1. Account and profile information
Continuing as a guest still creates a unique user identifier and session on the server. Guest access does not mean that data stays only on your device or that no data is collected. Email registration/sign-in processes your email address and authentication information. Apple or Google sign-in supplies the identifier, email and, where available, name shared by that provider; your password for that service is not shared with LogicFood.
Your display name, uploaded profile photo, shopping categories, analysis priorities, vegan/vegetarian preferences and selected gluten, lactose, nut or soy sensitivities are stored in the cloud with your profile. Preferences and sensitivities are optional and can be changed in profile settings. Sensitivity selections may reveal health information. They are not medical records and do not provide a personal medical assessment.
2. Lists, history and usage records
Your lists, list contents and memberships; barcode, product and time information about products you open/scan; product contributions and daily usage counters may be associated with your account on the server. These records display your lists and history, enforce access permissions, calculate daily allowances and limit abuse.
Onboarding records step views, skips, completion, errors, durations, platform and session events. A session may later be linked to a user identifier; these event records do not include names, emails or dietary selections. Sharing events contain a share identifier, content kind, originating app section, platform and time. A short share link’s destination and creator identifier are stored separately.
3. Camera, photos and AI text reading
During live barcode scanning, the barcode is decoded on the device and sent to the server for a product lookup. Camera footage is not uploaded just because of that scan. Photo analysis and product contributions work differently: product and label photos you select/take may be sent to the server and stored in contribution storage.
Reading ingredients or nutrition tables from photos and analysing product photos uses the OpenAI API. The relevant label photo, and for product analysis also the front-of-package photo, is sent to OpenAI to extract text. This does not happen solely on your device. Do not include faces, identity documents, addresses, health documents or other people’s personal information in photos. You can use search or barcode lookup without using photo analysis.
4. Who can see your content
List visibility and membership permissions affect other users’ access. Administrators may review submitted product information and photos; verified product records may be shown to other users. Your own photo analysis record does not automatically become an approved shared catalogue entry.
Profile and product contribution photos are served from publicly accessible addresses. Anyone who knows the address may access the image; restrictions on lists or analysis records do not make the image address private. Shared links can be forwarded. Only upload product/packaging images you are authorised to share.
5. Service providers and data transfers
Supabase provides authentication, the database, file storage and server functions. OpenAI performs the photo reading described above. On iOS, RevenueCat uses the LogicFood user identifier, purchase/transaction identifiers, subscription product, entitlement and subscription status to verify Pro access. Apple processes payment; LogicFood does not receive your full payment card details. Choosing Apple or Google sign-in communicates with that provider for authentication.
Cloudflare serves the website. Hosting and other infrastructure services may process IP addresses, request times, device/browser information and error logs to deliver requests and protect the service. Support emails and their contents are processed by the email service. Provider infrastructure may be located abroad, so the relevant data may be processed outside Türkiye. Information may also need to be disclosed to competent authorities in response to legally required requests.
6. Purposes and legal grounds
Account, session, list, lookup and subscription records are considered for providing the service and entering into/performing the contract; abuse prevention and service error records for legitimate interests with regard to your fundamental rights and freedoms; and mandatory legal records for legal obligations and protecting rights. The relevant conditions in Article 5 of Türkiye’s Personal Data Protection Law (KVKK) govern personal data processing.
Sensitivities that constitute health information require a separate processing condition under Article 6 of KVKK. This policy, accepting the terms or granting an operating-system camera permission does not by itself constitute explicit consent to process sensitive data or transfer data abroad. International transfers are also subject to the conditions of Article 9 of KVKK.
7. Device storage and cookies
The website stores your theme preference in the logicfood-theme browser local-storage entry. The current website loads no advertising or visitor analytics scripts and serves fonts from its own domain without connecting to a remote font service. Hosting-provider security and connection processing is separate.
The mobile app may store session information, language/theme/haptic preferences, onboarding and account-upgrade drafts, recent searches and queued events on the device. Uninstalling the app does not delete your cloud account or store subscription. Manage camera, photo and notification permissions in device settings; disabling permissions may limit the corresponding features.
8. Retention and account deletion
Delete your account through the app’s account settings or contact us. Account deletion is designed to remove the authentication account, linked profile/lists, scan history, contribution records, usage and in-app subscription records, plus profile and contribution images in your user folder. A guest account may not be recoverable after signing out.
Account deletion removes user references from onboarding events and created share links; those events and public link destinations may remain. Non-personal product information already incorporated into the shared catalogue may also remain. Copies received by others, infrastructure backups and providers’ transaction/security records may not be removed at the same time as in-app deletion. Mandatory records may be retained while the relevant obligation or dispute requires them. Deleting an account does not cancel an Apple subscription.
9. Your rights and requests
Under Article 11 of KVKK, you may learn whether your data is processed; request information about processing; learn its purpose and whether it is used accordingly; learn the recipients inside/outside Türkiye; request correction of incomplete or inaccurate data; request deletion or destruction when the conditions are met and notification of these actions to recipients; object to an adverse result from solely automated analysis; and seek compensation for damage caused by unlawful processing.
Send requests to [email protected]. Identify the relevant account and explain your request; do not send your password or payment card details. We may request proportionate additional information to verify account ownership. Requests are answered as soon as their nature allows and within the statutory period, no later than 30 days. Your right to complain to the competent data protection authority is preserved.
10. Security
The app uses session verification and user-based access rules. Authorised administrators may access records needed to review product contributions and operate the service. Transmission and storage over the internet cannot be guaranteed to be absolutely secure. Protect access to your account and report suspected security problems to us.
11. Children
LogicFood is not designed specifically for children. If you are below the age at which you can validly create an account and, where applicable, give data processing consent in your country, your legal representative must be involved. Contact us for review and deletion if you believe a child’s data has been processed inappropriately.
12. Policy changes
The date on this page indicates the latest text update. Changes to data use or service providers will be reflected here. Where a new purpose requires separate information or consent, updating this text alone does not fulfil that requirement.