Who We Are
Kaibu is a food scanner app that helps users scan products and understand nutritional information and ingredients in relation to their personal health needs. This privacy policy describes how we collect, use, and protect your information.
Kaibu is operated by a team dedicated to improving access to food transparency. For legal inquiries, please contact us through the app's settings.
What We Collect
When you use Kaibu, we collect:
- Account information: Email, username, and authentication details from Clerk
- Health profile data: Your personal list of ingredients to avoid (when you create one)
- Scan history: Records of products you scan
- Usage analytics: App interactions and feature usage (optional, you can disable this)
- Device information: Device type, OS version, and app version
- Mailing list address: Your email address, if you subscribe to the mailing list on kaibu.app (optional, and separate from your account)
How We Use Your Information
- To provide core app functionality: scanning products and retrieving data
- To personalize your experience with your ingredient preferences (only on your device or with your explicit consent)
- To improve the app through aggregated, anonymized analytics
- To communicate important updates about your account
- To comply with legal obligations
Our Data Processors
We use trusted service providers to operate the app:
- Clerk - User authentication and account management (US-based, subject to EU-US Data Privacy Framework)
- PostHog - Analytics platform (EU instance available)
- Anthropic - AI model provider for generating personalized notes
- Amazon Web Services (Amazon SES) - Sending account emails and the mailing list (EU, Ireland)
- Cloud Hosting Provider - VPS hosting and database storage (encrypted at rest and in transit)
- Storage Provider - Object storage for cached product images
- Apple App Store and Google Play - App distribution (as required by their terms)
- Open Food Facts - Product data source (when you upload photos)
Your Health Data
Information about your health conditions and ingredient preferences is especially sensitive. We follow these practices:
- Explicit consent: If you create an ingredients list, you're explicitly consenting to store this health data. You can delete it at any time.
- Limited sharing: We send only a category label (not your ingredient list) to Anthropic for generating your personalized notes.
- Never sold: We do not sell, rent, or trade your health information.
- Retention: Your ingredient list is stored only while you keep it. Scan history is retained for 24 months. Personalized notes are updated when the AI model changes.
Analytics and Tracking
Analytics is disabled by default. If you opt in through "Help improve Kaibu" in your Profile, we track:
- Which features you use and how often
- Aggregate product grades and categories (never individual ingredients or health conditions)
- General device information
We do not track: precise location, health conditions, ingredient choices, dietary notes, or your name. You can disable analytics at any time in your Profile.
Mailing List
You can subscribe to the Kaibu mailing list on kaibu.app. We store the address you enter and the date you entered it, and nothing else. Every email has an unsubscribe link, and unsubscribing removes your address from the list. The list is kept on our own hosting and is never sold, rented, or shared. Subscribing does not create a Kaibu account, and an account does not subscribe you.
Your Rights
You have the right to:
- Access: Request a copy of all your data
- Delete: Remove your account and all associated data (in-app delete button)
- Correct: Fix or update your information
- Portability: Download your data in a portable format
- Object: Opt out of analytics and marketing communications
Children's Privacy
The Kaibu scanning feature is available to anyone aged 4+. The ingredient profile feature requiring explicit health data consent is restricted to users aged 16+. We do not knowingly collect information from children under 13 without parental consent.
Data Security
We implement industry-standard security measures including:
- Encryption at rest on our servers
- TLS encryption in transit
- Regular security backups retained for 30 days
- Limited access controls restricted to authorized personnel only
Data Breaches
In the unlikely event of a data breach involving your information, we will notify you and relevant authorities within the timeframes required by applicable law (typically 30-72 hours).
International Transfers
Your data may be transferred to and processed in countries other than where you reside, including the United States. We rely on the EU-US Data Privacy Framework and contractual safeguards (Data Processing Agreements) to protect your data in international transfers.
Changes to This Privacy Policy
We may update this privacy policy from time to time. We will notify you of material changes by updating the version date and prominently displaying a notice in the app.
Contact Us
If you have questions about this privacy policy or how we handle your data, please contact us through the app's settings or at the email address listed in your account settings.