Decify Privacy Policy

1. Who we are

Decify is operated by DECIFY LTD, a private limited company registered in England and Wales under company number 17375945 ("Decify", "we", "us" or "our"). The company is the controller, business or organisation responsible for personal information processed through the Decify mobile application, website and related services (together, the "Services"), except where another organisation acts independently under its own privacy notice.

Registered office: 22 Kempster Gardens, Salford, England, M7 1AD, United Kingdom

Privacy Officer and privacy contact: privacy@decifyapp.com

General contact: team@decifyapp.com · Support: support@decifyapp.com

Website: decifyapp.com

2. Scope and availability

This Privacy Policy explains what personal information we collect, why and how we use it, who may receive it, where it may be processed, how long we keep it, and the choices and rights available to you.

Decify is intended to be available in the United Kingdom and in supported countries worldwide, including the United States, Canada and Switzerland. At launch, Decify is not offered or marketed in the European Union (EU) or European Economic Area (EEA). We may restrict availability in any country, state, province or territory where we have not completed the legal, operational, language, regulatory or app-store requirements necessary to offer the Services.

Local laws may provide additional rights. Section 13 contains regional information that supplements this Policy where the relevant law applies. If local mandatory law conflicts with this Policy, that law applies to the extent required.

3. Information we collect

3.1 Account and profile data

If you create a registered account, we collect:

• Email address.
• First name and, if provided, last name.
• A unique username.
• Authentication identifiers and basic profile information supplied through Google Sign-In or Sign in with Apple, including the provider’s account identifier and an email address, which may be an Apple private relay address ending @privaterelay.appleid.com. Apple may also share your name, but only on your first sign-in.

Passwords are processed and securely hashed by Supabase Auth. Decify does not receive or store your password in its own application database.

Decify does not offer profile photographs or avatars, and we do not collect them.

We do not ask for age, date of birth, gender, skin type, medical conditions, allergies, pregnancy information, medication use or other health information.

3.2 Guest use

You may use core features without creating a registered account. Guest use does not create an account record on our systems.

Products you star and the products recorded in your scan history are stored only on the device you are using. That information is not transmitted to us and we do not hold a copy of it. It remains on your device until you clear it or uninstall the app, and it does not move between devices — keeping starred products and history across devices requires a registered account.

When you search or scan as a guest, the request itself reaches our servers so that we can return a result. Hosting and infrastructure providers may temporarily record request information, including IP addresses, timestamps and request metadata, in operational, security and abuse-prevention logs.

3.3 Search data

Search text is transmitted to our backend to return results. Decify does not keep a server-side search-history table. The five most recent successful searches are stored locally on your device, roll over as new searches are made, and are removed when the app is uninstalled.

3.4 Camera, barcode and image data

• Barcode scanning: supported retail barcodes are decoded on your device. Camera frames used for barcode scanning are not uploaded or stored by Decify. Only the decoded barcode number is sent to the server for lookup.
• Product submissions: you may take or select one or two product photographs. These are compressed on the device and uploaded to a private Supabase Storage bucket that is not publicly readable.

Please do not upload photographs containing faces, reflections, addresses, receipts, prescriptions, documents, payment information or other unnecessary personal details.

3.5 Product submissions

Submitting a product for the catalogue requires a registered account. A product submission may include a barcode, one or two product photographs, an optional product name, brand and ingredient list. Submissions are linked to your account so that we can receive, review, moderate, secure and manage them, and so that we can operate the repeat-infringer policy described in our Terms of Service.

Submissions are not visible to other users before acceptance into the catalogue. They may be accessed by authorised Decify personnel and contractors for review, security, legal compliance and catalogue administration.

3.6 Diagnostic and technical data

• Device model, operating-system version and app version.
• Crash reports, error logs and stack traces.
• A Sentry-generated installation identifier.
• Limited diagnostic breadcrumbs, such as the screen in use and actions immediately before a crash.

Our Sentry configuration disables default personal information, IP collection, account identifiers, session replay, profiling and behavioural analytics. We do not intentionally attach typed content, submission images, product details or network logs to crash reports.

Crash and error reporting cannot be switched off in the app. It is limited to what is described above and is necessary to keep the Services working. Where UK law applies we rely on our legitimate interests in the reliability and security of the Services rather than on your consent, and we have assessed that reliance against your rights.

Authorised personnel and developers may access limited diagnostic and technical information from countries where they are located where reasonably necessary to develop, maintain, secure and support the Services. Access is restricted to what is necessary and subject to confidentiality, security and access controls.

Decify does not use advertising identifiers, third-party behavioural analytics, advertising SDKs or tracking SDKs.

3.7 Communications

We process messages sent to team@decifyapp.com, support@decifyapp.com and privacy@decifyapp.com, and information needed to send transactional communications, including email verification, password reset, account, support and security notices.

Decify does not send marketing emails at launch. If marketing is introduced, we will provide any notice, consent choice, sender identification and unsubscribe mechanism required by applicable law. Refusing marketing will not prevent essential service or security communications.

3.8 Information we do not intentionally collect

We do not intentionally collect precise location, contacts, microphone recordings, payment-card details, government identifiers, medical records, biometric templates or information from device health platforms. We do not knowingly collect personal information from children who are not legally permitted to use the Services.

4. Why and how we use personal information

The table below sets out our purposes and, where UK data-protection law applies, the lawful basis for each.

Where we rely on legitimate interests we have considered whether the processing is necessary and whether it is balanced against your rights, and we keep a record of that assessment. You may object to processing based on legitimate interests — see section 11.

Where applicable law requires consent, we will request it clearly. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing that was lawful before withdrawal. Some information is necessary to provide an account or feature; if you decline or withdraw necessary processing, that feature may not be available.

5. Product scores and health-related information

Ingredient insights are for informational purposes only and should not be considered medical advice. Decify’s product ratings, ingredient verdicts, roles, explanations and recommendations are general editorial and informational assessments — not diagnosis, treatment, allergy testing, professional endorsement or a guarantee of safety, effectiveness or suitability.

Ratings are not personalised. They are not based on your skin type, medical conditions, allergies, pregnancy status or any other health information, because we do not collect that information. Ratings do not produce legal or similarly significant effects, and we do not intentionally infer or create health profiles from searches, scans or product choices.

Please do not send medical records, diagnoses, detailed symptoms, prescriptions or other sensitive health information through support or product submissions. Before launching any future feature that collects or infers health-related information, we will assess and implement any separate notice, consent, deletion or other controls required by applicable law.

6. Who receives personal information

We disclose personal information only as reasonably necessary for the purposes in this Policy, as directed by you, or as required or permitted by law. Recipients may include:

• Supabase, which provides database, authentication and storage services and may use infrastructure providers such as Amazon Web Services as sub-processors.
• Sentry, which provides crash reporting and diagnostic services.
• Resend, which provides transactional email delivery.
• Cloudflare, which provides domain registration, DNS, website hosting, network security, encrypted backup storage and inbound email routing for our domain.
• Google and Apple, when you choose their sign-in services.
• Apple App Store and Google Play, which distribute the app and process information under their own policies.
• Google ML Kit on Android and Apple AVFoundation / Core Image on iOS for on-device camera and barcode functions.
• Authorised employees, directors, developers, contractors and advisers who need access for legitimate operational purposes and are subject to confidentiality and access restrictions.
• Regulators, courts, law-enforcement bodies and other authorities where disclosure is required or permitted by law or reasonably necessary to protect rights, security and users.
• A purchaser, investor or successor in connection with genuine financing, due diligence, reorganisation, merger, sale or transfer, subject to appropriate protections.

Decify does not sell personal information. Decify does not share personal information for cross-context behavioural advertising, targeted advertising or third-party behavioural profiling, and does not knowingly disclose personal information in exchange for money or another valuable benefit. If these practices change, we will update this Policy and provide any legally required notice and choice before the change takes effect.

7. International processing and transfers

Decify is established in the United Kingdom. Personal information collected from users in other countries may be transferred to, stored in or accessed from the United Kingdom and other countries where providers, sub-processors or authorised personnel operate.

Privacy and government-access laws in a destination country may differ from those in your country. Information processed abroad may be accessible to courts, law-enforcement or public authorities under applicable local law.

Where a transfer requires safeguards, we will use an appropriate mechanism and proportionate measures, which may include recognised adequate destinations, approved contractual clauses or data-transfer agreements, transfer risk assessments, restricted permissions, encryption, multi-factor authentication, data minimisation and provider due diligence.

Our Supabase project is hosted in London (eu-west-2). Sentry uses its EU data region. Encrypted database backups are stored in Cloudflare R2. Cloudflare operates a global network, so website requests and inbound email may be handled at a location near the sender. Providers may use approved sub-processors in other locations.

Canadian users should understand that information processed outside Canada may be subject to foreign laws. Swiss users may request available information about safeguards used for transfers where Swiss law requires it.

8. Retention

We apply the shortest retention reasonably consistent with purpose, security, dispute handling and legal obligations. When information is no longer needed, we delete, anonymise or securely de-identify it. Anonymised information may be retained where it can no longer reasonably be linked to an identifiable person.

9. Account deletion and catalogue contributions

You may delete your account in the app at Menu → Account → Delete account, or request assistance at privacy@decifyapp.com. We may take proportionate steps to verify identity and prevent fraudulent deletion.

Account deletion removes or de-identifies the authentication account, profile, starred products, scan history, active sessions and associated identifiers, subject to limited legal, security, dispute and backup exceptions. Deleted data may persist in encrypted backups for up to 14 days before those backups are deleted on a rolling basis.

If you use Decify as a guest, we do not hold an account record for you. Clearing the app’s data or uninstalling the app removes the starred products and scan history stored on your device. There is nothing held on our systems for us to delete, so no request is necessary.

Pending, rejected, duplicate and unnecessary submission material will be deleted under the retention schedule. Product information and suitable product-only photographs already reviewed and accepted into the catalogue may remain only after the account link has been permanently removed and reasonable steps have been taken to remove personal information. The retained catalogue record should not contain your name, email address, username, account identifier or other information that reasonably identifies you.

A content licence in the Terms does not override privacy rights. If retained material contains personal information, was uploaded by mistake, may infringe rights, or cannot be effectively de-identified, contact us. We will assess and act on the request as required by law.

10. Security and incidents

We maintain reasonable administrative, technical and organisational safeguards appropriate to the nature and sensitivity of the information. These are intended to include authentication controls, role-based permissions, row-level database security, private storage for submission images, encryption in transit and where appropriate at rest, multi-factor authentication for privileged access, least-privilege access, logging, secure development practices, provider review and incident-response procedures.

We maintain encrypted backups of the production database so that personal information can be restored in the event of a technical incident, and we test restoration periodically.

No electronic system is completely secure. We cannot guarantee absolute security, but we will investigate suspected incidents and take reasonable containment, remediation, documentation and notification steps. Where law requires notification to individuals, regulators or other authorities, we will provide it within the required period and manner.

For Canada, we will maintain records of security-safeguard breaches where required. Users should protect their devices and credentials and notify privacy@decifyapp.com promptly if they suspect unauthorised access.

11. Your choices and rights

Depending on where you live and whether the relevant law applies to Decify, you may have rights to:

• know or obtain information about the personal information we collect, use and disclose;
• request access to or a portable copy of personal information;
• request correction of inaccurate information;
• request deletion or de-identification;
• withdraw consent where processing is based on consent;
• object to or restrict certain processing, including processing based on legitimate interests;
• opt out of sale, targeted advertising, certain sharing or qualifying profiling;
• appeal a refusal where applicable;
• authorise an agent to submit a request where applicable; and
• complain to a privacy or consumer-protection regulator.

Contact privacy@decifyapp.com and describe your request. We may request information reasonably necessary to verify identity, authority and jurisdiction. We will not discriminate against you for exercising a legally protected right.

We will respond within the period required by applicable law. We may deny or limit a request where law permits, including where we cannot verify it, it conflicts with another person’s rights, it is manifestly unfounded or excessive, or retention is legally required. We will explain any refusal and available appeal or complaint route where required.

An authorised agent must provide evidence of authority, and we may verify the request directly with you unless the law provides otherwise.

12. Children

Decify is not directed to children under 13. You must be at least 13 and must also meet any higher minimum age required by the laws of your country, state, province or territory. Where valid parental or guardian permission is legally required, you may use Decify only with that permission.

Because we do not collect date of birth, we cannot tell whether a particular user is a child. We therefore apply the same privacy-protective defaults to everyone: no account is required to use core features, guest activity stays on the device, we collect the minimum information needed to run the Services, we do not profile users, we do not use advertising or tracking technologies, and we do not use nudge techniques to encourage anyone to share more information than necessary.

We do not knowingly collect personal information from a child who is not legally permitted to use the Services. If you believe this has occurred, contact us so we can investigate and delete information where required.

We do not sell or share personal information for behavioural advertising and do not knowingly use children’s information for targeted advertising.

13. Regional privacy information

13.1 United Kingdom

Where UK data-protection law applies, DECIFY LTD is the controller. The lawful bases described in section 4 apply as relevant. You may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You may complain to the UK Information Commissioner’s Office, although we encourage you to contact us first.

13.2 United States

US privacy rights vary by state and often apply only when statutory thresholds or other conditions are met. Where an applicable state privacy law applies, the categories collected, sources, purposes, recipients and retention are described throughout this Policy.

During the preceding 12 months, Decify intends to collect the categories described in section 3 and disclose them to the categories in section 6 for business and operational purposes. Decify does not sell personal information or share it for cross-context behavioural advertising or targeted advertising.

Where applicable, residents may request confirmation, access, correction, deletion or portability; opt out of sale, targeted advertising or qualifying profiling; use an authorised agent; and appeal a denied request. Requests may be sent to privacy@decifyapp.com. Because Decify does not engage in sale or targeted-advertising sharing at launch, a separate opt-out mechanism is not currently provided. We will add one before engaging in a practice that requires it.

Decify does not collect information intended to diagnose, treat or infer a medical condition, and does not collect skin type or any other health information. If a future feature collects or infers consumer health data, we will assess and implement any separate privacy notice, consent, authorisation, deletion and geofencing controls required by applicable state health-data law before enabling it.

13.3 Canada

Where Canadian private-sector privacy law applies, Decify is accountable for personal information under its control and designates the Privacy Officer in section 1 to oversee compliance. We collect, use and disclose personal information only for identified purposes that a reasonable person would consider appropriate, with meaningful consent or another lawful basis.

You may request access to personal information under our control, information about its use and disclosure, and correction of inaccuracies. You may withdraw consent subject to legal or contractual restrictions and reasonable notice. You may complain to our Privacy Officer and, where applicable, to the Office of the Privacy Commissioner of Canada or the relevant provincial regulator.

Information may be processed outside Canada and may be accessible to foreign authorities under local law. We remain responsible for information transferred to service providers and use contractual or other measures appropriate to the circumstances.

If Decify sends commercial electronic messages to Canadian recipients, it will obtain any required consent, identify the sender and provide a functioning unsubscribe mechanism.

Some provinces have additional privacy, consumer or language requirements. Decify may restrict availability within a province until required notices, translations, consent flows, contracts or procedures are operational.

13.4 Switzerland

Where the Swiss Federal Act on Data Protection applies, this Policy identifies the controller, purposes, categories, recipients, retention and international-transfer information. Swiss users may request information about whether and how their personal data is processed and exercise other rights available under Swiss law by contacting privacy@decifyapp.com.

We will use required safeguards for transfers to countries that are not recognised as providing adequate protection. If Decify becomes legally required to appoint a representative in Switzerland, we will publish that representative’s identity and contact details before the obligation applies.

13.5 Other supported jurisdictions

Users in other supported jurisdictions may have mandatory rights that cannot be limited by this Policy. Decify will honour those rights where applicable and may restrict or delay availability where local registration, representative, data-localisation, language, consent, security, age-assurance or other requirements have not been completed.

14. App permissions

• Camera: barcode scanning and taking product photographs for submissions.
• Photo library: selecting product photographs for submissions.

Decify does not request location, contacts, Bluetooth, microphone, calendar, notification or health-data permissions for its current functions.

15. Third-party services and links

Third-party providers process information under their own contracts, terms and privacy notices. Decify is not responsible for independent third-party websites, stores or services linked from the Services. This does not reduce any responsibility applicable law places on Decify for its selection and use of processors or service providers.

16. Changes to this Policy

We may update this Policy to reflect changes in the Services, providers, law, supported territories or business operations. We will publish the revised version and update its effective date. Where required, we will provide additional notice, obtain renewed consent or give users an opportunity to exercise a choice before a material change takes effect.

17. Contact and complaints

Privacy questions, rights requests and complaints may be sent to the Privacy Officer at privacy@decifyapp.com, or by post to DECIFY LTD, 22 Kempster Gardens, Salford, England, M7 1AD, United Kingdom.

General enquiries: team@decifyapp.com. Product and app support: support@decifyapp.com.

Please include enough information for us to understand the request, but do not send passwords, full identity documents, medical records or other unnecessary sensitive information by ordinary email.

If you are dissatisfied with our response, you may contact the privacy or consumer-protection authority available in your jurisdiction. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk).

Change log