Privacy policy

On this page

The short version

Who we are

GoodSwap is published by Invikta Technology Ltd, registered in England and Wales (company no. 15228536), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom (“GoodSwap”, “we”, “us”). We are the controller of the personal data described here. You can reach us at contact@goodswap.app.

What stays on your phone

These never leave your device in the current version of GoodSwap:

• your scan history, the products you have at home and your lists;
• household profiles: names, emoji, allergies, diets, avoid lists, pregnancy and child settings;
• the lenses you choose, and every personal verdict (“Fits”, “Things to know”, “Not for you”), which your phone computes itself;
• camera images while you scan barcodes and use Label Lens, unless you tap Analyze on a product we don’t know.

GoodSwap doesn’t upload or sync this data to our servers. On iPhone it is part of your own encrypted iPhone or iCloud backup, like other app data; the offline product packs are left out of backups because they can be downloaded again. On Android, GoodSwap opts out of Android backups, so this data stays on your phone only. If you delete the app, the data on your phone is deleted with it.

To take a copy with you, use You → Privacy → Export my data: the app creates a JSON file of everything it stores on your phone, and you choose where to share it.

What leaves your phone

Only the following, for these reasons, and for no longer than shown. None of it is used for advertising.

Data	Why	Where it goes	How long we keep it
A random install ID and an anonymous account ID	Rate limits, and checking whether you have GoodSwap Pro	Our server (United States)	Until you delete your account
Barcodes looked up online (only for products that aren’t in your offline pack)	To send you the product	Our servers, through Cloudflare	Only as aggregated counts. We keep no per-person scan log
Photos of a product’s label (only when you tap Analyze)	To read a product we don’t know yet, with AI	Our servers, then OpenAI, named on the consent screen	Photos are deleted after 30 days. The product facts read from them are kept as product data, not linked to you
Ingredient-list text, only from the GoodSwap website or Android app when you ask us to score a label. The iPhone app scores label text on your phone	To score the label	Our servers only. No AI provider sees it	Not stored or logged
Purchase status	To unlock GoodSwap Pro	Apple (iPhone) or Google Play (Android), then RevenueCat, then our servers	While you’re subscribed, plus 1 year
App events: screens viewed, scans that worked or failed, steps of the subscription screen. Never health or profile data	To improve the app	Our servers	90 days
Usage statistics from the Android app (from version 1.0.1), through Google Analytics for Firebase: screens and app events, the app version, the phone model and system version, a random app-instance ID, and an approximate location (country or region) that Google derives from the IP address. Advertising features and the advertising ID are off. Never health, profile or scan contents	To count active users and see which features people use	Google (Firebase), as our service provider	14 months
Crash and performance reports from the iPhone app (Apple MetricKit). The Android app sends none	To fix crashes	Our servers	90 days
Your email address (only if you use Sign in with Apple on iPhone and choose to share it)	To recover your account	Our servers	Until you delete your account
A GoodSwap code you redeem in the Android app (for example a press code), and when	To turn on GoodSwap Pro for the code’s days, without a purchase	Our servers	Until you delete your account
Reports you send, such as “wrong ingredients”	To fix product data	Our servers	2 years

Notifications. Recall alerts, research alerts and trial reminders are local notifications that your phone schedules itself. We don’t collect push tokens today. If we add optional remote notifications later, we’ll update this policy before we do.

Every request to our servers also carries technical details needed to answer it: your app version, your country (your App Store region on iPhone, your phone’s region setting on Android), your language and your IP address. We use these to serve the request, apply rate limits and protect the service, not to identify you.

Recall Radar is private by design

The app downloads the public recall list (the same list for everyone in your country) and compares it, on your phone, with the products you have at home. If one of them is recalled, your phone shows the alert. We never receive that list, and we never learn which recalls matched.

AI and your photos

• When a product isn’t in our database, you can photograph its front and its ingredient list and tap Analyze. Before the first photo is sent, a consent screen names our AI provider: currently OpenAI. If the provider changes, we ask again.
• The AI reads the label (name, brand, ingredients, nutrition). It doesn’t decide scores. Our rules do that.
• We delete the photos after 30 days. The product facts read from them become product data, so the next person who scans that product gets an answer. They aren’t linked to you.
• Please photograph the product only, not people.

Subscriptions and sign-in

• Payments are handled by Apple on iPhone and by Google Play on Android. We never see your card, your Apple ID or your Google account. The store tells our subscription service, RevenueCat, which plan you bought and when it renews or ends, and RevenueCat tells our servers, linked to your anonymous account ID.
• An account is optional. GoodSwap creates an anonymous account automatically. On iPhone, if you choose Sign in with Apple, Apple may share your email address, or a private relay address that forwards to it. We use it only to help you recover your account. The Android app has no sign-in.

This website

• goodswap.app sets no cookies of its own and uses no analytics, ad pixels, third-party scripts or third-party fonts.
• The site is hosted and delivered by Cloudflare, which also protects it. Like any web service, Cloudflare processes your IP address and browser details to deliver pages. We keep no logs of your visits. Cloudflare may set a strictly necessary security cookie (such as __cf_bm or cf_clearance) if it needs to check that a visitor isn’t a bot; it isn’t used for tracking.
• Story pages (/s/…) and product pages (/p/…) load their content from our API at api.goodswap.app. Your browser connects to it directly, and we use that request only to send the page.
• If you email us, we use your address and message to reply, and keep them only as long as needed to handle your request.

Who we share data with

We use a few service providers that process data on our behalf, under contracts that limit them to providing their service to us:

• Cloudflare: hosts this website and our product-photo service, delivers and protects the app’s API, and stores our encrypted backups.
• Our hosting provider: the dedicated server in the United States that runs the app’s API.
• Neo: our email provider, for the messages you send to contact@goodswap.app.
• OpenAI: reads label photos, only when you tap Analyze. Ingredient text sent for scoring never goes to an AI provider.
• RevenueCat: subscription status.
• Apple: App Store purchases and Sign in with Apple, under Apple’s own privacy policy.
• Google: Google Play purchases on Android, under Google’s own privacy policy, and usage statistics from the Android app (Google Analytics for Firebase), as our service provider.

We don’t give data to advertisers or data brokers. We disclose data to authorities only when the law requires it. If GoodSwap is ever sold or merged, this policy would continue to apply to the data collected under it.

No selling, no ads, no tracking

We don’t sell personal information and we don’t “share” it for cross-context behavioral advertising, as California law defines those terms. We don’t show targeted ads, and there’s no App Tracking Transparency prompt in GoodSwap because we don’t track you. Because there is nothing to opt out of, we treat signals like Global Privacy Control as already honored. We don’t use sensitive personal information to infer anything about you; the health-related settings you enter stay on your phone.

Legal bases (EEA and UK)

Under the GDPR and the UK GDPR, we rely on:

• Contract: looking up products, keeping your anonymous account, and giving you the subscription you bought;
• Legitimate interests: keeping the service and this website secure and within rate limits, improving the app with app events, usage statistics and crash reports that contain no health or profile data, counting barcode lookups in aggregate, and fixing product data from your reports. You can object at any time;
• Consent: sending label photos to our AI provider, and receiving your email through Sign in with Apple. You can withdraw consent at any time, without affecting earlier processing;
• Legal obligation: where the law requires us to keep or disclose something.

We don’t process health data (special category data) on our servers: allergies, pregnancy and diet settings stay on your phone.

Your rights and how to use them

Delete everything from the app

In GoodSwap, go to You → Privacy → Delete my data. This erases the data on your phone and deletes your account and the personal data linked to it on our servers; our encrypted backups are kept for up to 35 days, so it is gone from them too after five weeks. Deleting the app alone doesn’t delete your server account, and canceling a subscription is separate: manage it in your iPhone’s Settings, or on Android in Google Play → Payments & subscriptions → Subscriptions.

Get a copy of your data

In GoodSwap, go to You → Privacy → Export my data to get a JSON file of everything stored on your phone. For the little we keep on our servers (your anonymous ID, purchase status and any reports you sent), email us.

Other requests

Email contact@goodswap.app to ask for a copy of your server data, a correction, or anything else on this page. We answer within 30 days. Because your data is tied to a random identifier rather than your name, we may ask for details from the app to find it. If we turn down a request, we’ll explain why, and you can appeal by replying to our answer.

EEA and United Kingdom

You have the right to access, correct, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent. You can complain to your data protection authority; in the UK that’s the Information Commissioner’s Office (ico.org.uk).

California and other US states

Under the CCPA as amended by the CPRA, and similar state laws, you can ask to know what personal information we collect and how we use it, to get a copy, to correct it and to delete it, and to opt out of sale or sharing (we do neither). We won’t treat you differently for using these rights. You can use an authorized agent; we’ll verify the request with details from the app.

In the last 12 months we collected these categories, for the purposes in What leaves your phone: identifiers (random install and account IDs; an email address only with Sign in with Apple), commercial information (subscription status), internet or other electronic network activity (app events, crash reports, aggregated barcode lookups), and visual information (label photos, only when you choose to analyze one). We disclosed them for business purposes to the service providers listed above. We collect no sensitive personal information on our servers.

Canada

Under PIPEDA you can access and correct your personal information and withdraw consent. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Your data may be processed in the United States and the European Union, where the law of those places applies to it.

Where data is processed

Our server is in the United States, and our service providers may process data in other countries. When data from the EEA or the UK is processed elsewhere, we rely on lawful transfer safeguards, such as the European Commission’s Standard Contractual Clauses and the UK’s addendum to them.

Children

GoodSwap isn’t directed to children under 13, and we don’t knowingly collect their personal information. Parents can create profiles for their children (a name, allergies, diet); those profiles stay on the parent’s phone. If you believe a child has sent us personal information, email us and we’ll delete it.

Security

Data in transit is encrypted with TLS. We keep as little as possible, access to our servers is restricted, and sign-in tokens from Apple are verified with Apple’s keys. No system is perfectly secure, so we design GoodSwap so that very little about you exists outside your phone.

Changes to this policy

We’ll post any change here with a new date. If a change is significant, for example a new kind of data leaving your phone, we’ll tell you in the app before it takes effect.

Contact

Questions or requests: contact@goodswap.app.