Legal
Last updated: 16 May 2026 · Effective date: 23 April 2026
This Privacy Policy explains how Arovya ("we", "us", "the app") handles your information. We've written it in plain English. If anything is unclear, contact us at the address at the bottom of this page.
Arovya is an indie app developed by Anand Basavaraj Muddi, based in the United Kingdom. We are the data controller for any information you provide.
Correspondence address:
Anand Muddi
Unit 166188
PO Box 7169
Poole, BH15 9EL
United Kingdom
For privacy questions, contact: support@arovya.uk
The following information is stored exclusively in your device's local storage (UserDefaults). It is not intentionally sent to us or to any third party as part of normal app operation:
If you delete the app, this information is removed with it.
When you scan a barcode, we send the barcode number to Open Food Facts (openfoodfacts.org) to retrieve product information. Open Food Facts is a free, open product database. We send only the barcode — no information about you. See Open Food Facts' privacy policy at openfoodfacts.org/privacy.
When a product isn't in Open Food Facts and you choose to scan the label with AI, the photos you take are sent through our Cloudflare Worker (a security and rate-limiting proxy we operate) to OpenAI for ingredient and nutrition extraction.
What we send:
What we do not intentionally send:
OpenAI processes the photos to extract text and structured data, then returns the result. We use OpenAI's API service. Under OpenAI's API data handling terms, data submitted via the API is not used to train OpenAI's models by default. After extraction, only the front-of-package photo is retained (see Section 4.3); ingredients and nutrition photos are used for extraction only and are not kept. For current details on OpenAI's data handling, review their privacy and API documentation.
When AI label scanning successfully identifies a food product, we retain the front-of-package photo you took. The image is stored in Cloudflare R2 (Western Europe region) alongside the extracted product data described in Section 4.4, so that when other users scan the same product in future, we can recognise it faster and avoid re-processing the same label. This optimises the service for all users and reduces the cost of running Arovya.
We store only one image per successful scan — the front-of-package photo. Photos of the ingredients list and nutrition panel are not retained after processing. The stored image is not linked to your name, identity, or account; it sits alongside the anonymised data described in Section 4.4.
After a successful AI label scan, we save the extracted result to our database, paired with a hashed device identifier. This helps us recognise commonly-scanned products faster in future and improve coverage in regions where Open Food Facts has gaps.
What's stored:
What's not intentionally stored:
The device identifier is a random UUID generated on first install and stored only on your device. We do not intend to collect or store the raw value — only a salted hash of it. This lets us count how many distinct devices use the service for rate-limiting and abuse prevention, without being able to identify any individual.
If a previously-scanned product looks wrong, you can report it as such from within the app; this clears the cached entry and triggers a fresh AI scan. The new result replaces the previous record under the same barcode. Free users have a monthly limit on these corrections (3 per month) to prevent abuse; Pro subscribers have unlimited corrections. Corrections are processed using the same flow described in Section 4.2 and produce a new entry as described in this section.
To prevent abuse of the AI scanning service, our Cloudflare Worker tracks scan counts using the same hashed device identifier. Counts are kept for short rolling windows (10 minutes, 1 hour, 1 day) and then automatically expire.
We use Mixpanel to understand which features are used. Events are tied to an anonymous Mixpanel-generated identifier, not to your name or any account.
Events we track:
screen_viewed (with a screen name like "scan_home")scan_started, scan_completed (with score and data source)upgrade_screen_viewed, upgrade_completedpurchase_marked_bought, purchase_marked_didnt_buy, purchase_decision_cleared — fired when you mark a scanned product as bought, not bought, or clear that status. We record only the score range (low / medium / high) — no product names, brands, or barcodes.correction_initiated, correction_completed, correction_failed, correction_limit_reached — fired when you report a scanned product as wrong and trigger a fresh AI scan. We record only the original data source ("OFF" / "Cache" / "AI"), the score range, and (for failures) a categorical reason such as "non_food" or "network_error". No product names, brands, or barcodes are included.We do not intentionally attach your name, supplement list, adherence data, goals, or diet to any analytics event. Mixpanel is hosted on its EU server (api-eu.mixpanel.com) for GDPR compliance.
We use Sentry to receive crash reports so we can fix bugs. Sentry crashes contain device model, operating system version, and a stack trace. We have explicitly disabled the collection of personal identifying information (sendDefaultPii = false) — Sentry is configured not to collect your IP address, cookies, or user identifiers.
We use TelemetryDeck (privacy-first analytics, hosted in the EU) to understand how Arovya is used in aggregate. TelemetryDeck collects anonymous device and usage information including device type, operating system version, country (approximate, derived from network), language preference, and counts of in-app events (such as scans started, tabs viewed, and Pro features explored).
Events we track include: app launches, onboarding progress, tab navigation, scan flow stages, paywall views, Pro purchase events, and supplement-related interactions (such as adding, removing, or toggling supplements). Where parameters are attached to events, they use anonymous identifiers (e.g., supplement IDs) or bucketed values (e.g., score ranges) — never your name, scan content, or other personally identifying information.
TelemetryDeck does not assign persistent user identifiers. The data is anonymous and cannot be linked back to individual users. You can read TelemetryDeck's privacy policy at telemetrydeck.com/privacy.
When you subscribe to Arovya Pro:
$RCAnonymousID), not your name, email, or Apple ID.We do not collect:
| What | Where | How long |
|---|---|---|
| Your data on your device | Your iPhone | Until you delete the app |
| AI scan results in our database | Cloudflare D1 | Retained for as long as reasonably necessary to improve product recognition and operate the service. Wrong-product corrections replace previous records under the same barcode. |
| Product front-of-package images | Cloudflare R2 | Retained for as long as reasonably necessary to improve product recognition; we may remove or replace images as coverage improves |
| Rate-limit counters | Cloudflare KV | Auto-expire after 10 min / 1 hour / 1 day |
| Mixpanel events | Mixpanel (EU) | Per Mixpanel default retention (currently up to 5 years) |
| Sentry crashes | Sentry (EU) | Per Sentry default retention (currently 90 days) |
| TelemetryDeck events | TelemetryDeck (EU) | Per TelemetryDeck default retention |
| Subscription receipts | RevenueCat / Apple | Per Apple and RevenueCat policy |
Because almost all your personal information stays on your device, most data-subject requests are handled by you simply using the app:
For the small amount of data on our servers (anonymous scan results and product images), we do not hold information that directly identifies you. If you would like us to attempt to locate and delete records associated with your specific device, you can contact support@arovya.uk and provide your device identifier from the app; we will make reasonable efforts to locate matching records and remove them.
Legal basis for processing. Where we process your personal data, we rely on the following legal bases under UK GDPR: legitimate interests for operational data such as rate limiting, abuse prevention, crash diagnostics, and anonymised product records used to improve the service; contract performance for subscription management; and consent where required by applicable law.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you believe your privacy rights have been infringed.
Arovya is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have received personal information directly from a child under 13, we will take reasonable steps to delete it. If you are a parent or guardian and believe a child has provided information to us, please contact support@arovya.uk.
Some of our service providers process data outside the UK and EU:
Where data is transferred outside the UK, we rely on safeguards offered by our providers, such as Standard Contractual Clauses or equivalent transfer mechanisms where applicable.
We may update this policy. Material changes will be communicated via the app or by updating the "Last updated" date at the top. Continued use after changes constitutes acceptance.
Anand Basavaraj Muddi
Unit 166188
PO Box 7169
Poole, BH15 9EL
United Kingdom
Email: support@arovya.uk
For UK GDPR matters, our supervisory authority is the Information Commissioner's Office (ico.org.uk).