The short version
Decify tells you what is in a skincare product. You can use it without an account.
- Without an account, you can scan and search, but nothing you star, scan or search is saved, either on our servers or on your phone. Your app gets an anonymous ID so it can talk to our servers; the only things we link to that ID are a photo report, if you make one, and the technical record of the session described in section 3.7.
- With an account, we store your email, your name, your username, and the products you star and scan, so they follow you between devices.
- We do not ask for your skin type, age, health conditions, allergies or any other health information.
- Your camera is used to read barcodes on your device. We never receive or store the camera feed.
- We do not sell your information, we do not show ads, and we do not track you across other apps or websites.
- You can delete your account and everything in it at any time, in the app or by writing to us.
This summary is here to be easy to read. It does not replace the full policy below, but nothing below contradicts it.
1. Who we are
Decify is operated by DECIFY LTD, a private limited company registered in England and Wales under company number 17375945 ("Decify", "we", "us" or "our"). The company is the controller responsible for personal information processed through the Decify mobile application, website and related services (together, the "Services"), except where another organisation acts independently under its own privacy notice.
Registered office: 22 Kempster Gardens, Salford, England, M7 1AD, United Kingdom
Privacy Officer and privacy contact: privacy@decifyapp.com
General contact: team@decifyapp.com · Support: support@decifyapp.com
Website: decifyapp.com
2. Scope and availability
This Privacy Policy explains what personal information we collect, why and how we use it, who may receive it, where it may be processed, how long we keep it, and the choices and rights available to you.
Decify is available in the United Kingdom, Pakistan, Australia and New Zealand. It is not offered or marketed in the European Union (EU), the European Economic Area (EEA) or any other country. We may restrict availability in any country where we have not completed the legal, operational, regulatory or app-store requirements needed to offer the Services.
Local laws may give you additional rights. Section 13 contains regional information that supplements this Policy where the relevant law applies. If local mandatory law conflicts with this Policy, that law applies to the extent required.
3. Information we collect
3.1 Account and profile data
If you create a registered account, we collect:
- Email address.
- First name and, if provided, last name.
- A unique username.
- Authentication identifiers and basic profile information supplied through Google Sign-In or Sign in with Apple, including the provider's account identifier and an email address, which may be an Apple private relay address ending @privaterelay.appleid.com. Apple may share your name, and sometimes your email, only on your first sign-in. Google shares your name, email address and a link to your Google profile picture; we store the link but never display or download it.
Passwords are processed and securely hashed by Supabase Auth. Decify does not receive or store your password in its own application database.
Decify does not offer profile photographs or avatars, and we do not collect profile photographs (only the picture link Google shares, described above).
We do not ask for age, date of birth, gender, skin type, medical conditions, allergies, pregnancy information, medication use or other health information.
3.2 Guest use
You can scan and search without creating an account. To let the app communicate securely with our servers, we create an anonymous guest ID for your installation. It contains no name, email address or other contact details.
As a guest:
- Products you scan or open are not saved to a history, and you cannot star products or ingredients. Nothing of this kind is stored on our servers or on your device.
- Your searches are not saved on our servers or on your device.
- You can report a product photograph (section 3.6). The report is linked to your anonymous guest ID.
- You cannot submit new products or add photographs or barcodes to existing products. That requires a registered account.
We delete anonymous guest IDs, and anything linked to them, after 90 days without activity. When you search or scan, the request itself reaches our servers so that we can return a result, and hosting providers may briefly record request information such as IP addresses and timestamps in operational and security logs (section 8).
If you create an account from the app, your anonymous guest ID becomes your account.
3.3 Search data
Search text is sent to our servers to return results. We do not keep a server-side search history. If you have an account, your five most recent searches are stored on your device, roll over as you make new ones, and are removed when the app is uninstalled. Guests' searches are not stored.
3.4 Camera, barcode and image data
- Barcode scanning: barcodes are decoded on your device. Camera frames are not uploaded or stored by Decify. Only the decoded barcode number is sent to our servers, to look up a product or, if you have an account and choose to add a missing barcode to a product, so we can review it.
- Photographs: if you have an account, you may take or select one or two photographs when submitting a new product, or one photograph to add to an existing product. They are compressed on your device, location and camera details are removed, and they are uploaded to private storage that is not publicly readable.
Please do not upload photographs containing faces, reflections, addresses, receipts, prescriptions, documents, payment information or other unnecessary personal details.
3.5 Product submissions and contributions
"Submissions" means new-product submissions and additions to existing products, such as a photograph or barcode. Submissions require a registered account.
A new-product submission may include a barcode, the product name and brand, one or two photographs, and an optional ingredient list. An addition to an existing product may include one photograph or a barcode number.
Submissions are linked to your account so that we can review, moderate and secure them, and so that we can apply the account restrictions described in our Terms of Use. Every submission is reviewed by a person before anything becomes visible to other users. Authorised Decify personnel and contractors may access submissions for review, security, legal compliance and catalogue administration. If accepted, a photograph may be displayed publicly on the product's page and a barcode may be used for product lookup.
If an account submits content that is unlawful, infringing or inappropriate, we may block it from making further submissions or reports. We keep a record of the block (section 8).
3.6 Photo reports
Anyone using the app can report a product photograph. When you do, we record which photograph and product were reported, when, and the account or anonymous guest ID that made the report. Reports are not visible to other users. A person reviews each report, and we may remove the photograph.
3.7 Diagnostic and technical data
- Device and app information, such as device model, operating system and version, screen size, memory, language, time zone, whether the device is set to light or dark mode, and the app version.
- Crash reports, error logs and stack traces.
- A Sentry-generated installation identifier.
- Limited diagnostic breadcrumbs, such as the screen in use and actions immediately before a crash.
Our Sentry configuration disables default personal information, IP collection, account identifiers, session replay, screenshots, profiling and behavioural analytics.
Crash and error reporting cannot be switched off in the app. It is limited to what is described above and is necessary to keep the Services working. Where UK law applies we rely on our legitimate interests in the reliability and security of the Services, and we have assessed that reliance against your rights.
Our sign-in provider records the IP address and a description of the device or app for each signed-in session. It is kept until you sign out or your account (or guest ID) is deleted.
Decify does not use advertising identifiers, third-party behavioural analytics, advertising SDKs or tracking SDKs.
3.8 Communications
We process messages sent to team@decifyapp.com, support@decifyapp.com and privacy@decifyapp.com, and the information needed to send transactional emails such as email verification, password reset, account, support and security notices.
Decify does not send marketing emails. If marketing is introduced, we will provide any notice, consent choice, sender identification and unsubscribe mechanism required by law.
3.9 Information we do not intentionally collect
We do not intentionally collect precise location, contacts, microphone recordings, payment-card details, government identifiers, medical records, biometric templates or information from device health platforms. We do not knowingly collect personal information from children who are not permitted to use the Services.
4. Why and how we use personal information
The table sets out our purposes and, where UK data-protection law applies, the lawful basis for each.
| Purpose | Examples | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Provide accounts and app features | Account data, starred products, scan history, settings | Performance of a contract with you — Art. 6(1)(b) |
| Authenticate and secure accounts | Email, authentication identifiers, security records | Contract — Art. 6(1)(b); legitimate interests in protecting users and Decify — Art. 6(1)(f) |
| Run guest access | Anonymous guest ID | Legitimate interests in providing the Services securely and preventing abuse — Art. 6(1)(f) |
| Search and barcode lookup | Search query, decoded barcode, request metadata | Contract — Art. 6(1)(b) for account holders; legitimate interests in providing the feature you requested — Art. 6(1)(f) for guests |
| Review submissions | Barcode, photographs, product details | Contract — Art. 6(1)(b); legitimate interests in maintaining an accurate catalogue — Art. 6(1)(f) |
| Handle photo reports, moderate content and block accounts | Reports, the reported photograph, account or guest ID, block records | Legitimate interests in keeping the catalogue accurate, safe and lawful — Art. 6(1)(f); legal obligation where online-safety law requires it — Art. 6(1)(c) |
| Maintain, debug and secure the Services | Crash reports, diagnostics, request and security logs | Legitimate interests in reliability, security and fraud prevention — Art. 6(1)(f) |
| Communicate with you | Email address, account status, correspondence | Contract — Art. 6(1)(b); legal obligation where a response is required — Art. 6(1)(c) |
| Protect rights and comply with law | Relevant account, submission or technical information | Legal obligation — Art. 6(1)(c); legitimate interests in establishing or defending legal claims — Art. 6(1)(f) |
Where we rely on legitimate interests, we have considered whether the processing is necessary and balanced against your rights, and we keep a record of that assessment. You may object to processing based on legitimate interests (section 11).
Where law requires consent, we will ask for it clearly, and you may withdraw it at any time. Some information is necessary to provide an account or feature; without it, that feature may not be available.
5. Product scores and health-related information
Ingredient insights are for informational purposes only and should not be considered medical advice. Decify's product ratings, ingredient verdicts, roles, explanations and recommendations are general editorial and informational assessments, not diagnosis, treatment, allergy testing, professional endorsement or a guarantee of safety, effectiveness or suitability. How ratings are calculated is explained at https://decifyapp.com/methodology.
Ratings are not personalised. They are not based on your skin type, medical conditions, allergies, pregnancy status or any other health information, because we do not collect it. Ratings do not produce legal or similarly significant effects, and we do not infer or create health profiles from searches, scans or product choices.
Please do not send medical records, diagnoses, detailed symptoms, prescriptions or other sensitive health information through support or submissions. Before launching any feature that collects or infers health-related information, we will put in place any notice, consent or other controls the law requires.
6. Who receives personal information
We disclose personal information only as reasonably necessary for the purposes in this Policy, as directed by you, or as required or permitted by law. Recipients may include:
- Supabase, which provides database, authentication and storage services and uses infrastructure providers such as Amazon Web Services as sub-processors.
- Sentry, which provides crash reporting and diagnostics.
- Resend, which delivers transactional email.
- Cloudflare, which provides domain registration, DNS, website hosting and network security for our domain, and stores our encrypted database backups.
- Google Workspace, which hosts our company email, including messages sent to team@decifyapp.com, support@decifyapp.com and privacy@decifyapp.com.
- GitHub, which runs the automated job that takes our nightly database backup on its servers (in the United States by default) and encrypts it before it is stored in the EU.
- Google Fonts and unpkg, which serve fonts and icons to visitors of decifyapp.com and receive the visitor's IP address.
- Google and Apple, when you choose their sign-in services.
- Apple App Store and Google Play, which distribute the app and process information under their own policies.
- Google ML Kit on Android and Apple Vision and AVFoundation on iOS, for on-device camera and barcode functions.
- Authorised employees, directors, developers, contractors and advisers who need access for legitimate operational purposes and are bound by confidentiality.
- Regulators, courts, law-enforcement bodies and other authorities where disclosure is required or permitted by law, or reasonably necessary to protect rights, safety and security.
- A purchaser, investor or successor in connection with a genuine financing, reorganisation, merger, sale or transfer, subject to appropriate protections.
Decify does not sell personal information, does not share it for targeted advertising or behavioural profiling, and does not disclose it in exchange for money or another valuable benefit.
7. International processing and transfers
Decify is established in the United Kingdom. Information collected from users in Pakistan, Australia and New Zealand is transferred to and stored in the United Kingdom, and may be accessed from other countries where our providers or authorised personnel operate.
Our Supabase project is hosted in London (eu-west-2), and database backups are stored encrypted in the EU. Sentry uses its EU data region. Resend sends email from Ireland (eu-west-1). Cloudflare operates a global network, so website requests may be handled near the visitor. Google stores our email in its own data centres, which may be outside the UK.
Where a transfer needs safeguards, we use an appropriate mechanism, such as a recognised adequate destination or approved contractual clauses, together with encryption, restricted access and provider due diligence. Laws on government access in a destination country may differ from those in yours.
For New Zealand users: when we disclose personal information to an organisation outside New Zealand that is not acting on our behalf, we do so only as permitted by information privacy principle 12. Providers acting on our behalf, such as those listed in section 6, handle it under our instructions.
8. Retention
We keep information only as long as needed for its purpose, for security, for handling disputes and for legal obligations. When it is no longer needed, we delete or anonymise it.
| Information | How long we keep it |
|---|---|
| Account and profile data | Until the account is deleted, unless the law, security, fraud prevention or a dispute requires longer |
| Starred products and scan history (accounts) | Until you clear them or delete your account |
| Stars, history and searches (guests) | Not stored |
| Anonymous guest ID, and any reports linked to it | Deleted after 90 days without activity |
| Recent searches (accounts) | Up to five, on your device only; removed when the app is uninstalled |
| Pending submissions | While needed for review, moderation and security |
| Rejected or duplicate submissions | Deleted within four months of review, unless needed for a dispute, security issue or legal obligation |
| Accepted catalogue content | Kept while useful, with the link to your account permanently removed |
| Photo reports | Deleted 12 months after the report is closed, unless needed for a dispute, security issue or legal obligation |
| Records of blocked accounts | Kept while the account exists, and deleted with it |
| Database backups | Up to 7 days, then deleted automatically |
| Sentry diagnostics | Up to 90 days |
| Support and privacy correspondence | Normally 24 months after the matter is closed |
| Provider request and security logs | According to each provider's configured retention and legal obligations |
9. Account deletion and catalogue contributions
You can delete your account in the app at Menu → Manage account → Delete account, or ask for help at privacy@decifyapp.com. We may take proportionate steps to verify your identity before acting on an emailed request.
Deleting your account removes your profile, sign-in details, starred products, scan history, active sessions, and any pending or rejected submissions and reports. Deleted data may remain in encrypted database backups for up to 7 days before they are automatically deleted.
Submissions already reviewed and accepted into the catalogue, such as a product photograph or barcode, remain after the link to your account has been permanently removed. The retained record does not contain your name, email address, username or account identifier. If retained material contains personal information, was uploaded by mistake or may infringe someone's rights, contact us and we will assess it as the law requires.
Guests. We do not store stars, history or searches for guests, so there is nothing of that kind to delete. Your anonymous guest ID, and any report linked to it, is deleted automatically after 90 days without activity. Because a guest ID is not linked to any contact details, we usually cannot identify a particular guest's data from an emailed request.
10. Security and incidents
We use reasonable administrative, technical and organisational safeguards appropriate to the information we hold, including authentication controls, row-level database security, private storage for submitted photographs, encryption in transit and at rest, least-privilege access and provider due diligence.
No system is completely secure. We investigate suspected incidents and take reasonable steps to contain and fix them.
If a personal data breach occurs:
- United Kingdom: we notify the Information Commissioner's Office within 72 hours where required, and affected users without undue delay where the breach is likely to result in a high risk to them.
- New Zealand: if a breach is likely to cause serious harm, we notify the Privacy Commissioner and affected users as soon as practicable.
- Elsewhere: we notify regulators and affected users where local law requires.
Please protect your devices and credentials, and tell privacy@decifyapp.com promptly if you suspect unauthorised access to your account.
11. Your choices and rights
Depending on where you live, you may have rights to:
- know what personal information we hold about you and receive a copy, including in a portable format;
- have inaccurate information corrected;
- have information deleted;
- object to, or ask us to restrict, certain processing, including processing based on legitimate interests;
- withdraw consent where we rely on it; and
- complain to a privacy regulator (section 13).
Contact privacy@decifyapp.com and describe your request. We may ask for information reasonably needed to verify your identity. We will respond within the time the law requires: one month in the UK, and 20 working days in New Zealand. We may refuse or limit a request where the law allows, for example if we cannot verify it or it would affect someone else's rights, and we will explain why. We will not treat you unfairly for exercising your rights.
12. Children
Decify is not directed to children under 13. You must be at least 13, and must also meet any higher minimum age required where you live. Where parental or guardian permission is legally required, you may use Decify only with that permission.
Because we do not collect dates of birth, we cannot tell whether a particular user is a child. We therefore apply the same protective defaults to everyone:
- core features work without an account, and guests' stars, history and searches are not stored;
- we collect only what is needed to run the Services;
- profiles are private, and there is no public profile, messaging or following;
- we do not show ads, profile users, use location, or use tracking technologies;
- we do not use nudge techniques to encourage anyone to share more information.
Our settings are high-privacy by default, as assessed in our data protection impact assessment.
We do not knowingly collect personal information from a child who is not permitted to use the Services. If you believe this has happened, contact us and we will investigate and delete information where required.
13. Regional information
13.1 United Kingdom
Where UK data-protection law applies, DECIFY LTD is the controller and the lawful bases in section 4 apply. You have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may complain to the Information Commissioner's Office (ico.org.uk), although we encourage you to contact us first.
13.2 New Zealand
Where the Privacy Act 2020 applies, you may ask to access and correct personal information we hold about you. We notify the Privacy Commissioner and affected individuals of notifiable privacy breaches as described in section 10, and handle overseas disclosures as described in section 7. If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).
13.3 Australia
Where the Privacy Act 1988 applies to our handling of your information, you may ask to access and correct it, and complain to us about how we have handled it. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).
13.4 Pakistan
We apply this Policy to users in Pakistan in the same way as to all other users. We respond to lawful requests from Pakistani authorities in accordance with applicable law.
14. App permissions
- Camera: barcode scanning and taking product photographs for submissions.
- Photo library: selecting product photographs for submissions.
Decify does not request location, contacts, Bluetooth, microphone, calendar, notification or health-data permissions.
On Android, the Play Store listing shows biometric permissions. These are declared by Google's sign-in library to support passkeys; the device handles any biometric prompt itself, and Decify receives no biometric data.
15. Third-party services and links
Third-party providers process information under their own terms and privacy notices. We are not responsible for independent third-party websites, stores or services linked from Decify. This does not reduce any responsibility the law places on us for how we choose and use our providers.
16. Changes to this Policy
We may update this Policy to reflect changes in the Services, our providers, the law or the countries we operate in. We will publish the revised version with a new effective date and, where required, give notice or ask for consent before a material change takes effect.
17. Contact and complaints
Privacy questions, rights requests and complaints: the Privacy Officer at privacy@decifyapp.com, or by post to DECIFY LTD, 22 Kempster Gardens, Salford, England, M7 1AD, United Kingdom.
General enquiries: team@decifyapp.com. Product and app support: support@decifyapp.com.
Please include enough information for us to understand your request, but do not send passwords, identity documents, medical records or other unnecessary sensitive information by email. If you are not satisfied with our response, you may contact the regulator listed for your country in section 13.
Change log
| Version | Date | Summary |
|---|---|---|
| 1.0 | 11 October 2026 | Initial publication. |