Privacy Policy 1. Data we collect Account information: we collect your name or display name, email address and Firebase Authentication user identifier (UID). A guest session also has an anonymous UID. These identifiers link your session to your profile, scans and other app features; being a guest does not mean that no identifiers are collected. Health information: if you choose a health goal or conditions, we store those preferences, including pregnancy if selected, and use them for personalized nutrition analysis. You can use the app without selecting a health focus. Photos and scans: we collect the product photos you upload and the resulting analysis. Photos are stored in Firebase Storage, and photos and the health context needed for personalized analysis are sent to Google Gemini when you request that analysis. Device identifiers and invitations: the app sends a phone identifier (ANDROID_ID on Android) to our server to enforce trial-scan, registered free-scan and referral limits. The server converts it into separate hashes for trials, registered free quotas and referrals before storing it in those records. For referral links, we also process the IP address, browser information (user agent) and invitation code to recover the invitation after installation. The retention periods for these records are described below. Registered free scans: the three initial scans are shared by accounts on the same phone for 365 days from creation of the device record. Deleting an account or registering another one does not restart this allowance. After the initial scans are exhausted, the daily free scan is also shared per phone, using the UTC date. Existing account usage is still respected when switching phones. Notifications: when enabled and permission is granted, we collect the Expo Push Token used to deliver notifications to this installation. We also store notification preferences and permission status, language, time zone, delivery records and notification interactions. Purchases: Google Play and RevenueCat process subscription purchases. We receive purchase history, product identifiers, subscription and entitlement status, and the RevenueCat customer identifier, linked to your Firebase UID when you sign in with a registered account. The app does not receive your full payment card number. App activity: we store usage and presence records, scans, publications, reactions, challenge progress and results, referral activity and notification interactions to operate these features and understand their use. Errors and diagnostics: we send crash logs, errors, performance traces and technical context such as app version, operating system and device information to Sentry. Events can include your Firebase UID, email and display name when available, as well as context from the affected operation. Support: when you contact us through the app, we collect your message, contact email, account UID, request type and any images or PDF documents you choose to attach, including their file names and technical metadata. 2. How we use data We use account information and identifiers to authenticate you, manage your account and subscription, save your history and make app features work. Photos and any health preferences you provide are used for nutrition analysis and personalization. Device identifiers and referral-link records help prevent abuse of trials, registered free quotas and referral rewards. App activity, purchase statistics, errors and diagnostics help us understand usage, diagnose failures and improve performance and feature quality. We use notification information to deliver app communications and reminders according to your permissions and preferences. Support messages and attachments are used to respond to your request. 3. Sharing and disclosure We do not sell your personal data. We use service providers that process data to operate NutriTruth: Google/Firebase for authentication, databases and storage; Google Gemini for analysis; Expo and the mobile push services for notifications; RevenueCat and Google Play for purchases and subscriptions; and Sentry for errors and diagnostics. Each receives the data needed for the processing described above. When you choose to publish in Community or share an analysis, the display name, product photos and analysis content shown in that publication or shared link can be accessible to other people. Copies already saved by others cannot be withdrawn remotely. We may also disclose information when required by law. 4. Retention and deletion We keep account data while your account is active. From Profile → Danger zone → Delete account, you can delete your account. The server removes your profile and health preferences, photos and public image copies, scan history and publications, reactions, challenge activity and reports, support requests and attachments, notification records, username reservation, ranking entries, referral records and Gemini usage audits from our active Firebase databases and storage. Firebase Authentication is deleted last. If an operation fails, you can retry while the authentication account still exists. After deletion, we retain only separate SHA-256 device hashes for trial-scan, registered free-quota and referral abuse prevention, with counters and dates but without account UID, email or name. These records expire 365 days after creation; a daily job is scheduled to remove them within the following 24 hours. Deleting an account does not restart this period. Once the period ends, the device limit can reset. Referral counts and rewards already earned by the person who invited you remain in that person’s account without a link to your deleted account. For guests who do not create an account, a daily job deletes the anonymous account, photos and analyses after 30 days without use. Device abuse-prevention records follow the 365-day period above. Unclaimed referral-link fingerprints expire after 24 hours and are removed by daily cleanup; linked fingerprints are deleted with the account. Public image copies orphaned by an older deletion are removed by daily cleanup. The app attempts to clear this installation’s cached profile, health preferences, history and images after server deletion. Copies already downloaded on other devices, screenshots and files shared outside NutriTruth cannot be erased remotely. We delete existing Firebase copies of RevenueCat customer and purchase events linked to the account. This action does not delete the customer held by RevenueCat or previously sent Sentry error events, which may include account identifiers and diagnostic context. Their deletion requires separate action through those providers; their retention periods are not set by this account-deletion function. RevenueCat webhooks may recreate Firebase purchase records until the provider-side customer is removed. Deleting your NutriTruth account does not cancel a Google Play subscription; manage cancellation in Google Play. These deletion actions apply to active application data. This function does not erase infrastructure logs, provider backups or Storage soft-deleted object versions; any retention for those copies depends on the provider configuration. 5. Your choices You can update profile information in app settings. You can request deletion from Profile → Danger zone → Delete account, or without the app by following https://nutritruth.me/eliminar-cuenta/ and emailing hola@nutritruth.me from the account email address. We verify account ownership before processing the request. Do not send passwords or sign-in codes. Notification permissions can be changed in your device settings. If you do not agree with this policy, stop using the app and request account deletion. Last updated: October 20, 2026. By using NutriTruth, you acknowledge this Privacy Policy.