Aleaf: Privacy Notice

Last updated: 6 November 2026. Version: privacy-2026-11-06b.

What changed: the website now also counts visits to its home page, without cookies, and you can turn that off. Section 3 explains what is counted. The record our team keeps of changes to your preferences is now described more fully: it also covers how you heard about Aleaf and your email updates choice. The Google Play buttons on the website now add a note that you came from our website.

1. The short version

This notice, also called our Privacy Policy, explains what personal information Aleaf collects, why we collect it, who sees it, how long we keep it and what you can do about it. "Aleaf" means the Aleaf mobile app and the website at aleafapp.com. The notice also covers our early access waitlist. It replaces every earlier version.

Aleaf is run by ALEAF STUDIOS LTD, a company in London, and is for people aged 18 and over.
You can scan products as a guest, with no account. Barcodes are read on your phone, and the live camera picture is not uploaded.
A label photo you send goes to Google's Gemini AI to be read. Section 3 says when we also keep a photo.
Your allergy, diet and boycott choices are optional. They can show your health, your beliefs or your views, so we treat them with extra care. We use them to give you your own results, never for advertising or marketing, and we never sell them.
We measure how the app is used with an analytics provider and Google's Firebase tools. We also count visits to the home page of the website with the same analytics provider, without cookies. Section 15 explains the app tools and section 3 explains the website. Both say what you can do about it.
We do not sell your personal information, and we do not use it to show you other companies' advertising.
If you invite friends or join the leaderboard, we keep records of that. Section 3 explains.
Corrections you send, and the photos with them, can be opened by other people who are signed in to Aleaf. Section 3 explains.
You can delete your account in the app: open Profile and tap Delete my account. Some records stay. Section 17 lists them.
You can ask to see, correct or delete your information, and you can complain. Section 9 explains how.

"Personal information" means anything that identifies you or can be linked to you. Some features, such as Aleaf Pro, the invite leaderboard and prizes, are not open to everyone yet. We describe them so you know what happens to your information if they open for you, and we write "if" or "when" for them. If something is unclear, email support@aleafapp.com.

2. Who we are

Aleaf is run by ALEAF STUDIOS LTD, company number 17401876. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. In this document, "we", "us" and "our" mean ALEAF STUDIOS LTD. We are the controller of your personal information, which means we decide how and why it is used.

Email us at support@aleafapp.com. You can also write to us at our registered office.
We have not appointed a data protection officer.

UK data protection law and the UK rules on electronic communications (called PECR) apply to us. If you live in the European Economic Area (the EU, Iceland, Liechtenstein and Norway), EU law may also apply. The UK regulator is the Information Commission, still called the ICO. Section 9 says how to complain.

3. What we collect, and why, by what you are doing

This section follows what you do in Aleaf. For each activity we say what we collect and what we use it for. Section 5 gives the legal reason for each use. Section 6 says who else receives information. Section 8 says how long we keep it.

Using Aleaf as a guest

You can use Aleaf without an account. Aleaf never signs a guest in anonymously, so we hold no account for a guest.

On first use, Aleaf runs a short setup: your country, language, diets and allergies, and boycott filters. Each choice is saved on your phone. If you create an account, Aleaf copies the choices into it. If you sign in to an account that already has choices, your setup allergies and diets are added to that account's lists.
A guest sees full results for a small number of different products. The barcodes and how you scanned them are kept on your phone and added to your My List when you sign in. After that number, the next new product asks you to sign in.
Even as a guest, the app contacts Google servers and the servers of a network and security provider to check that you are online. Analytics use a random ID that is not linked to a name (section 15). On Android the app reads the install link details from Google Play (see "Invite codes and inviting friends"). It asks your phone to show its notification prompt, but we save no token for a guest.
You can read this notice at aleafapp.com/privacy. The app links to it in Settings and on the card that asks a guest to sign in.

Your account

You can create an account with an email address and a password, with Google, or with Apple (Sign in with Apple is available on iPhone). We collect:

your name and email address. Google gives us your name, email address and a link to your profile picture. Apple gives us your name (the first time only) and an email address, which can be a private relay address that hides your real one;
how you signed in, and the IDs that go with it;
your country, which every account needs. You choose it at setup or when Aleaf asks. Aleaf may suggest one from your phone's region setting. We never ask for your phone's location;
your preferred language;
a phone number, an age range (a choice of windows) and a notification setting. All three are optional;
the date you joined, the date you last used the app, and counts of your scans and favourites.

Your password goes to Google's Firebase Authentication, and we never see it. When you reset your password, Firebase sends the email to the address you typed. We do not send a verification email when you sign up.

The app keeps a copy of your profile on your phone so that it opens quickly. Signing out removes it.

Your preferences

You can tell Aleaf about:

allergies (the app covers eight: peanuts, tree nuts, dairy, gluten, soy, shellfish, eggs and sesame);
diets (five, for example vegan, vegetarian or pork free);
boycott filters: a master switch and four lists, called Boycott for Palestine, Mondelez, Nestle and Kellogg's. All are off until you switch them on;
three Join questions, which Aleaf asks only on the leaderboard Join screen, only if you join as a paying member, and once for each account: your age range, your gender (woman, man or non-binary) and how you heard about Aleaf (if you choose Other, the short text you type). You need to answer each question before you can join, but "Prefer not to say" counts as an answer, and when you choose it we store no answer for that question. If your profile already holds an age range, that question starts filled in, and we keep it unless you change it. We keep the time you answered, so that we do not ask again.

This is sensitive information. Allergies are information about your health. Diet choices can show your religion or beliefs. Boycott choices can show your views. The law calls this "special category data" and gives it extra protection.

You choose whether to tell us about allergies, diets and boycott choices. You can remove them at any time in Profile.

We use these choices to personalise your results, for example to show a warning when an ingredient matches an allergy. Our team also keeps a record of changes to them, described next, to help with support. We never use them for advertising or marketing, never sell them and never show them to other users.

Our team can see a record of changes to your allergy, diet, boycott, language, country, age range, how you heard about Aleaf, email updates, name, photo and notification settings. It shows which setting changed, what it changed to and when. For a name or photo it only shows that it changed. For how you heard about Aleaf, it holds only the answer you picked from the list, and the record does not copy the words you type if you choose Other. Our team can also see your Join answers (age range, gender, and how you heard about Aleaf, including any words you typed for Other) on your profile in our admin tool. We keep the record for 12 months and use it for support and to investigate problems. You cannot see it in the app. You can ask us for a copy.

What analytics receives about your choices. Analytics records whether you have set allergies, diets or boycott filters, and how many. It also records when a warning or a boycott banner is shown for a product you scanned, and which product. These records are linked to your account id, so they can show which products matched your choices. It does not receive the choices themselves. Versions of the app made before mid October 2026 did send the lists of allergies and diets, so an older analytics profile may still hold them. You can ask us to delete it (section 17).

What you scan, My List and Favourites

Barcodes are read on your phone. The live camera picture is not sent anywhere and we do not store it. If you pick a photo from your gallery to read a barcode, that is also read on your phone.

Aleaf looks a product up in its own catalogue first, then asks a public food database (section 6) if it is not there. If that fails too, you can photograph the label.

When you are signed in, Aleaf saves each product you scan in My List. For each one we store the barcode, the score and the boycott result we showed, whether the product was left unrated (alcoholic drinks are "Not rated") or had no usable data, how you scanned it and the time. Favourites work the same way. You can remove a product from My List at any time. It disappears at once and is deleted from your account a few seconds later, after a short Undo window.

Each time a result opens, a counter on the shared product record goes up by one. It is not linked to you.

Photos and the camera

Aleaf asks for access to your camera and uses your phone's photo picker when you choose a photo. It does not use your location, contacts or microphone.

Aleaf uses artificial intelligence (AI) to read label photos and to help work out some product details, such as how processed a food is. When you send a label photo, it is sent to Google's Gemini AI service, through Google Firebase, to be read. AI can make mistakes, so check the pack.

A label photo is a photo of an ingredient list or nutrition table that you take or choose and send for reading. You must be signed in to send one. This is what happens:

The whole photo goes to Gemini with fixed instructions. Gemini sends back the printed text it reads, such as ingredients and nutrition values. We use that text to build or complete the product record.
The request also carries two technical tokens, your sign-in token and an app-check token. They let Google link the request to your account, even though the instructions do not name you.

What Google does with label photos is set by Google's own terms for that service. See Google's Gemini API terms.

Aleaf does not save a copy of a label photo in our own storage after Gemini has read it, with these exceptions:

if you scan a new product and Aleaf cannot read your photo twice in a row, the photo is uploaded to our storage and sent to our team as a "new product" correction;
if you add missing details from the Results screen and the reading is unsure, or the photo does not show a label, the same photo is uploaded as a correction;
if you send a photo yourself as a correction or as feedback (see the next part).

Our team can open a stored photo when reviewing a correction, and can ask Gemini to read it again. Aleaf also sends product text (ingredient text, name, brand, category and language) to Gemini to clean up, translate, classify or check it. This happens for guests too. The text is about the product, not about you.

Please photograph labels only, and keep people, faces and personal documents out of every photo you send.

Reports, feedback and corrections

You can tell us about a problem in several ways. We store what you send, the time and your account ID.

Corrections: a new product photo, name, brand, ingredients, nutrition values, or a new product. We store the type, the change or photo you propose, the product, how you scanned it, and a copy in your own list of corrections.
Feedback: the topic, your message, the product, up to five pictures with their file names, your app version and your language.
"This isn't what I scanned" reports: the same details as feedback, with one optional front-of-pack picture. To spot misuse, our servers also keep a scrambled code made from your account ID, the scrambled device keys of your phones, a scrambled form of your sign-in email, and a pointer to your first report. We use these only to count different reporters and to spot repeated misuse.
"Tell us about this result" messages about a boycott listing: up to 1,000 characters, with the lists you had switched on, the matched entry, your language, app version and platform. Only you and our corrections team can read the message, and it is not copied into the support email. Please leave out personal details.

Each new report, correction or piece of feedback sends a notice to our support inbox through our email delivery provider. A feedback notice holds your message, the product, the number of photos and your email address (or account ID). A correction notice holds the product, the type, the proposed change, a link to any photo and your email address (or account ID). The text of a boycott message is never put in the email; that notice names only the product, the list entry it matched and your email address or account ID.

Our team reviews corrections. If we approve a product photo, it becomes the picture for that product, and anyone using Aleaf can see it. A confident AI reading of a photo can fill a blank field on a product record at once, with no review. Our team can stop an account from sending corrections if it is misused, and we keep the reason.

Other people who are signed in to Aleaf can open correction records. A record shows the account ID of the person who sent it and a link to any photo, and they can open the photo files too. Boycott messages are the exception: only the author and our team can read them.

Product details you helped add

The shared product record can be read by anyone, even without an account. When your photo is read by AI and fills a blank field on it, we write your account ID and the time on that record, to show where the change came from. The account ID is a random string, not your name or email address, but it sits on a public record.

Deleting your account does not remove your account ID from public product records.

The product details themselves, and any photo we approved as the product picture, belong to the product and stay.

Invite codes and inviting friends

Each signed-in account gets a short invite code and an invite link (aleafapp.com/r/ followed by the code). We create it when you open your Profile. You share it with your phone's own share menu. Aleaf does not read your contacts and does not see who you send the link to.

When someone adds your code within 7 days of creating their account, we record that you invited them, the code, how the code reached them and the date. The number of people who joined on your profile goes up by one.

A code can reach a new account by a link you tap, by an automatic read (described below), or because you paste a link or type the code by hand.

A link you tap. The app keeps the code on the phone until you sign up.
Android, automatic. The first time the app opens after an install, it asks Google Play for the install referrer, which is the information that came with the install link. The app uses the campaign details in it to tag later analytics events, and sends one event saying whether an invite code was present. It does not keep the code at that point. This happens for every new Android install, including for guests. When you create a new account, and only if no code is already waiting, the app reads the install referrer again and keeps an Aleaf invite code if it finds one.
iPhone, automatic. Once per install, after you create a new account and only if no code is already waiting, the app reads your clipboard. It accepts only text that starts with "aleaf-ref:" followed by a code. Anything else is ignored and is not stored or sent. Your iPhone may ask whether Aleaf can paste, or show a short notice, when this happens.

What each person sees. You see how many friends joined and, if counting is open, how many count. You never see who. Your friend sees a short "Invite credited" message. When your friend adds your code, our server sends their phone the first word of your profile name. The app does not show it. A small number of Aleaf staff can see invite records, including both names, each person's plan status and the reason an invite does or does not count.

How we decide whether a friend counts. We read both people's store subscription records (the plan, its status and dates, and whether it was bought at full price or with an offer, a discount code, a gift or as a test). We compare the sign-in email addresses of the two accounts after removing small tricks (anything after a "+", and dots in Gmail addresses). We check whether they used the same phone, using the scrambled device key (see "The free-scan allowance"). We do not store the email addresses from this check. We store the result on the invite record: its status, the reasons and any flag. A same-phone finding is remembered even after the phone record expires. We also keep a running total of how many of the invites you made count, and delete it when you delete your account. These checks run when someone adds an invite code, and a nightly check repeats them, whether or not the leaderboard has opened. Some of these steps are automatic and can stop an invite from counting. You can ask for a person to look again (section 9).

If you are the friend, we run the same plan, device and email checks on you when you add an invite code. If you later buy Pro and counting is open, the person who invited you may be told that a friend now counts. We never tell them your name or which plan you bought.

The leaderboard and prizes

The leaderboard is optional and is not open to everyone yet. It is for Pro members aged 18 or over who live in a country where we have opened it. This part applies only if it opens for you and you choose to join. The checks on whether an invited friend counts are not part of it: they run whenever someone adds an invite code, and are described under "Invite codes and inviting friends".

Prize rules are published before a season starts.

When you join we store the date and time; the country from your profile; your age tick and Prize rules tick, with the exact wording, version and language; the app version, platform and the screen you joined from; and a count of how often you have joined and left. You can join at most 3 times in any 30 days.

Your rank. We work out your place among members from the number of your friends who count, and show you a label such as "Top 25". Other users never see it, except on the public board for a member in a winning place who has turned it on. A small number of Aleaf staff can see exact ranks because they run the competition.

The public board. It is off unless you turn it on, with its own tick. If you do, we store your display name and a record of your agreement (the wording version, language and time). A person at Aleaf checks a new or changed name before it appears. For winning places with at least the number of counted friends that the Prize rules set, the board shows your place, display name and country flag. It does not show your account, your email address or who you invited. Anyone signed in to Aleaf can see the board while it is open, and anyone can copy what they see.

Reports. If you report an entry, we store the reason and your optional note (up to 200 characters). The report does not carry your account. We keep a short scrambled code made from your account and the entry, only to count different reporters and stop repeat reports, and a daily count of reports your account sent. A nightly check removes members whose profile says they are under 18.

If you win. We store your place, your count of friends, how we can reach you (whether notifications are on, whether your email is verified, your sign-in method and whether you hold a paid plan) and the time of the sign-in you used to claim. You confirm again that you are 18 or over, and a separate tick records whether we may announce you. We tell a winner with one notification and one inbox message that say only that a message is waiting, and send one reminder before the reply date. For a prize that needs delivery, we also ask for your full name, address, postcode, country and phone number. We use these only to arrange the prize and share them only with the company that gives you the prize. Only a senior administrator can see them in the app, masked until opened, and every look is logged.

Aleaf Pro and purchases

Aleaf Pro is a yearly plan that you buy through the App Store or Google Play. It is not open to everyone yet. If you buy it, Apple or Google takes the payment. We do not receive your card details. We keep:

Your plan, its price step (Seed, Sprout or Tree), its status, its dates and whether it renews.
The store, the store's order or transaction reference, the amount and the currency.
Any Aleaf discount code you used, and when.
A random account token that links the store purchase to your account (a random ID for Apple, a scrambled form of your account ID for Google).

Our servers check each purchase with Apple or Google, and the stores tell us about renewals, cancellations and refunds. Deleting your Aleaf account does not stop your plan. You stop the renewal in your App Store or Google Play settings. Staff with the payments permission can see purchase records. We count refunds for each account and each phone, and a second refund is flagged for a person at Aleaf to look at. If two purchases that used an Aleaf discount code are refunded, we do not accept another Aleaf discount code from that account.

The free-scan allowance

You can use Aleaf free for a limited number of products or days. To apply that limit fairly, a signed-in account on a recent version of the app does the following. Guests are not counted this way.

The phone makes a scrambled device key from its own identifier. On Android that identifier is the Android ID. On iPhone it is an ID kept in the iPhone Keychain, which survives deleting and reinstalling the app. Only the scrambled key leaves the phone. Our server scrambles it again with a secret.
Each time a new product is counted, the app sends the scrambled key and the barcode. The first time, it also sends up to 10 barcodes that the phone counted earlier, for example while you were a guest. Our server keeps a device record: the key, the platform, the app version, when it was first and last seen, the barcodes counted with their times, the number of refunds made on that phone, and the IDs of up to 10 accounts that used the phone. It also keeps a row per counted product under your account. The server counts products even when it is not blocking anyone.

We use these records to apply the free allowance, to stop people getting round it, and for the same-phone check on invites. A device record expires 400 days after the last scan counted on the phone. When you delete your account, your account ID leaves the device record, but the counted barcodes stay, so that deleting and re-creating an account cannot reset the allowance. Staff with the payments permission can see these records.

Notifications and your inbox

If you allow notifications, we store a push notification token for each of your devices, with its platform, and a setting that says whether notifications are on. We use Google Firebase Cloud Messaging, and Apple's push service on iPhone. Aleaf asks your phone to show its notification prompt when you first open the app, even as a guest, and again when you sign in. Signing in also switches notifications back on in your account settings (section 16 says how to turn them off).

We send notifications from these sources:

messages written by our team, to everyone, to a group chosen by country or language, or to one person. They can carry a picture, which the app downloads from the web address our team chose;
the result of a correction or a report, or a moderation decision about your account;
"product updated" notices to people who scanned or saved a product that was updated (at most one per person per day, and up to 300 people per change);
invite and prize notices, if those features are open to you.

Every message is also saved in your in-app inbox, even if push is off. The inbox shows your newest 100 messages. You can delete your own messages. We keep a history of messages sent by our team, with the sender's email address and, for each person, whether delivery worked.

Email updates and support email

Email updates. On the email sign-up form there is an unticked box: "Email me news about new Aleaf features and offers." The same choice is a switch in Settings. It is hidden for guests, for accounts with no email address and for profiles that say Under 18. When you switch it on or off, our server records the choice, the wording and its version, the language, where you made the choice, your email address, whether Google or Apple has verified it, your platform, your app version and your age range. We keep these records until you delete your account.

Support email. If you email support@aleafapp.com, we keep your message and our replies. We have not set a fixed period for support email. Our support mailbox is hosted by an email provider (section 6). Our tool for deleting an account cannot reach the mailbox.

The early access waitlist

The waitlist at aleafapp.com/join is separate from an Aleaf account. If you join, we collect:

your name or nickname, used only to greet you;
your email address;
whether you use an iPhone, an Android phone or are not sure, and the language of the page;
a short tag showing which sign or card led you there (it names a channel, never a person);
a record of your consent: the exact wording you saw, its version, the version of this notice, the time and your tick confirming that you are 18 or over (people who joined before that wording was used ticked an older wording that said 16 or over);
up to four earlier spellings of your name, if you fix your sign-up within 24 hours;
later: when you confirmed or unsubscribed, which emails we sent, and whether one bounced or was marked as spam.

We send waitlist emails by hand, through our email delivery provider. Our emails contain no tracking pixel of our own. When you sign up, we check that the domain of your email address (the part after the @) can receive mail. We store no IP address with your sign-up. To stop automated abuse, we briefly keep a scrambled version of your IP address, only to count sign-ups from one connection. We aim to delete it within about 20 minutes. If that does not happen, Google's automatic expiry removes it within a few days at the latest. We also count visits, sign-ups and taps on our Instagram link. These counts contain no personal information.

Technical and usage information

Our tools and the companies we use receive technical information: your IP address, device model, operating system, app version, language, the time and a random installation ID. Our analytics and crash tools also receive what you do in the app (section 15). Your phone checks that it is online by contacting Google servers and the servers of a network and security provider about every five seconds while the app runs. It also checks Apple or Google Play for the newest app version. These checks show your IP address, and your phone's country and language, to those servers.

Staff records

The admin tool keeps a record of changes that our staff make. A line can hold the staff member's email address, the type of change and sometimes the account ID of the person it concerns. We keep these records as proof of what was changed and to answer complaints. They stay when you delete your account.

Our website

The website at aleafapp.com has the home page, invite pages, this notice, the Terms, the About page, the delete-account page and the waitlist. It sets no cookies and shows no advertising. It uses our analytics provider only to count visits to the home page, as described below.

The website is delivered through Google Firebase Hosting and its delivery partners, who see your IP address, the time, the page you asked for and your browser details.
The home page and invite pages load fonts from Google Fonts, so your browser contacts Google. The home page also asks Google's database for our app rating, which sends your IP address to Google.
Your browser's local storage (not cookies) can hold up to four items: your language choice (aleaf_lang); a saved copy of the app rating for up to 12 hours (aleaf_ratings_cache_v1); on the waitlist page, a sign-up our server has not yet confirmed (aleaf_join_pending_v1), dropped after 48 hours; and, only if you use the page that turns visit counting off, a flag that records your choice (aleaf_stats_off).
The Google Play buttons on the home page and on invite pages add a note that you came from our website to the Google Play link, and the source tag of the link you used if it had one. An invite page also adds the invite code. When you tap a link to Instagram or an app store, that site sees your IP address.

Counting visits to the home page. When you open the home page (never the waitlist or the invite pages), a small script of ours sends a page view to our analytics provider, and a page left event when you close or leave it. They carry the page address without anything after a question mark; the name of the website you came from, not its full address; a short source tag if the link you used had one that we added, for example "instagram"; your browser language, your browser family and your device type, worked out on your device; how far down the page you went and how long it was open; and your approximate location (country, region and city, and your time zone), which the provider works out from your IP address when the event arrives. Like any web request, your browser's standard request details, such as its user-agent header, and your IP address reach the provider with each visit. The provider uses your IP address to work out your country and city and does not keep it on the stored visit record. The script saves nothing on your device and sets no cookie, and it gives each visit an ID that exists only while the page is open, so we do not link one visit to another. We do not record your screen, your clicks or anything you type, and we do not link these counts to the app or to any account. We use them to see which pages are read and which links bring people to the website, so that we can improve it. You can turn counting off at aleafapp.com/stats, and counting is off when your browser sends a Global Privacy Control or Do Not Track signal.

4. Where your information comes from

We get information from you (what you type, choose, scan, photograph and send); from your phone and the app (technical information, and the choices saved on your phone during setup); from Google and Apple (your sign-in details, and the status of a Pro purchase); from other users (an invite code, or a report about a leaderboard name); and from our own systems (your scores, your standing, and the results of fraud checks).

Product information and credits. Product facts are not personal information, but we name our sources. Some product information comes from an open food database. (c) Open Food Facts contributors. The database is available under the Open Database Licence, its individual contents under the Database Contents Licence and its product photos under a Creative Commons Attribution ShareAlike licence. The Boycott for Palestine list started from a public dataset by TechForPalestine, and Aleaf has added entries to it. The Mondelez, Nestle and Kellogg's lists were put together by Aleaf. A listing means that a boycott list names a brand. It is not a finding by Aleaf that any company did anything, and the choice to act on it is yours. Lists can contain mistakes. Brand names belong to their owners, and no brand is connected with Aleaf or endorses it.

5. Why we use your information, and our legal basis

The law says we need a reason, called a legal basis, for each use of your personal information. These are ours.

Running Aleaf and your account (contract): signing you in, keeping My List and Favourites, scoring products, showing your own results, reading label photos you send, and messages about your own reports.
Your allergy, diet and boycott choices: you choose to add them, and we use them to give you your own results and to help with support. You can remove them at any time.
Keeping product information accurate (legitimate interests): reviewing reports, corrections and feedback, filling shared product records, and helping you with support. Our interest is a reliable product database for everyone.
Security, fraud and abuse checks (legitimate interests): app checks, the free-scan allowance and device record, same-phone and same-email checks on invites, checks on repeated reports, staff blocks on misuse and limits on waitlist sign-ups. Our interest is protecting Aleaf and its users.
Purchases (contract and legal duty): checking your Pro purchase with Apple or Google, giving you access, and keeping the accounting records the law requires.
Invites, the leaderboard and prizes (contract once you join, and legitimate interests): ranking you, checking you are eligible, contacting winners and giving prizes. Fair-play checks rely on legitimate interests, and you can object (section 9).
The public board, announcing you as a winner, and the Join questions (your consent): you give each with its own tick or choice, and you can take it back at any time. For the Join questions, you can change your age range in Profile. To take back an answer (your age range, your gender or how you heard about Aleaf), email support@aleafapp.com.
Analytics, crash reports and speed measurements (legitimate interests): keeping Aleaf working and understanding how it is used. There is not yet a switch to turn them off. You can ask us to delete the analytics profile we hold about your account (section 15).
Notifications and your inbox: messages about your account, reports and corrections, and about products you have scanned or saved (running the service for you). We send no promotional messages by push notification. You can turn notifications off in Aleaf or in your phone settings.
Email updates and the waitlist (your consent): you give it by ticking a box, and can take it back at any time.
Counting visits to the website home page (legitimate interests): seeing which pages are read and which links bring people to the website, so that we can improve it. You can turn it off at aleafapp.com/stats, and it is off when your browser sends a Do Not Track or Global Privacy Control signal (section 3).
Support emails and staff records (legitimate interests): answering you, keeping a record of changes made in our admin tool, keeping the 12 month record of changes to your preferences, and answering a complaint or legal claim.
Running and protecting the app and website (legitimate interests): the online and update checks, downloading settings, recognising the real app, delivering the website and its fonts, and reading the install link on Android. Our interest is keeping Aleaf working.
Legal duties and claims: when the law requires us to keep or share something, or to deal with a legal claim.

If you do not give us information. An account needs an email address (or a Google or Apple sign-in), a name and a country. Everything else is optional. Aleaf still works without it, but results are not personalised.

6. Who we share your information with

We do not sell your personal information. We do not use it to show you other companies' advertising. We share it only as set out here.

Companies that process information for us

We use these companies to run Aleaf. Each handles your information under its own terms and privacy notice.

Google (Firebase and Google Cloud) provides our database, sign-in, file storage, servers, website hosting, push messages, app settings and security checks. See Firebase privacy information.
Google's measurement tools (Crashlytics, Performance Monitoring and Sessions) receive crash traces, device model, operating system, app version, an installation ID and timings (section 15).
Our analytics provider provides product analytics. Its servers for us are in the EU (Frankfurt), and it is a US company. It processes this information for us. Its name and privacy notice are available on request at support@aleafapp.com.
Our email delivery provider sends some of our email: notices to our support inbox, invitations to our staff and waitlist emails. It is a US company. Its name and privacy notice are available on request at support@aleafapp.com.
Our email hosting provider hosts our support mailbox (support@aleafapp.com). Every email you send to us goes there.

Google's Gemini AI

Label photos and product text go to Google's Gemini AI service, through Google Firebase (section 3). Google's own terms for that service apply. See Firebase AI Logic and data.

Companies that use information for their own purposes

These companies decide for themselves how to use what they receive, and each has its own privacy notice.

Apple handles Sign in with Apple, push notifications on iPhone, App Store purchases, app checks (App Attest) and update lookups. See Apple's privacy policy.
Google also handles Google Sign-In, Google Play purchases and app checks, the install link details on Android, update lookups on Android, Google Fonts, and the technical details that Google ML Kit, the barcode reader on Android, sends (section 15). See Google's privacy policy.
A public food database, run by a non-profit in France, receives a lookup when a barcode is not in our catalogue. The request carries the barcode, your app language, a fixed country code ("us", not your country) and your IP address. It carries no name, email address or account ID. We only read from this database. Its name and privacy notice are available on request at support@aleafapp.com.
Google servers and the servers of a network and security provider see your IP address when your phone checks that it is online. A content delivery provider, which delivers website content for Google, sees the IP address of website visitors.

Other people and organisations

Other Aleaf users. Anyone can read the shared product records. Anyone signed in to Aleaf can open correction records and correction photos (section 3). The public board shows only what you chose to show, for winning places, while the board is open.
Our staff. A small number of team members with admin access can open account profiles, reports, corrections, invite records and consent records, to give support and review corrections. Staff with the users or products permission can see scan histories, and staff with the payments permission can see purchase and device records. Staff with the users permission can also read the waitlist. A superadmin can read prize claim details. The admin tool records the changes staff make, but we do not claim that it records every time staff only look.
Prize providers: a delivery company we choose receives the winner's name, address and phone number, only to deliver a physical prize.
Authorities and others when the law requires it. We may share information with the police, a regulator, a court or an adviser when the law requires it, or to protect our users or our rights. If the business is sold or reorganised, information can pass to the new owner, who must follow this notice.

Aleaf links to other sites and services, such as a public food database, Instagram, the App Store and Google Play. They have their own privacy notices and decide for themselves what they do with information once they have it. We are responsible for what we send to them, and this notice says what that is.

7. Moving your information to other countries

Aleaf is run by ALEAF STUDIOS LTD, a company registered in London, but most of our servers are in the United States.

Our main database (Cloud Firestore) is in a Google multi-region location in North America. Our server functions run in the US. Firebase sign-in runs only from US data centres. Photos you send to us are stored with Google.
Our analytics provider stores analytics data in the EU, but it is a US company. Our email delivery provider is a US company. The public food database is based in France.
Google, Apple and our network and security provider also process some information in other countries.

When your information goes to the United States, we rely on the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework). Google LLC, our analytics provider, our email delivery provider, our network and security provider and our content delivery provider take part in the data bridge. Our email delivery provider's listing is under re-certification review. Apple is not on the list. We send Apple information only where a feature needs it, for example to deliver a push notification, check an App Store purchase or run Sign in with Apple. Apple then handles it under its own privacy policy and terms. You can ask us for more detail at support@aleafapp.com.

If you live in the European Economic Area, we rely on the EU-US Data Privacy Framework, or on the EU standard contractual clauses if the framework is not available. You can ask us for more detail at support@aleafapp.com.

8. How long we keep it

We give a period only where a rule or a job in our systems enforces it. Otherwise we say "until you delete your account" or "until we no longer need it", and we say what that means. We do not delete inactive accounts automatically.

Your account, preferences, My List and Favourites: until you remove them or delete your account. There is no cap on My List. The staff record of changes to your preferences is deleted automatically after 12 months.
Label photos read by AI: not saved by us. Photos we keep for review, and photos you send as corrections or feedback, have no automatic deletion date. We keep them while they help keep the product record accurate or deal with your report. Ask us if you want one deleted.
Reports, feedback and corrections: no automatic deletion date. Product details you helped add belong to the product and stay. Sections 3 and 17 say what happens to your account ID.
Invite records: until either person deletes their account.
The leaderboard: your membership record is kept while you are a member. After you leave, we keep a short record for 365 days (join date, leave date, your two ticks with their versions, your country and the privacy version), then delete it. Your display name and board entry are deleted at once when you switch the board off, leave, are removed or delete your account. If we remove you, we keep a record that we did, and why, so that you cannot rejoin. It has no automatic deletion date.
Reports about display names: deleted 90 days after we handle them, or after 180 days if nobody handles them. The daily count of reports your account sent is deleted after about two days.
Prize claims: delivery details are deleted 60 days after the prize is given. A prize you decline, or that expires, is deleted after 60 days. Details sent but never acted on are deleted after 180 days at the most. After a prize is given, a short claim record (your account, place, count and how we could reach you) stays until you delete your account. A winner record (season, place, number of counted friends, kind of prize and outcome, with no name and no account ID) is kept.
Backups: our database is backed up. A display name or other detail that we have deleted can stay in a backup copy for a limited time, until the backup is overwritten. We do not restore a deleted account from a backup. We do not use backups to put a deleted entry back on the board.
Aleaf Pro and purchases: we do not delete purchase records automatically. We keep them for as long as UK law requires a company to keep its accounting records, which is usually six years. When you delete your account, your account ID is replaced by a code in the purchase records, so a record no longer names you directly. Store event logs that hold your account ID are deleted after 90 days. Deleting your account does not remove your account ID from these logs.
The free-scan allowance: a device record expires 400 days after the last scan counted on the phone. The rows under your account are deleted with your account.
Notifications: a push token stays until you turn notifications off, sign out or delete your account. A token that Google says no longer works is removed the next time we send. Inbox messages and our history of messages sent have no automatic deletion date (section 17).
Email updates: your choice and its log are kept until you delete your account. Support email: we have not set a fixed period.
The early access waitlist: kept until you ask us to delete it. If you unsubscribe, we mark your record so that we never email you again, but the record, including your name, stays unless you also ask us to delete it.
Technical and usage information: Our analytics provider keeps analytics events for the period set in our account with it. Google keeps crash reports and Performance Monitoring data for a limited time. Google keeps the server logs of our website and servers for a limited time.
Staff records: the admin audit log and the history of messages staff send have no automatic deletion date. Counts of visits and sign-ups are kept, because they hold no personal information.

9. Your rights

You can ask us to show you, correct or delete the information we hold about you, to limit or object to how we use it, and to email you a copy. You can take back any permission you gave us. Email support@aleafapp.com. We reply within one month of confirming that you are the account holder.

In more detail, under UK and EU data protection law you have the right to:

be told how your information is used (this notice), and see and get a copy of what we hold about you;
have wrong information corrected, and have your information deleted in many cases;
limit how we use it, and move it to another service where this applies;
object to our use of it (you can object to direct marketing at any time, and we must then stop);
take back a permission you gave us, at any time, without affecting what we did before;
ask for a person to look again at a decision made by software (section 13).

Your right to object. You can object at any time to our use of your information for direct marketing, and we will stop. You can also object to any use that relies on our legitimate interests (section 5). Email support@aleafapp.com. For the analytics tools in section 15, the app has no switch yet, so an objection does not stop them on your phone. What we can do is delete the analytics profile we hold about your account, by hand.

How to ask

Email us from the address registered to your account. If you write from another address, we ask you one question that only the account holder can answer. We never ask for a passport or driving licence.
It is free, unless a request is clearly unfounded or excessive.
If your request is complex, the law lets us take up to two more months. We will tell you why before the first month ends. If we need to ask you a question to understand your request, the time stops until you answer.
You can correct most details yourself in the app: your name, age range, country, language, phone number, diets, allergies and boycott choices. To change your email address, email us.
If we turn down a request, we say why. You can ask us to look at it again, and we treat that as a new request. You can also complain to the ICO (see Complaints below).

What we can and cannot send you

Aleaf has no download button for your data yet. Email us and we will send you a copy within one month. We gather it by hand from our main database (your profile, My List, Favourites, corrections, invite, consent and purchase records), our support inbox and our analytics tool, and we tell you what we searched. Some tools hold data we cannot easily extract, such as Google's measurement tools. If we cannot send something, we tell you why. We do not send information that would reveal another person.

Complaints

If you are unhappy with how we use your information, tell us first at support@aleafapp.com. We will acknowledge your complaint within 30 days and tell you the outcome. You can also write to our registered office.

You can also complain to the Information Commission (the ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the European Economic Area, you can also complain to the data protection authority in your country, where you work or where the problem happened.

10. If you live in the United States

Some US states give residents extra privacy rights. This part is for you if you live in one of them.

What we collect. Identifiers (name, email address, account ID, device identifiers, IP address); account and purchase records; age range and gender, if you give them; what you scan and buy; app activity; approximate location (your country, and a place worked out from your IP address); photos you send; and inferences such as scores. Some of it is sensitive: your account log-in, your allergies (health information), and your diet and boycott choices, which can show beliefs. Sections 3 to 6 give sources, reasons and recipients.
We do not sell your personal information. We do not use it to show you other companies' advertising. We use sensitive information to give you your own results and to help with support.
Health information. Your allergy and diet choices are health information. We never sell them and never use them for advertising or marketing. You can remove them in Profile at any time, and you can delete your account in the app. If we turn down a request, you can ask us to look at it again, and you can contact your state attorney general if you are still unhappy.
Your rights. You can ask what we hold, ask us to correct or delete it, and get a copy. We do not treat you differently for asking. Email us. We reply within one month. If we turn down a request, you can ask us to look at it again.
Do Not Track. The Aleaf app does not respond to browser Do Not Track signals. The website's visit counting does: it is off when your browser sends a Do Not Track or Global Privacy Control signal. Aleaf does not use your information to track you across other companies' apps and websites. Aleaf is not for anyone under 18 (section 12).

11. If you live in another country

Aleaf is run by ALEAF STUDIOS LTD, a company registered in London. We give everyone the same core rights, wherever you live: to see what we hold about you, to correct it, to delete it, to limit or object to how we use it, to take back a permission you gave us, and to complain. If the law where you live gives you more rights, and they apply to us, we will respect them. Tell us first at support@aleafapp.com. You can also complain to the Information Commission (the ICO) or to your local data protection authority.

Section 7 names the places your information goes. Many countries treat health information, beliefs and political views as sensitive, and your allergy, diet and boycott choices can show these things. We never show them to other users or sell them. We send news email only to people who said yes.

12. Children and age

Aleaf is for people aged 18 and over, in every country and for every feature. If we learn that someone under 18 is using Aleaf, we will close the account and delete the information we hold about it, except the items listed under "What stays after you delete your account" (section 17). The early access waitlist asks people to confirm that they are 18 or over.

Parents and guardians: if you think your child has an Aleaf account, email support@aleafapp.com with the email address on the account. We will close the account and delete the information, as above. The age range in a profile is optional. If a profile holds the age range Under 18, we treat that as telling us you are under 18.

13. Scores, checks and decisions made by software

Scores come from Aleaf's own method. They are a guide for comparing products, not a statement about your health. Aleaf uses AI to estimate some product details, such as how processed a food is, and to translate ingredient text. AI can make mistakes.

Aleaf checks the allergies and diets it covers against the ingredient list it holds for a product. It first matches words in the list. An AI step may then clear a match that it judges to be a false alarm. Aleaf does not read "may contain" warnings printed on the pack. If Aleaf shows no warning, that does not mean a product is free of an allergen, because Aleaf may not be able to tell. Always read the pack yourself, especially if you have an allergy. Aleaf gives general information. It is not medical, dietary or nutritional advice.

Scores and warnings inform you. They refuse you nothing and have no legal effect on you. A few checks run by software can affect you:

checks on whether an invited friend counts (section 3). They can stop an invite from counting;
a nightly check that removes leaderboard members whose profile says they are under 18;
checks that count reports about a product or a name and spot repeated misuse;
the free-scan allowance, which counts your products and, when Aleaf Pro is open to you, can stop further scans when your allowance ends (section 3);
checks that count refunds, which can flag an account for a person to look at and can stop an account from using another Aleaf discount code.

A person at Aleaf can look again at any of these if you ask (section 9). A person decides who is invited to claim a prize and who is given one.

14. Keeping your information secure

We take care to protect your information, but no system is perfect. These are measures we can describe:

Google encrypts data sent to Firebase services using HTTPS, and encrypts data stored in Cloud Firestore, Firebase Authentication and Cloud Storage for Firebase. Passwords go to Google's Firebase Authentication, and we never see them.
The keys our servers use to send email and to scramble device keys are kept in Google Secret Manager.
Our database rules stop phones from writing payments, consent, waitlist, invite and leaderboard records. Only our servers write them.
We use App Check (Google Play Integrity on Android, Apple App Attest on iPhone) to help recognise requests from the real Aleaf app. It is one layer of protection and does not make misuse impossible.
Only people we have given admin access can use our admin tool, and only a superadmin can add or change staff. The admin tool records changes staff make.

If a breach puts you at risk, we will tell you and the regulator as the law requires. If you think your account has been misused, tell us at once.

15. Analytics, app tools, cookies and similar technologies

The Aleaf app does not use cookies. It stores items on your phone: your language and appearance, your sign-in state, a copy of your profile and lists, your guest setup choices and scans, a random installation ID, and notes that Aleaf has already checked for an invite code. Deleting the app removes them. This section says which tools run in the app, what each receives, and your choices. Section 3 covers the website.

Aleaf uses an analytics provider, hosted in the EU, and Google's Firebase tools to measure how the app is used and to find crashes. They start when you first open the app. There is not yet a switch in the app to turn them off, and asking us does not turn them off for your phone. If you have an account, you can email support@aleafapp.com and ask us to delete the analytics profile we hold about your account. We do this by hand. Deleting the profile does not stop new events that the same phone records afterwards. Section 17 says what happens to your analytics profile when you delete your account.

Our analytics provider (product analytics, hosted in the EU). Events such as the screens you open, what you scan (the barcode of each product and whether it is on a boycott list), how long you looked at a result, and how you use features such as favourites, reports, language and notifications. If you are signed in, events are linked to your account ID, which is a form of profiling, and carry your country, language, counts of favourites and scans, sign-up time, sign-in method, plan details and install campaign tags. If you are a guest, events are linked to a random ID kept on your phone. Our analytics provider also receives your IP address, which it can use to work out a country and city, and your device model, operating system and app version. It does not receive your name, email address, phone number or photos. When you open a notification, it may record the notification's title and text. Section 8 says how long our analytics provider keeps events. Section 3 ("Your preferences") says what it receives about your allergy, diet and boycott choices.
Google Firebase Crashlytics (crash reports). Device model, operating system version, app version, a random installation ID and the state of the app when it failed.
Google Firebase Performance Monitoring (speed). How fast the app starts and how long network requests take.
Firebase Analytics and Sessions. The Firebase Analytics software is part of the app. If it is switched on for our project, it records basic usage events and an app-instance ID. Firebase Sessions records session timing.
App Check, Remote Config and Installations. These run every time the app starts, for everyone. App Check confirms that requests come from the real app. Remote Config downloads feature settings. Installations gives the app a random ID. Google sees your IP address and device details.
Google ML Kit (barcode reading on Android). The barcode is read on your phone. ML Kit sends Google technical details, such as your phone model, operating system and app version, a per-installation ID and performance measurements, for diagnostics and usage statistics. Aleaf has no switch for this.
Online and update checks, and fonts. Section 3 describes the connectivity and update checks. The app may also load fonts from Google, which then sees your IP address.
Advertising ID. Aleaf does not use your phone's advertising ID for advertising or tracking.

Deleting the app removes what is stored on your phone, but not what is on our servers. Delete your account for that (section 17).

16. Your choices about notifications and email

Push notifications. Turn them off in Settings in Aleaf, or in your phone settings. Turning them off, or signing out, removes this device's token. Signing in switches notifications back on in Aleaf, so check Settings after you sign in. Inbox messages are still saved.
Email updates. The box is unticked unless you tick it. You can switch it off in Settings at any time.
Waitlist emails. Unsubscribe with the link in a waitlist email, or by emailing us.

We send notifications about your account, your reports, your corrections and products you have scanned or saved. We do not send promotional messages by push notification. You can turn them off in your phone settings or in Aleaf.

17. Deleting your account

You can delete your account in the app: open Profile and tap Delete my account. This starts at once and cannot be undone. It deletes your profile, sign-in account, My List, Favourites, list of corrections, invite and leaderboard records and email preference records. Some information stays, and we list it under "What stays after you delete your account". Deleting your account does not stop an Aleaf Pro plan: stop the renewal in your App Store or Google Play settings.

If you cannot use the app, email support@aleafapp.com from the address registered to your account. We will reply within one month of confirming that you are the account holder, and tell you what we can do. aleafapp.com/delete-account also lists what is deleted and what stays.

What is deleted

your profile (name, email address, phone number, preferences and notification tokens), your sign-in account, and your profile photo file if you ever had one;
your scan history (My List), Favourites and list of corrections;
your free-scan rows, your account ID in the device record, and the staff record of changes to your preferences;
your email update choice and its log;
your invite code, the record that links you to the person who invited you, and the invites you made (your inviter's count goes down by one);
your leaderboard membership, rank, board entry and your prize claims with their details.

What stays after you delete your account

Correction records stay as part of the shared product data. We remove your account ID from them. A boycott message loses its text and the list of switches shown.
Correction photos you sent stay in our storage with the correction record, and other signed-in Aleaf users can open them (section 3). Ask us if you want one deleted. Product details you helped add, and photos we approved as a product picture, belong to the product and stay.
Purchase, subscription and discount records: your account ID is replaced by a code, and the email address is dropped from discount records. Amounts, order references, dates and store references stay for accounting.
The device record stays for up to 400 days after the last scan counted on the phone. It keeps the counted barcodes but no longer has your account ID.
Staff records: audit log lines that name your account stay. So do the scrambled codes we keep to spot repeated misuse in "This isn't what I scanned" reports.
The winner record, with no name and no account ID, and records the law requires us to keep.
Data held by Google's measurement tools (Crashlytics and Performance Monitoring) stays for the periods in section 8.
Label photos read by Google's Gemini. When you send a label photo, it goes to Google's Gemini AI service to be read. Google's own terms decide what it does with the photo and for how long. We have no tool to delete it there.
Emails. Your emails to support, and the notices about your reports, stay in our mailbox and, for a limited time, in our email delivery provider's logs.
Backups. A copy of what you deleted can stay in a backup of our database for a limited time, until the backup is overwritten (section 8). We do not restore a deleted account from a backup.
The waitlist is separate from your account. Ask us to remove your details from it. Your store plan is not stopped.
A leftover record. In some cases a phone can recreate a basic record that holds only a notification token, seconds after you delete. It holds no profile details. We remove such a record when we find it.

What happens to some other records

Your inbox messages and notification history: they are not deleted when you delete your account. They stay under your old account ID, which no longer links to a profile. Email us if you want them removed.
Feedback and reports: the account ID is removed, but the message, the photos and the product details stay. Email us if you want a particular item deleted.
The account ID on public product records: it stays. The product details stay too.
Your analytics profile: it is not deleted automatically. Email us before you delete your account and we will ask our analytics provider to delete it. Afterwards we cannot tell which profile was yours.
Your Sign in with Apple link: from version 1.0.1 (47) of the iPhone app, deleting your account also asks Apple to end it. With an older version it does not. In any version you can remove Aleaf in your Apple ID settings.

Deleting starts at once. We do not say it is complete in every system, because of the lists above.

18. Changes to this notice

We may update this notice.

We change the date and version at the top of this page every time we change this notice. If a change matters to you, for example if we start to use your information for a new purpose, we will try to tell you in the app before it takes effect.

This notice is written in English. The app has text in 37 languages, but this notice is only in English for now. If a translation differs from the English version, the English version applies.

19. Contact us

Questions, requests or complaints: support@aleafapp.com. ALEAF STUDIOS LTD, company number 17401876, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.