Privacy Policy

1. Creating and managing your account

To create and manage your account, Wagzak processes your sign-in provider, account identifier, the email address your provider shares with us, sign-in status, and sign-up and access times. Your name and profile photo may be included if your provider shares them within the scope you allowed. We never collect the password for your Google or Apple account. Public reviews show the nickname and profile you set in the app. We process this information as needed to provide the service you signed up for, and we delete your account information when you delete your account.

2. Information by feature

3. Allergies and other health-related information

The allergens you choose in the allergy filter are stored only on your device, and you can use the filter without giving separate consent. When you run a search that uses your allergy filter, the exclusion conditions are sent to our search server and used only to handle that request. We do not save them as a health profile linked to your account, and we never use them for ad targeting. Server logs and our providers’ retention follow the processing details below. You can delete the filters, combos, and setup status saved on your device in My > Privacy & consent.

4. Photo analysis, AI search, and AI processing

When you use photo analysis, the food label photo you choose and the ingredient and nutrition text extracted from it are sent through our Supabase analysis server to the Google Gemini/Gemma API. Before the analysis starts, we explain on a separate screen why we send it and how the provider uses data, and we ask for your consent. Please do not send photos that include faces, names, addresses, prescriptions, or other personal or health-related information. If you do not consent, no photo is sent and you can still search products. AI results can contain errors, so please check them against the label on the package. When you use AI search, the sentence you type is sent through our Supabase analysis server to the Google Gemma API (Gemini API) to turn it into search conditions. Your account information is not sent with it. To answer the same sentence quickly, we keep only a converted identifier of the sentence and the search conditions on our server, not the original sentence. Google may use the sentences it receives to provide and improve its services under its API terms, so please do not include your name, contact details, health conditions, or other personal information in your search. When the Google API is too busy, we send the sentence to Cloudflare Workers AI (Cloudflare, Inc.) in the same way. Your account information is not sent in that case either, and Cloudflare does not use the sentence to train AI models.

5. Public information and sharing

Review text, photos, your nickname, and your profile photo are visible to other users. If your text or photos include health or contact information, that may be visible too, so please remove it before posting. You can avoid making it public by not posting, or by editing or deleting your post. We do not sell your personal information, share it for cross-context behavioral advertising, or add your allergy information to affiliate links. We do not provide your personal information to third parties except where the law allows it or where we have told you and received your consent. Outside stores apply their own privacy policies.

6. Service providers and international processing

We use Supabase for sign-in, our database, and file storage, and Cloudflare Workers and Turnstile to deliver data requests and protect the service. The providers, purposes, items, and retention are listed under “Service providers and retention” below. Our Supabase database is located in Seoul, Republic of Korea, so your information is transferred to and stored in Korea. Our providers may also process it in other countries, such as the United States and Singapore, for support, security, and their global networks. We use contracts and safeguards with these providers to protect your information. Apple (App Store) and Google (Google Play) handle payment, auto-renewal, cancellation, and refunds for Full Ingredients Plus. We only receive the subscription transaction information the store sends us or check the subscription status with the store; we never receive your payment details. Requests that pass through Cloudflare include your IP address, request and authentication information, and browser or device verification signals. Search requests may include the search conditions you choose. Our own rate-limit store keeps a value converted with HMAC instead of your original IP address, along with request counts, and does not store authentication tokens, photos, or the content of search conditions. We use Apple App Attest to verify our iOS app. You can ask us to stop processing that is needed for sign-in and the service by contacting our privacy contact. If you object to or stop that processing, features that require sign-in and access to your data may be limited, and you can delete your account to have your account information deleted. If any processing needs separate consent, we will explain it and ask before you use that feature.

7. Optional marketing messages

We do not currently send marketing emails, and signing up does not require you to agree to them. If we start, we will send them only to members who opt in separately, show who they are from, and include a free way to unsubscribe. You can withdraw your consent anytime in My > Privacy & consent.

8. Deletion, retention, and security

When the purpose of processing is fulfilled or your account deletion or deletion request is processed, we promptly delete the related account information, data, and uploaded files from our live systems. Electronic files are deleted so they cannot be recovered. Daily backups of our Supabase database are kept for 7 days, and backups made before a deletion are removed when they expire. We use backups only to recover from failures. Service logs and security verification information are managed under the separate retention periods below. If the law actually requires us to keep certain information, we will tell you the basis, items, and period, and keep it separately from other personal information. We use safeguards such as restricted access, encrypted connections, and separated server secrets.

9. Your rights and choices

In My > Privacy & consent, you can view and export your saved data, change optional consents, delete personalized data on your device, and delete your account. You can edit or delete your profile and reviews in their own screens. For other requests to access, correct, delete, or stop processing your information, or to withdraw consent, contact our privacy contact. Depending on where you live (for example, California or other US states), you may have the right to know about, access, correct, delete, or get a copy of your personal information, and to opt out of its sale or sharing. We do not sell or share personal information, and we will not treat you differently for exercising your rights. We may need to verify your identity before handling a request, and you can use an authorized agent where the law allows. Please also delete any files you saved separately on your own devices.

10. Children and device permissions

Full Ingredients accounts are only for people aged 18 or older, and the service is not directed to children under 13. If we learn that we collected information from a child under 13, or that someone under 18 created an account, we will delete it after the necessary checks. We ask for camera and selected-photo access when you take or attach a photo, and for permission to save photos when you save one. If you decline, you can still use the rest of the app, and you can change permissions in your device settings.

11. On-device storage, cookies, and tracking

We store your sign-in session, device settings, and saved conditions in the app’s storage or your web browser’s storage. You can control this by signing out, deleting the app’s data, or clearing browser storage, but you may then need to sign in and set things up again. We do not use SDKs that track you across other companies’ apps and websites with an advertising identifier. On the web, Cloudflare Turnstile processes your IP address, browser information, TLS connection characteristics, and the site you visit to tell people from automated traffic. Turnstile’s security signals are used to protect websites and improve bot detection.

12. Contact and changes to this policy

Our privacy contact is listed under “Operator” below. We will tell you about important changes to this policy, and when they take effect, in the app, and we keep previous versions.