Privacy Policy

1. Data Controller

PureScan (“the App”, “we”, “us”) is operated by an individual developer based in Istanbul, Türkiye, who acts as the data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”). Contact for all privacy requests: support@purescan.health.

This notice also serves as our disclosure obligation (aydınlatma metni) under Article 10 of KVKK.

2. Data We Process, Purposes and Legal Bases

• Account data: Email address, username and password (stored hashed by Supabase Auth; we never see your password). Purpose: creating and securing your account. Legal basis: performance of a contract (KVKK Art. 5/2-c).
• Health and belief-related preferences (special category data): Allergy information, family member profiles and religious dietary preferences (e.g. Halal/Kosher) that you choose to enter. Purpose: personalising product analysis and warnings. Legal basis: your explicit consent (KVKK Art. 6/2 and GDPR Art. 9(2)(a)). Providing this data is optional; you may withdraw consent at any time by removing these fields or deleting your account.
• Scan and content data: Barcodes you scan, ingredient text, photos of ingredient labels or menu text you submit for analysis, scan history and favourites. Products, comments and deals you publish are visible to other users together with your username. Legal basis: performance of a contract and our legitimate interest in operating the service (KVKK Art. 5/2-f).
• Approximate location (country): Derived from your IP address to show region-appropriate deals and product data. We do not collect precise GPS location.
• Purchase data: Payments are handled by Paddle (web) or Google Play with RevenueCat (Android). We do not receive your card details; we receive only subscription status and identifiers needed to activate Premium. Legal basis: performance of a contract and legal obligations.
• Analytics and diagnostics: App usage events and device information collected through Google Firebase Analytics / GA4, which may include an advertising identifier. Purpose: stability, performance and improving the App. Legal basis: legitimate interest and, where required, consent.
• Camera: Used only when you scan a barcode or a label. Barcodes are read on your device; label or menu photos are sent to our AI provider only when you request an analysis.
• Local device storage: Preferences, scan history and cached data are stored on your device to improve performance.

3. Recipients and International Transfers

We share data only with service providers that are necessary to run the App, under their own privacy terms: Supabase (database and authentication), Vercel (hosting), Groq (AI analysis of ingredient text, questions and images you submit), Paddle (web payments), RevenueCat and Google (mobile purchases and analytics), IP geolocation providers such as ipapi.co, ipwho.is and ipify (your IP address, to determine your country), and the Open Food Facts, Open Products Facts, Open Beauty Facts and USDA FoodData Central databases (barcode numbers only).

Many of these providers store or process data outside Türkiye (including the EU and the United States). Such transfers are carried out in accordance with Article 9 of KVKK and, where applicable, GDPR Chapter V.

We do not sell or rent your personal data and do not use it for third-party marketing.

4. Retention

We keep your account data for as long as your account exists. When you delete your account (Profile → Settings), your profile, favourites, shopping list, comments, deals and statistics are deleted and your authentication record is removed; products you contributed remain in the database without a link to you. Records that we or our payment providers must keep by law (e.g. tax and payment records) are retained for the legally required period.

5. Your Rights

Under Article 11 of KVKK (and GDPR, where applicable) you may: learn whether your data is processed; request information about it; learn its purposes and whether it is used accordingly; know the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or inaccurate data; request deletion or destruction; request that these actions be notified to third parties; object to an outcome against you that results from exclusively automated analysis; claim compensation for damage caused by unlawful processing; and withdraw your consent at any time.

To exercise these rights, email support@purescan.health. We respond free of charge within 30 days (KVKK Art. 13). You also have the right to lodge a complaint with the Personal Data Protection Authority (KVKK Kurulu, kvkk.gov.tr) or, if you are in the EU/UK, your local supervisory authority.

6. Security

We use industry-standard measures including encrypted connections (HTTPS), access controls and row-level security. No system is completely secure; if a breach affecting your data occurs we will notify you and the authorities as required by law.

7. Children’s Privacy

PureScan is not intended for children under 13 and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

8. Changes to This Policy

We may update this policy. Material changes will be announced in the App or by email before they take effect, and the “Last Updated” date above will change.