Privacy Policy

Account Information: When you create an account, we collect your email address via Google Firebase Authentication. If you sign in with Google, we receive your email and display name from Google.

Scan History: When you scan a product, we store the product name, ingredient list, AI analysis results, and safety score associated with your account.

Health Profile: Flags you voluntarily set in your health profile (e.g., pregnancy, thyroid condition, hormone sensitivity) are stored to personalize your scan results. These flags are entirely optional and user-controlled.

Product Images: Photos you take of ingredient labels are temporarily uploaded to Azure Blob Storage for analysis. They are permanently deleted within 24 hours of upload.

Usage Analytics: We collect anonymized usage data (screens visited, features used, error events) via Azure Application Insights. This data is not linked to your identity.

Crash Diagnostics: When the App crashes or encounters an unhandled error, we collect a crash stack trace, your device model, OS version, App version, and an anonymized installation identifier via Firebase Crashlytics. If you are signed in, the report is correlated with your Firebase user ID so we can follow up if needed. Crash collection is disabled in non-production builds. You can clear all crash reports associated with your account by deleting your account.

Push Notification Token: If you opt in to weekly digest notifications, we store a Firebase Cloud Messaging device token so we can send those notifications. You can disable in Settings → Notifications at any time.

Subscription State: If you purchase ToxScan Premium, your subscription status, product identifier, and renewal/expiry timestamps are processed by RevenueCat under their privacy policy and stored against your account.

We use collected information to:

• Provide and improve the ingredient analysis service
• Personalize scan results based on your health profile
• Maintain your scan history so you can reference past results
• Diagnose technical issues and improve App reliability
• Send transactional communications (account confirmation, password reset)
• Comply with legal obligations

We do not use your data for advertising, do not build advertising profiles, and do not sell your data to third parties.

Your data is processed and stored using the following infrastructure:

• Google Firebase: Authentication and account management. Governed by Google's Privacy Policy.
• Microsoft Azure PostgreSQL: Scan history and user profile data, stored in the US East region.
• Azure Blob Storage: Temporary product image storage. Images deleted within 24 hours.
• Azure OpenAI Service: Ingredient analysis AI. Input data (ingredient lists) is processed per Microsoft's data processing terms and is not used to train OpenAI models.
• Azure Application Insights: Anonymized usage analytics.
• Firebase Crashlytics: Crash diagnostics and non-fatal error reporting. Governed by Google's Privacy Policy.
• Firebase Cloud Messaging: Push notification delivery. Governed by Google's Privacy Policy.
• RevenueCat: Subscription state and purchase history. Governed by RevenueCat's Privacy Policy.

We do not sell, rent, or trade your personal information. We may share data only:

• With service providers listed above who process data on our behalf under appropriate data processing agreements
• When required by law, such as in response to a valid court order, subpoena, or government request
• In a business transfer, if ToxScan is acquired or merges, your data may be transferred as a business asset (we will notify you prior to any such transfer)
• To protect rights, if we believe disclosure is necessary to enforce our Terms or protect the safety of users or others

Scan history is retained for 2 years from the date of each scan, after which it is automatically and permanently deleted.

Account data (email, health profile) is retained until you delete your account.

Product images are deleted within 24 hours of upload.

Anonymized analytics may be retained for up to 90 days.

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data via your in-app profile settings
• Delete your account and all associated data via the Profile screen in the App, or by emailing info@explorebetterpath.com
• Export your scan history by contacting us at info@explorebetterpath.com
• Opt out of analytics collection (iOS: Limit Ad Tracking; Android: Opt out of Ads Personalization)

In-app account deletion is processed immediately. Email-initiated deletion requests are processed within 7 days. We may retain certain data as required by law.

ToxScan is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us at info@explorebetterpath.com and we will delete it promptly.

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS 1.2+) and at rest, access controls, and regular security reviews. No system is perfectly secure; in the event of a data breach that affects your rights or freedoms, we will notify you as required by applicable law.

Our infrastructure is primarily located in the United States. If you access ToxScan from outside the US, your data will be transferred to and processed in the US. By using the App, you consent to this transfer.

We may update this Privacy Policy from time to time. We will post the updated policy in the App with a revised "Last updated" date. For material changes, we will provide notice via the App or email. Continued use of the App after the effective date constitutes acceptance.

For privacy questions, data requests, or concerns, contact us at:

• Email: info@explorebetterpath.com

We aim to respond to all privacy inquiries within 5 business days.