This Privacy Policy describes how Vijay Umapathy (“Developer”, “we”, “us”, “our”) handles information in connection with the BiteSmart mobile application (“App”). By using the App, you agree to the practices described in this policy.
BiteSmart is designed with a privacy-first approach. We do not create user accounts, do not require login, and collect the minimum information necessary to provide the service. We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes.
When you scan a product and the App makes a request to our server, the following information is transmitted and may be logged:
IP addresses: Your device’s IP address is received by our server as part of standard internet communication but is not logged or stored. IP addresses are processed in memory only for rate limiting (abuse prevention) and are discarded immediately after the request is completed.
The App uses PostHog, a product analytics service, to help us understand how the App is used and improve it over time. PostHog collects the following data from your device:
PostHog data does not include your name, email address, phone number, IP address, GPS location, or any directly identifying information. Child names are never sent to PostHog. Child ages are transmitted only as a numeric value in months (e.g., “8”), with no association to any name or identity.
PostHog is used solely for our own product analytics. PostHog does not use your data for advertising and does not sell it to third parties.
We use the information described above solely for the following purposes:
We do not use any information for advertising, marketing, or cross-context behavioral tracking.
To generate product assessments, our server retrieves product data from the following third-party sources:
When our server queries these sources, it transmits the barcode number. Our server makes these requests — your device does not communicate with these third parties directly. These third parties receive no information about you, your child, or your device.
Our server is hosted on Railway (railway.app). Cached data is stored using Redis, hosted by Railway. These infrastructure providers may process server logs and network data in accordance with their own privacy policies. We do not share user-specific data with these providers beyond what is inherent in hosting the service.
Analytics data is processed by PostHog, Inc. (posthog.com), a US-based product analytics service. PostHog acts as a data processor on our behalf. They do not sell your data or use it for advertising. PostHog’s privacy policy is available at posthog.com/privacy.
We do not sell, rent, license, or otherwise provide your personal information to third parties for their own commercial purposes. We do not participate in data brokerages or advertising networks.
We may disclose information if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
BiteSmart is a tool used by parents and caregivers. It is not directed at children and is not intended to be used by children.
We do not knowingly collect personal information from children under 13 years of age, as defined by the Children’s Online Privacy Protection Act (COPPA).
The child age value entered by a parent or caregiver is a general numeric parameter (e.g., “8 months”) that cannot identify any specific child. It is not linked to a name, device, account, or any other identifying information.
If you believe that we have inadvertently collected personal information from a child under 13, please contact us immediately at the address below and we will take steps to delete such information.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.
Categories of personal information collected:
We do not log IP addresses or collect names, contact information, or any directly identifying information.
We do not:
Your rights: You have the right to know what personal information we collect, to request deletion of your personal information, to opt out of the sale or sharing of personal information (we do not sell or share), and to not be discriminated against for exercising these rights.
To exercise any of these rights, please contact us at the email address below. We will respond within 45 days.
Our server is located in the United States. If you access the App from outside the United States, your request data (including barcode, child age, and allergen parameters) will be transmitted to and processed in the United States. By using the App, you consent to this transfer. We do not log IP addresses or other information that could identify your location.
We do not currently target or market the App to users in the European Economic Area (EEA) or United Kingdom. If this changes, we will update this policy to address GDPR requirements.
The App requests access to your device’s camera solely for the purpose of scanning product barcodes. Camera data is processed on-device in real time by the barcode scanning library. We do not capture, store, or transmit photos or video from your camera. No images leave your device.
We use commercially reasonable measures to protect information transmitted to and stored on our server, including encrypted HTTPS connections for all API communication and access-controlled hosting infrastructure. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.
The App may display links to third-party websites (e.g., FDA recall notices, scientific publications, Open Food Facts pages) as source citations for product findings. These links are provided for informational purposes. We do not control the content or privacy practices of these external sites, and this Privacy Policy does not apply to them.
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last Updated” date at the top of this page and, where practicable, provide notice through the App. Your continued use of the App after changes are posted constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or believe we have collected information from a child under 13, please contact:
Vijay Umapathy
Email: contact.bitesmart@gmail.com
By using BiteSmart, you acknowledge that you have read and understood this Privacy Policy.