Edibles — Privacy Policy
Edibles checks food labels. To look a product up, it sends the product's barcode (or the name you search for) to public food databases. It sends nothing about you: no account, no name, no diet, no allergies, no location.
What leaves your phone
| Sent | To | Why |
|---|---|---|
| Barcode or search words | Open Food Facts (and its sister databases for beauty, pet food and other products), France; their images are served from Amazon Web Services | Product name, ingredients, nutrition and photos |
| Barcode or search words | USDA FoodData Central, USA | Nutrition data for US products |
| Barcode | UPCitemdb, USA | Product name when the other databases don't know it |
| Barcode or search words, with your own key | Edamam, USA — only if you add an Edamam key in Settings | Extra product data |
| A request for a language pack | Google, when you first translate ingredients into a language | Downloads the offline translation model; the ingredient text itself is translated on the phone |
Like any website you visit, these services see your phone's IP address when it connects. Their own privacy policies apply. The US services are outside the EU; only product codes and search words are sent to them, never data about you. Connections are encrypted (HTTPS). Edibles never uploads anything to these databases for you.
What stays on your phone
- Your scan history, the "scan later" list and results.
- Your diets, allergies and household profiles. These can be sensitive, so they never leave the phone — the verdict is worked out on the phone. (With sync turned on they go, sealed, to your own other phone.)
- Photos of labels: the text is read on the phone by Google's ML Kit (offline). Photos are not uploaded.
- Backup files you create are saved where you choose. Edibles does not use Android's automatic Google backup.
Permissions
- Camera — to scan barcodes and labels, only while the scanner is open.
- Internet — for the product look-ups above.
- Bluetooth, nearby devices, location — only for "Sync with a phone nearby", see below.
No tracking
No analytics, no accounts, no data sale.
Sync between your phones (optional)
If you turn on sync, Edibles moves your data between your own phones, never through a server of ours. There are two ways: phone to phone nearby (Bluetooth and Wi-Fi, through Google Play services' Nearby Connections, on the phones), or a sync file you pick in your own cloud storage. Everything that leaves a phone is sealed with the pairing code your phones share (AES-256-GCM encryption), so the cloud service and anyone nearby see only scrambled data. The pairing code stays on your phones and is left out of backups. What a phone announces nearby is not personal: a one-way group name and a random device ID. For nearby sync, Android asks for Bluetooth, nearby-devices and (on older Android versions) location permission, only when you tap "Sync with a phone nearby", because Android requires them to find devices; the app never reads your location.
Problem reports and email
If the app crashes, a report (the error and your phone model, no personal content) is kept on your phone. It is only sent if you choose to send it — by email, from your own email app. If you write to us, we use your email only to answer you and delete it when the matter is closed, unless the law requires us to keep it.
Children
Edibles is not directed at children under 13.
Changes
If the app starts to collect or send anything new — for example when optional purchases are added — this page is updated first, and the date below changes. Material changes are also mentioned in the app's release notes.
Your rights
Under the GDPR you may ask what data about you we hold, have it corrected or deleted, restrict or object to its use, and receive it in a portable form. Because these apps keep your data on your phone and we receive none of it, you can exercise most of these rights yourself: view, edit, export or delete the data in the app, or uninstall the app, which deletes it. For anything else, write to support@khuntslab.net. You may also complain to a data protection supervisory authority, for example the one where you live.
Who is responsible
Khunt's Lab, [Your full legal name]. Email: support@khuntslab.net. Postal address: see the Imprint.
Effective 24 September 2026. Privacy policy for the website and payments · Imprint.