Privacy Policy

1. Introduction

Allergen Maps LLC ("we," "us," "our") operates the AllergenMaps mobile app (the "Service"). This Privacy Policy explains what information the app handles, where it is stored, and your choices. It is adapted from our website policy for the app specifically.

2. Information Stored on Our Servers

To run the Service, a limited amount of information is stored on our servers:

Account: your name, email address, and a salted password hash, via our authentication provider (Supabase Auth).
Allergen profile: the allergens, diets, and exclusions you select. These are health-related data, which we collect and process with your consent to check medications against your selections. (Unlike our website, where preferences stay only in the browser, the app keeps your profile on our servers so it works across sessions and powers each check.)
People you manage (caregiver mode): each managed person’s allergen selections are stored on our servers under an anonymous identifier only. Their name and relationship are never sent to our servers.
Medication checks: when you scan or enter a medication, the barcode or NDC is sent to our servers to return a result. We also keep a count of checks to enforce free-plan limits.

3. Information Stored Only on Your Device

The following never leaves your device and is never sent to us:

Your medication list and the details you add (strength, how you take it, what it’s for, notes)
Your check history and refill reminders
Details read from a scanned barcode such as lot, serial, and expiration
The names and relationships of the people you manage

4. Camera

The Service uses your device camera only to read a medication barcode. Frames are processed on your device; no photos are taken, stored, or uploaded.

5. Information We Do NOT Collect

Prescriptions or medical records beyond the products you choose to check
Payment or financial information
Biometric data
Precise location
Advertising identifiers or third-party tracking

6. How We Use Information

Providing the Service: authenticating your account and returning medication checks
Enforcing free-plan check limits
Security: rate limiting and abuse prevention
Responding to your support requests
Legal compliance

7. Sharing and Disclosure

We do not sell your personal information and we do not share it with advertisers. We share information only with service providers who process it on our behalf (Supabase for database and authentication; Vercel for hosting), when required by law, or in connection with a business transfer (with notice).

8. Data Retention

Your account and server-side allergen profile are retained while your account is active and deleted on request or when you delete your account. Information stored on your device is removed when you delete it, sign out, or delete the app.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. You can delete your account and its data from within the app (Profile → Delete account). To access, correct, or export the information held on our servers, contact legal@allergenmaps.org. California residents (CCPA) and EU/UK residents (GDPR) have additional rights. Residents of Washington, Nevada, and Connecticut have rights under their consumer health data laws, including the right to withdraw consent and to have consumer health data deleted; contact legal@allergenmaps.org.

10. Children

The Service is not directed to children under 13, and you should not create an account for a child. The "people you manage" feature is intended for caregivers acting for those they are authorized to care for; a managed person’s name stays on your device.

11. Security

All connections use TLS/HTTPS. Server data is stored with our providers’ industry-standard encryption at rest. Privileged keys are server-side only.

12. Changes to This Policy

We may update this Policy from time to time. Changes will be reflected by an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance.