Privacy Policy

Summary: LabelCue does not need an account. Label photos, the text read from labels and your allergy profiles (including family members’ profiles) stay on your phone. The server only receives barcodes to look up products, problem reports you choose to send (with a label photo only if you turn that on) and — if you turn it on — anonymous usage statistics.

1. Who is responsible

Privacy contact: support@labelcue.app.

2. Data that stays on your device

• Allergy profiles for you and your family (the names you give them, allergen groups, ingredients to avoid): stored on your device; the profile file is encrypted (Android: the app’s encrypted storage; iPhone: iOS Data Protection) and is not included in iCloud backups.
• Label photos and the text read from them: text recognition and matching against your profile run on your phone. Photos are not sent anywhere unless you turn on “Attach label photo” yourself when reporting a problem (see below).
• Scan history, calendar, stats and the list of products you are watching for recipe changes: stored on your device.
• Allergy card: the card image is only saved to your photo library or shared when you tap “Save image”/“Share”. On iPhone, the app only asks for permission to add photos; it does not read your photo library.

You can delete all of this data in Profile → “Delete all data on this device”, or by uninstalling the app.

3. Data sent to LabelCue’s server

• Barcodes, when you scan or type in a barcode and when the app re-checks the products you are watching for recipe changes (about once a day; on iPhone the operating system decides when this runs, so it may happen less often), to look up product information (source: Open Food Facts), together with your device’s country code so that suitable data can be chosen. Your allergy profile is not included.
• Anonymous installation ID: a random code created when you install the app, used to limit request rates and prevent abuse. The server only stores a hash of this code in its rate counter, and does not store it with problem reports or usage statistics.
• IP address of the connection (present in every network request): used only in the temporary rate counter of our infrastructure provider (Cloudflare) to block bursts of requests. LabelCue does not store IP addresses in its database, does not log individual requests and does not store IP addresses with problem reports or usage statistics.
• Problem reports: when you tap “Report”: the type of problem, the allergen group involved (if any), the barcode (if any), the rule set version and any note you write yourself. Label text is not sent. A label photo is only sent if you turn on “Attach label photo” (off by default) for that particular report: a scaled-down image of the ingredients section you just photographed, used only to fix label-reading errors and automatically deleted from the server after 90 days.
• Rule set updates: the app downloads the latest version of the allergen detection rules.

The app looks up barcodes only through LabelCue’s server (since version 1.0.1). The server queries Open Food Facts itself, so Open Food Facts receives only the barcode, not your device’s IP address or installation ID. When the server cannot be reached, the app tells you it has no connection instead of contacting anywhere else.

4. Usage statistics and crash reports (can be turned off)

If you turn on “Send anonymous statistics” in Profile, the app sends the following to LabelCue’s server (not through any third-party service):

• Usage statistics: event names (for example “app opened”, “scan result received”, “LabelCue Plus page opened”) with brief details such as the result status or the number of matches, the app version, the Android version (the iPhone version does not send the iOS version) and the country (based on the region set on your device). They include a random statistics ID, separate from the installation ID, which is renewed when you turn statistics off or delete your data.
• Crash reports: when the app stops unexpectedly: the type of error and where in the code it occurred, and the app version (plus the Android version on Android). They do not include the text of the error message or the statistics ID.

Usage statistics and crash reports never contain photos, label text, barcodes or allergy profiles. Default: off if your device is in the European Union, the EEA, the United Kingdom or Switzerland; on everywhere else. You can change this at any time in Profile; when you turn it off, any data on the device that has not yet been sent is deleted.

5. LabelCue Plus (paid plan)

Payments are handled by Google Play (Android) or the App Store (iPhone); LabelCue does not receive your card details or your Apple ID / Google account. To check whether you are entitled to use Plus, the app uses the RevenueCat service with an anonymous user ID created by RevenueCat; RevenueCat receives your purchase history (plan, purchase date, expiry date) from Google Play or the App Store. No allergy profile or scan data is sent to RevenueCat.

6. Notifications

If you watch a product for recipe changes and allow notifications (the app only asks for notification permission when you tap “Watch for changes”), the app checks on your device and shows a notification when new ingredients touch your profile. The notification content is created on the device.

7. What we do not do

• We do not require an account, email address or phone number.
• We do not sell data, do not use data for advertising and do not use advertising SDKs.
• We do not take your allergy profile off your phone.

8. Retention

Data on your device: until you delete it. Problem reports, usage statistics and crash reports on the server: up to 12 months, then deleted. The cache of product information by barcode contains no personal data.

9. Your rights

You have the right to ask to see or delete data you have sent, by writing to support@labelcue.app. Because data on the server is not linked to a name or an account, please describe it so that we can find it (for example, the approximate date and time and the barcode of a problem report). You can delete the data on your device yourself straight away in Profile → “Delete all data on this device”; this also creates a new installation ID. You can also turn off “Send anonymous statistics” at any time.

10. Children

Parents may use LabelCue to read labels for their children and to create profiles for their children on the device. The app does not collect identifying data about anyone, including children.

11. Changes to this policy

When this policy changes, we update the date at the top of this page and, if the change is significant, let you know in the app.