Privacy Policy

1 Overview

SpillScam ("we," "our," or "us") is a product compliance scanner app that helps you understand whether food, cosmetic, and household products meet safety regulations across 7 global markets: the European Union, United States, India, China, Australia, United Kingdom, and Canada.

This Privacy Policy explains what information we collect when you use the SpillScam mobile application on iOS and Android, how we use it, and the choices you have.

2 Information We Collect

2.1 Account Information

When you sign in with Google or Apple, we receive and store the following:

2.2 Scan History

Every product you scan is recorded in your private scan history (visible only to you):

• Barcode (EAN-13 / UPC)
• Product name and brand
• Overall compliance status
• Product image URL
• Date and time of scan

2.3 Shopping List

Products you save to your shopping list are stored privately and include the same fields as your scan history plus the category.

2.4 Preferences

Your personalisation choices are stored locally on your device and optionally synced to the cloud if you are signed in:

• Preferred Market — your selected regulatory market (e.g. EU, USA)
• Allergen Profile — allergens you have flagged (e.g. peanuts, gluten)
• Dietary Preferences — diet types (e.g. vegan, halal, kosher)

2.5 Community & Product Data

When you scan a product, the product's details (name, brand, ingredients, barcode, compliance analysis) are saved to a shared global database that all SpillScam users benefit from. This product data is not linked to your identity in the shared database.

If you submit a mismatch report or flag incorrect information, your user ID is recorded alongside the report to prevent abuse.

2.6 Community Votes

When you upvote or downvote a compliance result, your vote is stored linked to your user ID and the product. Votes are used to surface inaccurate results for admin review.

3 Device Permissions

iOS

Android

4 Camera & Photos

Barcode Scanning

When you use the barcode scanner, the camera feed is processed entirely on your device to detect the barcode. No video or images are recorded or uploaded during barcode scanning — only the detected barcode string (e.g. "0885446128994") is sent to our servers for product lookup.

Label Photo Analysis

When you photograph a product label for AI analysis:

• The photo is compressed on your device
• It is uploaded to Firebase Storage (encrypted in transit and at rest)
• It is sent to Google Gemini AI for product data extraction
• The photo URL is saved alongside the product record in our shared database
• Photos are verified by AI to confirm they show a product before being saved

You can choose to use your phone's camera or select an existing photo from your library. You are never required to submit a photo — you can enter product details manually.

5 Third-Party Services

SpillScam relies on the following third-party services. Each has its own privacy policy.

Firebase (Google)

We use Firebase Authentication, Firestore (database), Storage (photos), and Cloud Functions. All data is processed and stored on Google infrastructure. Firebase Privacy Policy

Google Sign-In

Used for account creation. We receive your name, email, and profile photo. Google Privacy Policy

Apple Sign-In

Used for account creation on iOS. Apple may provide a private relay email. Apple Privacy Policy

Google Gemini AI

Product compliance analysis. We send product information (name, brand, ingredients) and optionally product label images to Google's Gemini AI model for analysis. Gemini Terms

OpenAI

Product lookup via web search. When a product is not found in public databases, we perform a web search using OpenAI's GPT-4o model. We send the product barcode as the search query. OpenAI Privacy Policy

Public Product Databases

All public database lookups send only the barcode number — no personal information is transmitted.

6 Data Storage & Security

Your data is stored in the following locations:

• Firebase Firestore — User profile, scan history, shopping list, preferences (Google data centres; encrypted at rest and in transit)
• Firebase Storage — Product label photos (encrypted; Google data centres)
• Your Device — Cached login state and preferences (via local storage; never shared)

All communication between the app and our servers uses HTTPS (TLS) encryption. API keys are stored securely in Google Cloud Secret Manager and are never included in the app's source code.

We do not store payment information. SpillScam is a free app with no in-app purchases.

7 Data Sharing

We share data only in the following limited circumstances:

• Service providers: Firebase, Google Gemini, and OpenAI receive data only as needed to provide the service (product analysis).
• Public product database: Product scan results (barcode, name, ingredients, compliance) are stored in a shared database accessible to all SpillScam users. This data is not linked to your identity.
• Legal obligations: We may disclose data if required by law, court order, or to protect the rights and safety of our users.

8 Data Retention

When you delete your account, all personal data (profile, scan history, shopping list) is permanently deleted. Global product and compliance data you contributed to the shared database is retained for community benefit but is not linked to your identity after deletion.

9 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Update inaccurate or incomplete information
• Deletion — Delete your account and all associated personal data
• Portability — Receive your data in a structured, machine-readable format
• Objection — Object to processing of your data in certain circumstances
• Restriction — Request that we limit how we use your data

EU/UK users (GDPR): You have all the rights above. Our legal basis for processing is legitimate interest (product safety information) and consent (account creation).

California users (CCPA): You have the right to know what data we collect, to delete it, and to opt out of sale (we do not sell data).

To exercise any of these rights, contact us at the email address below.

10 Account Deletion

You can delete your account at any time directly within the app:

1. Open the app and go to Profile
2. Scroll to the bottom and tap "Delete Account"
3. Confirm the deletion when prompted

Upon deletion, we permanently remove:

• Your profile (name, email, photo)
• Your complete scan history
• Your shopping list
• Your Firebase Authentication account
• All locally cached data on your device

11 Children's Privacy

SpillScam is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child under 13 has created an account, please contact us immediately at contact@khenitech.com and we will delete the account and associated data promptly.

For users in the European Union, the minimum age is 16 unless local law specifies otherwise.

12 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. For significant changes, we may also notify you within the app.

Your continued use of SpillScam after any changes constitutes your acceptance of the updated policy.