Privacy Policy

Welcome to Toxly, an ingredient analysis application developed by Mindful Code Studio. We recognize that your privacy is of paramount importance. This Privacy Policy outlines the types of information we collect, how we use it, and the steps we take to ensure your personal data remains secure and private.

1. Information We Collect and Process

Toxly is built on a "Privacy by Design" philosophy. We aim to collect the absolute minimum amount of data required to provide our services. We do not require account registration, which means we do not collect your name, email address (unless you contact us), or phone number during app usage.

• Camera Access and Image Data: The core functionality of Toxly requires access to your device's camera. This access is used solely to capture images of product ingredient labels and barcodes for analysis. Text and barcode recognition is performed on-device using Apple's Vision framework. We do not save, store, or transmit raw images or video frames from your camera to any servers.
• Extracted Text: Once text is extracted from an ingredient label, that text is processed to identify individual ingredients. This extracted text, along with any allergy or sensitivity preferences you've set in the app, is the data sent for analysis (see Section 3).
• Anonymous Account Identifier: To authenticate requests to our secure backend and prevent abuse, the app signs you in anonymously using Firebase Authentication. This creates a random identifier for your installation that is not linked to your name, email address, or any other personal information, and requires no sign-up or password.
• Usage Analytics: To improve app performance and user experience, we collect usage statistics through Firebase Analytics, such as app opens, screen views, and general engagement. This data is tied to a pseudonymous, per-install identifier generated by Firebase, not to your real identity.
• Crash and Diagnostic Data: We use Firebase Crashlytics to automatically collect crash logs, stack traces, and basic device diagnostics (such as device model and iOS version) when the app encounters an error. This helps us find and fix bugs quickly.
• Device Information: We may collect non-identifying technical data such as your device model, iOS version, and language settings.

2. How We Use Your Information

The information we handle is used for the following specific purposes:

• Ingredient Analysis: To provide you with immediate feedback on the safety and health impact of ingredients found in scanned products. This involves comparing extracted text against known databases and utilizing AI for deeper insights, including flagging ingredients against any allergies or sensitivities you've told the app about.
• Local Scan History: To allow you to review past scans, Toxly stores scan results locally on your device. This data remains under your exclusive control and is not synced to a central cloud database by us.
• Optional Cloud Backup: Premium subscribers can optionally back up their scan history to their own Google Drive account. This feature is off by default, requires you to sign in with Google, and only ever writes to a private, app-specific folder in your personal Drive — Toxly does not have general access to your Drive, and your scan history is never uploaded to a server we control.
• App Optimization: Analytics and crash data help us identify bugs, understand which features are most useful, and optimize the user interface for different devices.
• Monetization: For users of the free version of the app, we use third-party advertising services to serve ads. We do not show the App Tracking Transparency prompt because we do not track you across other companies' apps and websites, so ads shown are not personalized based on your activity elsewhere.

3. Third-Party Services and Data Sharing

While we strive to keep as much processing on-device as possible, Toxly utilizes several high-quality third-party services for specific features. These providers have their own privacy policies governing how they handle data:

• Apple Vision Framework: Text and barcode recognition happens entirely on your device using Apple's built-in Vision framework. No images are transmitted off-device for this purpose.
• AI Providers: For ingredient risk assessment and AI-powered explanations, the extracted ingredient text (and your allergy/sensitivity preferences, if set) is sent through our own secure backend to one of several AI providers (including Anthropic, Google, and others) for analysis. This data does not contain your name, email, or image data — only the anonymous identifier described in Section 1.
• Google AdMob: We use AdMob to serve advertisements to free-tier users. AdMob may use device-level signals to serve and measure non-personalized ads.
• Apple App Store Billing (StoreKit): Purchases of Toxly Premium are handled securely by Apple through the App Store. We never see or store your credit card or bank details; that information is handled entirely by Apple.
• Google Sign-In and Google Drive: Only if you choose to enable optional cloud backup (Section 2), we use Google Sign-In to authenticate you and Google Drive's app-scoped storage to save your backup file to your own account.
• Firebase (Google): Firebase powers our anonymous authentication, analytics, crash reporting, and app configuration, as described in Section 1.
• Open Food Facts / Open Beauty Facts: We may query these public product databases to retrieve product information based on barcodes. These queries do not include any personal identifiers.

4. Data Retention and Deletion

Because Toxly does not use central user accounts, your data is primarily stored on your physical device. We retain aggregated, pseudonymous analytics and crash data for as long as reasonably needed to improve the app. Regarding your personal data:

• Local Data: You can delete your entire scan history at any time through the app settings or by deleting the app from your device.
• Cloud Backup: If you've enabled optional Google Drive backup, you can disconnect it at any time from Settings, and you can delete the backup file directly from your Google Drive.
• App Uninstallation: Uninstalling the app will remove all locally stored data from your device.

5. Security Measures

We implement a variety of security measures to maintain the safety of your information. Data handled by the app is protected by iOS's built-in security features, including application sandboxing, and encrypted network connections to our backend and third-party services. While no method of electronic transmission or storage is 100% secure, we follow industry best practices to protect your data during the brief window it is processed.

6. Children's Privacy

Toxly is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete such information from our records immediately.

7. Changes to This Privacy Policy

We may update our Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new policy within the app or on our official distribution channels.