Privacy Policy
Effective: August 5, 2026 · Last updated: August 5, 2026
This Privacy Policy explains how VeganLens ("VeganLens," "the app," "we," "us," or "our") collects, uses, shares, and protects your personal data when you use the VeganLens mobile application and related services.
VeganLens is operated by an individual sole operator based in Israel. For the purposes of the EU/UK General Data Protection Regulation (GDPR), the Data Controller is:
Leonid Fonaryov, Israel Contact: leon.fonar@gmail.com
1. Data we collect
We collect the following categories of data.
Account data. When you sign in using Sign in with Apple or Google Sign-In, we receive and store your email address, your provider name (Apple or Google), the provider's stable user identifier, and your account creation timestamp. We also generate an internal user UUID to identify your account within our systems.
User content. When you scan a product, we collect the photos of product ingredient labels you choose to scan, the textual ingredient list that is extracted from those photos by our AI processors, and the AI-generated verdict and summary returned for that product.
Usage data. We record the number of scans you perform per day, your total scan count, and your scan history.
Technical data. We process your internal user UUID and your request IP address for the purpose of rate limiting. Your IP address is held only transiently in short-lived rate-limit counters and is not stored beyond that. We also generate HTTP access logs as part of normal server operation.
Diagnostic data. The app and our server include crash and error reporting (Sentry — see Section 3), which collects crash logs and error events, including stack traces, device and OS version, and app version, to help us diagnose and fix problems. Server-side error reports also include your internal account identifier (a random ID we generate), so that we can connect an error to the scan that caused it. We do not attach your email address or scan content to these reports.
2. How we use your data
We use your data to:
- Authenticate you and maintain your account.
- Enforce the free-tier rate limit of 10 scans per day.
- Send your scan images to our AI processors — OpenAI and Anthropic — for AI analysis (see Section 3).
- Cache scan results for 30 days so that repeat scans of the same product return instantly.
- Show you your own scan history.
- Produce internal aggregate metrics for our admin dashboard, such as total users, total scans, and the distribution of verdicts. These metrics are aggregate and are not used to profile individual users.
- Analyze usage and scan data to operate, maintain, and improve VeganLens — for example, to evaluate and improve AI accuracy, fix problems, and develop new features. This analysis is performed internally, by us, on our own infrastructure. Where feasible, we use aggregated or de-identified data for this purpose. We do not send your data to third parties to train their models (see Section 3 regarding OpenAI and Anthropic).
We do not sell your personal data. We do not share it with advertisers, and we do not engage in cross-app tracking.
Legal bases for processing (EU/UK users)
Where GDPR applies, we rely on the following legal bases: your consent (which you give by creating an account and using the app, and which you may withdraw at any time by deleting your account); our legitimate interests in operating, securing, analyzing, and improving the service, including rate limiting, aggregate metrics, and improving AI accuracy; and performance of our agreement with you to provide the scanning service you request. You may object to processing based on legitimate interests at any time (see Section 5).
3. Third-party processors
We share data with the following third parties, each acting as a processor or service provider on our behalf. We share only the data needed for each service.
Apple — Sign in with Apple. Used for identity verification only when you choose to sign in with Apple.
Google — Google Sign-In. Used for identity verification only when you choose to sign in with Google.
OpenAI — primary AI analysis. When you scan a product, the scan image and related text are sent to OpenAI's API for AI analysis. OpenAI is our primary AI processor. Under OpenAI's API data-usage policy, data submitted through the API is not used to train or improve OpenAI's models. OpenAI processes this data solely to return analysis results to us, and may retain it briefly for abuse monitoring under its own policies before deleting it.
Anthropic — Claude API (fallback AI analysis). If a scan cannot be completed by OpenAI, the same scan image and related text are sent to Anthropic's Claude API instead, so that you still receive a verdict. We have enabled Anthropic's organization-level data-processing controls so that your scan inputs are not used to train or improve Anthropic's models. Anthropic processes this data solely to return analysis results to us.
Google Cloud Platform — hosting infrastructure. Provides our compute, database (PostgreSQL), cache (Redis), and image storage.
Sentry — error and crash reporting. Sentry is in use in both the app and our server, and receives crash logs and error events (stack traces, device/OS and app version) to help us diagnose problems. Server-side reports also include your internal account identifier so an error can be connected to the scan that caused it. We do not send your email address or scan content to Sentry.
International data transfers
Our infrastructure and AI processing (Google Cloud Platform, OpenAI, Anthropic) are located in the United States, and we operate from Israel. If you are in the EU or UK, your data is therefore transferred internationally. Israel benefits from a European Commission adequacy decision, which recognizes Israeli data-protection law as providing an adequate level of protection for personal data transferred from the EU. Where data is transferred onward to U.S. processors, those transfers are governed by the processors' own safeguards, including Standard Contractual Clauses where applicable.
4. Data retention
We retain your account data, scan records, and scan images for as long as your account remains active, with no fixed time limit, so that we can provide your scan history and analyze the data to operate and improve the service (see Section 2). You can end this retention at any time by deleting your account, which purges your data as described in Section 5.
| Data | Retention |
|---|---|
| Account data, scan records, scan images | Retained for as long as your account is active, with no fixed time limit, and deleted when you delete your account. We retain this data to provide the service and to analyze and improve it. |
| De-identified / aggregated data | Data that has been aggregated or stripped of identifiers so it can no longer be linked to you may be retained and used for analysis and product improvement even after account deletion. |
| Scan result cache | 30 days |
| Rate-limit counters (incl. transient IP) | End of the UTC day |
| Refresh tokens | 30 days from last use |
| HTTP access logs | 30 days |
| Crash / error reports (Sentry) | Retained by Sentry under its own event-retention policy (typically 90 days) |
5. Your rights
You can delete your account and all associated data at any time from within the app: Profile → Delete account. This purges your account data, scan history, and scan images. If you no longer have the app installed, you can request deletion instead — see Delete your account for both routes and exactly what is removed. After deletion we may retain only data that has been aggregated or de-identified so that it can no longer be linked to you (see Section 4).
For any privacy question or request, contact us at leon.fonar@gmail.com.
Additional rights for EU/UK users (GDPR)
If you are in the EU or UK, you have the right to: access the personal data we hold about you; request rectification of inaccurate data; request erasure ("right to be forgotten"); request portability of your data in a structured, machine-readable format; request restriction of processing; and object to processing based on legitimate interests. You may exercise these rights by emailing us at the address above, and we will respond within the timeframes required by law (generally one month). You also have the right to lodge a complaint with your local data protection authority.
6. Children
VeganLens is not directed to children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have collected such data, we will delete it. If you believe a child has provided us data, please contact us at the email above.
7. Changes to this policy
We may update this Privacy Policy from time to time. We will notify users of material changes via in-app notice and email. The "Last updated" date at the top reflects the most recent revision.
8. Contact
Questions about this policy or your data: leon.fonar@gmail.com