Privacy Policy

Unfrill works without an account. Your food diary, saved foods, goals, and weight stay on your device unless you choose to export them. Food searches and barcode lookups are different: those requests leave your device, and the providers may retain request information.

Unfrill has no advertising or analytics SDK, does not track you across other companies’ apps or websites, and does not transmit HealthKit data, photos, or automatic diagnostic telemetry. Provider request analysis is described below.

Food logs and history, My Foods, Favorites, Recent Foods, nutrition goals, and settings are stored locally. Unfrill has no account or cloud-sync service and does not guarantee cross-device recovery.

Depending on your Apple and device settings, eligible app data may be included in a device backup. Weight entries are stored separately in protected local storage marked to be excluded from device backups. Export Data creates a JSON file only when you request it, including weight data if present. This version cannot import or restore that file. You control where you save or share it.

Camera access is optional and used for barcode scanning and Nutrition Facts recognition. Image recognition takes place on your device; Unfrill does not upload camera images or selected photos. A barcode lookup sends the decoded barcode, not its image. You can decline or revoke camera permission in your device’s Settings.

With your permission, Unfrill reads your latest body weight from Apple Health when you choose to import it. Unfrill does not write to HealthKit or transmit HealthKit data to Unfrill servers or nutrition providers. Imported weight stays in protected app-local storage. You can revoke read access in the Health app or your device’s Settings. Clearing Unfrill’s weight entries does not delete the original records in Apple Health.

Food-search text is sent over HTTPS through Unfrill’s Cloudflare Worker to USDA FoodData Central. The Worker has no persistent application storage or logs, and its observability, tracing, and log exports are disabled. This does not prevent the upstream provider from keeping its own request records. The relay does not forward your device’s IP address or original request headers to USDA; an upstream access log may instead contain the relay’s outgoing IP address.

Data.gov’s published policy permits access logs containing IP addresses, search words, request times, and browser or operating-system information, and states a 180-day web-access-log retention period. It describes security, performance, and usage analysis. That published period is not a guarantee that every USDA API record is deleted at day 180. See the Data.gov privacy policy and USDA privacy policy.

Open Food Facts receives the barcode lookup path, your request’s IP address, and a User-Agent identifying the requesting app. Its published policy permits visitor IP/log records for security, technical analysis, and popularity measurement, with a three-year retention period. This provider-side popularity analysis is why Unfrill’s App Privacy disclosure includes Analytics as well as App Functionality for Search History; it is not advertising tracking.

See the Open Food Facts privacy policy. Its policies for contributions, image uploads, and its own mobile scanning software should not be read as features of Unfrill: Unfrill performs read-only lookups and does not upload photos or food contributions.

Unfrill limits lookup requests to the information needed for the requested result and uses HTTPS for transmission. Data.gov describes physical, electronic, and procedural safeguards and protection against unauthorized access. Open Food Facts describes access restricted to trusted technical administrators, SSH keys, and firewalls. These are the providers’ published safeguards, not a claim that Unfrill controls their systems or has independently audited them.

Search and lookup records may be associated with request identifiers such as IP addresses. Because those records are not guaranteed to be anonymized before collection, Unfrill conservatively discloses Search History as linked to the user, despite having no account or user ID. Unfrill does not use these records for tracking or advertising. Provider retention and deletion rules differ from the local storage rules in this app.

For the limited barcode-lookup information it receives, Open Food Facts’ published privacy commitments and applicable European data-protection obligations provide the same or equal protection described in this policy. Its visitor logs may be retained for three years. Deletion requests remain subject to its published technical and legal limits; deleting Unfrill does not delete those logs. You can exercise your privacy rights by contacting privacy@openfoodfacts.org.

The seven-day app-managed free-access period does not require payment authorization. Unfrill keeps a small marker in your device’s Keychain containing the free-access start time, the latest observed time, and a format version. It prevents clearing or reinstalling the app from automatically restarting free access. It is device-only, is not synchronized through iCloud Keychain or sent to Unfrill or lookup providers, and may survive deleting and reinstalling the app. Clear All Data does not remove this marker.

Continued use of subscription features after free access requires a Monthly or Annual subscription. Apple handles purchases and payment information. Unfrill uses the subscription status supplied by Apple to determine access; it does not receive your payment-card details. Deleting app data does not cancel an Apple subscription. Manage or cancel subscriptions through your Apple account settings.

You can avoid off-device lookup requests by entering foods manually instead of using online search or barcode lookups. Decline or revoke camera and Health access at any time. Stopping lookups or revoking permission prevents future use of the affected feature; it does not erase information already retained by a provider.

Clear All Data removes your local food diary, saved foods, goals, settings, reminders, and weight entries. Deleting the app removes its app-container data; offloading preserves that data. Neither action removes the Keychain free-access marker, original Apple Health records, exported files, existing device backups, Apple purchase records, or third-party request logs. Reinstalling alone does not restore your diary. Manage exported files and backups separately through the services you chose.

Unfrill cannot directly locate or erase USDA/Data.gov or Open Food Facts logs, and cannot promise immediate third-party deletion. Use the providers’ privacy contacts to request access or deletion, or contact us for help. Open Food Facts accepts privacy requests at privacy@openfoodfacts.org; its policy allows technical and legal limits on erasure. Provider policies and applicable retention requirements govern their response.

If you choose to email support, we receive your email address and the message and attachments you send so we can respond. A bug-report draft may include app, operating-system, and device-model details for you to review before sending; it is not automatic telemetry. Do not include sensitive information you do not want to share. Contact support@unfrill.app for help with a privacy or deletion request.

Unfrill is not directed to children under 13. If you believe a child has provided personal information through the app, please contact us.

We may update this policy as Unfrill changes. The effective date at the top of this page will show when the policy was last revised.