use it;
• get your data in a format you can take elsewhere.

To make a request, email support@nafroo.com from the email address on your account. We may need to confirm it’s you. We aim to reply within 30 days. If you’re not happy with our answer, you can complain to the data protection authority where you live.

15This website

nafroo.com describes the app. It has no sign-in, and it doesn’t use cookies, analytics or advertising tools. It is hosted by Cloudflare, which handles technical data such as your IP address to deliver the pages and protect the site. The pages load fonts from Google Fonts, so your browser also connects to Google.

If you email us using a link on this site, we receive your email address and message and use them to reply. If you ask for early access, we use the Gmail address you send to invite you to test Nafroo through Google Play, which means adding it to our tester list in the Google Play Console. You can ask us to remove it at any time.

16Changes to this policy

We will update this policy as Nafroo changes, and change the date at the top. If a change matters, we will tell you in the app or by email before it takes effect.

17Contact us

For questions or requests about your data, email support@nafroo.com.