Privacy

When you photograph a label, the image is uploaded to private storage and sent to Anthropic, whose Claude model reads the ingredient list off it. That is the only thing the photo is used for. Anthropic receives the image and nothing about you.

As soon as the label is read, the photo is deleted — what we keep is the extracted text of the ingredient list, never the photo. If a photo can’t be read, or no ingredients are found on it, we hold it for up to seven days so we can find out what went wrong, and a daily job deletes it after that.

Pasting an ingredient list as text never touches storage and is never sent to Anthropic: we read it on our own server. Scanning a barcode reads the number in your browser, from the live camera preview — no picture is taken or uploaded, and only the number reaches us. Supplement Facts panels are handled exactly the same way.

Every scan, signed in or not, keeps a record: the ingredient text we read, any Supplement Facts figures, which product it matched, what kind of label it was, whether it worked, and when. If you aren’t signed in, that record is tied only to an anonymous session cookie (below), not to you. If you sign in later on the same browser, those scans move to your account.

The first time we see a product, the ingredient list read from its label becomes that product’s public ingredient list on Roll Call. It says nothing about who scanned it.

Sign-in is a link or code sent to your email — no password for you to reuse or for us to lose. Your account keeps:

• your email address;
• your saved scans, as above — never the photos;
• your shelf: the products you add, any nickname you give one, and the date you opened it, if you enter it;
• your watch list, including any note you write on an entry;
• notes in your account inbox (when research you asked about lands, or something you watch changes);
• whether you’re a member, until when, and your alert settings;
• if you turn on phone notifications: each device’s push address, and the name of its browser so you can tell your devices apart;
• if you join the maker program: your business name, website and description.

If you’re a member, we tell you when a product you saved, or one that adds something you watch, changes its ingredient list — and, if you turn it on, when there’s new research on something you watch. We tell you in your account inbox, and — only on a device where you pressed “Notify me on this phone” — with a phone notification. A notification names the ingredient or product and links to its public page; it never says anything the page doesn’t.

Phone notifications travel through your browser maker’s push service (Google, Apple or Mozilla, depending on your device). Turn them off on /watch, or in your browser’s settings, at any time. We don’t send email yet.

Membership is paid through Stripe. To set that up we give Stripe your email address and your account’s ID; card details go to Stripe directly and never reach us. We keep only Stripe’s customer reference for you and the date your membership runs to.

• rc_session — an anonymous random ID, set for every visitor, lasting a year. It counts free scans and shows that an unsigned scan is yours, without knowing who you are.
• Sign-in cookies — set by our sign-in provider (Supabase) once you sign in, to keep you signed in. They last until you sign out, or about a year of not visiting.
• rc_auth_next — remembers which page to return you to after sign-in, for ten minutes.
• In your browser’s storage: the date you last dismissed the “add to home screen” invitation, so we don’t ask again for thirty days; and an offline copy of the app’s own files (never your pages or data).

None of these is used for advertising or to follow you to other sites.

We use Vercel Web Analytics: page views and visit counts, which Vercel summarizes by browser, device type and country. It records the address of each page viewed, which for a scan includes the scan’s ID. No advertising pixels, no third-party trackers, no fingerprinting, and no consent-banner gymnastics, because nothing here follows you around.

Only the services that make the app work, each for its own part:

• Supabase — our database, file storage and sign-in (it sends the sign-in email).
• Vercel — hosting, and the analytics above. Like any web host, it keeps request logs.
• Anthropic — reads label photos. Separately, it drafts and researches ingredient explanations; those requests contain ingredient names, never anything about you.
• Stripe — payments, as above.
• Google, Apple or Mozilla — deliver phone notifications, if you turn them on.
• Open Beauty Facts and the NIH Dietary Supplement Label Database — when you scan a barcode we don’t know yet, we send them the barcode number and nothing else.

We don’t sell or rent anyone’s data, and we don’t share it for advertising.

• Label photos: deleted once read; at most seven days if they can’t be.
• Your account and everything in it: until you delete it.
• Scans made without signing in: kept, tied only to the anonymous cookie.
• A device’s push address: until you turn notifications off, or the device stops accepting them.
• Stripe keeps its own payment records, as payment law requires.

You can ask us for a copy of what we hold about you, to correct it, or to delete it. There is no delete button in the app yet, so email teacher@ingredientrollcall.app and a person will do it. Deleting your account deletes your saved scans, shelf, watch list, inbox, notification settings and devices, and your email from our records. A few things are not personal and stay: anonymous scan counts, and the ingredient lists of products, which are public. Stripe keeps the payment records the law requires it to; ask us and we’ll ask Stripe to remove your customer record where it can.

Phone notifications are your choice and can be turned off at any time. We keep the rest because you asked us to (your account and what’s in it), or because the app can’t work without it (counting free scans, keeping you signed in, keeping the service running and secure).

Privacy questions or requests — or help with anything else: teacher@ingredientrollcall.app. A person reads every message and answers plainly.

Product names and ingredient lists for barcodes come from Open Beauty Facts, a free, community-maintained product database, made available under the Open Database Licence (ODbL), and, for supplements, from the Dietary Supplement Label Database of the National Institutes of Health’s Office of Dietary Supplements.