NoCrumb
Privacy policy
This policy explains what the NoCrumb app collects, where it is stored and who else receives it. In short: most of what you enter stays on your phone, and the few things that leave it are listed below.
Who we are
NoCrumb is made and run by an individual developer. For privacy questions, to use your rights or to ask for deletion, write to [email protected].
Stays only on your phone
The app keeps the following in a database on your device. It is never sent to NoCrumb or to anyone else.
- Your profile: app language, severity, country, state and the last restaurant city you opened.
- Your chef card note.
- Your scan history: the label text you analysed and the result, with the matched ingredients. The one exception is a wrong-verdict report you send (see What you post).
- Saved product lookups, so a product you scanned before works offline.
- Symptom check-ins: energy, bloating, pain, stool type, skin flare-ups and your own notes. These are never sent to NoCrumb.
- Your weekly meal plan and grocery ticks.
- Your daily reminder settings. Reminders are local notifications created by the app on your phone, not by a server.
- Restaurant lists downloaded for offline use, and the places you saved.
- Any AI provider API key you add (see AI meal plans), kept in your phone's secure storage.
- A count of today's scans, used for the free daily scan limit.
Photos and camera images used to read an ingredient label or barcode are processed on your phone. The text recognition runs on the device, and the image is not uploaded. The only photo the app ever uploads is a profile photo you choose to add (see your account).
Location
If you allow it, the app reads your location once to sort restaurants by distance and to draw a dot on the map. This is used on your phone only. It is never sent to NoCrumb or to any third party by the app. You can refuse or revoke the permission in your phone settings and the app keeps working.
Signing in and your account
Signing in is optional. It is needed only to post reviews, flag reviews, report or suggest restaurants, submit products, send wrong-verdict reports and add a profile photo. It also keeps Premium with you on another phone. You can sign in with Google or, on iPhone, Apple. On Android, an account that NoCrumb has created for you can also sign in with an email address and password. When you do, NoCrumb's server (hosted by Supabase) stores:
- your email address (if you use Sign in with Apple's private relay, this is the relay address) and the sign-in provider and its user ID;
- a display name. We generate one such as "crumb-1a2b" when you join, and you can change it. Other signed-in people see this name next to your reviews. Your email is never shown to them.
- a profile photo, only if you add one. You can take it or pick it from your gallery. The app shrinks it to 512 pixels before uploading it. It is stored privately: only you can see it, and other people never do. You can replace or remove it at any time, and removing it deletes it from the server.
Google and Apple handle the sign-in itself. NoCrumb never sees a password for those. For an email and password account, the password is stored only in hashed form by Supabase. We ask only for your email address and basic profile from Google and your email from Apple.
What you post
When signed in, anything you choose to submit is stored on NoCrumb's server, tied to your account:
- Restaurant reviews: whether you reacted to gluten, kitchen practices you report (such as a separate tawa or fryer) and an optional comment. Reviews are visible to other people with your display name.
- Review flags you raise on other people's reviews.
- Restaurant suggestions: name, city, country, address, cuisines, a proposed tier, and optional phone and notes.
- Restaurant reports: a reason and optional note about a listing.
- Product submissions: barcode, product name, brand and ingredient text for products that other sources lack.
- Wrong-verdict reports: when you flag a result as wrong and are signed in, the app sends the verdict it showed, the version of its ingredient list, the ingredients it matched, the reason you chose, your optional note, the label or ingredient text it analysed and, for a barcode result, the barcode and product name. It does not send your profile, country, severity, symptoms, location or other scans. Only you and NoCrumb moderators can read a report; it is never shown to other users. If you are signed out or offline, the report waits on your phone and is sent later, when you sign in or are online again. We use reports to find and fix mistakes in the app's ingredient list. At most 10 reports can be sent per 24 hours.
Once a moderator approves a product submission, its barcode, name, brand and ingredient text are shown to all app users as community data, without your name. An approved restaurant suggestion becomes a public listing, also without your name.
The server also keeps a record of when you posted, so it can enforce daily limits that stop abuse. A volunteer moderator may review suggestions and submissions, and an administrator can hide content or suspend an account that breaks the rules. A moderation log records which moderator took which action on which item. It does not store your content.
Contribution updates (notifications)
If you are signed in, you can ask to be notified when a moderator approves or turns down a restaurant you suggested or a product you submitted. This is off until you turn it on, either when the app offers it after your first suggestion or submission, or on your Account page; your phone also asks for permission to show notifications.
Only when it is on, the app gets a notification token for this installation from Google Firebase Cloud Messaging and stores it on NoCrumb's server with your account, the type of phone (Android or iPhone) and the app's language. When a moderator decides, NoCrumb's server sends a short message through Firebase Cloud Messaging (and, on iPhone, Apple's push service), such as "Your restaurant is live", and for an approved restaurant a link to it. Messages never contain the restaurant or product name, the barcode, ingredients, notes or the moderator.
Turning it off, signing out, deleting all data in the app or deleting your account removes the token from the server and deletes it on your phone. Messages that could not be delivered are kept for at most 7 days, and records of sent messages for 30 days. We use the token, at your request, only to send these updates.
Requests to NoCrumb's server without signing in
Even when signed out, the app contacts NoCrumb's server (Supabase) to:
- download restaurant lists for the country and city you open, and the list of cities;
- check a scanned barcode against products submitted by the community;
- fetch NoCrumb's list of recommended AI model names. This request carries no key and no personal data.
As with any internet request, our hosting provider receives your IP address and standard technical details such as the app's request headers. We do not use them to build a profile of you.
Crash reports and usage analytics
Two optional switches decide whether the app sends diagnostics. You see both on the last onboarding step and can change them any time in the app under Profile, Privacy & data. "Delete all my data" turns them back to their defaults.
- Send crash reports (on unless you turn it off): when the app crashes or hits an error on Android or iPhone, it sends a report to Google Firebase Crashlytics. A report contains the error and where in the code it happened, the app version, your phone model and operating system version, details such as free memory and orientation, a random ID for this installation of the app, and the last few steps the app took (such as which screen was open). It contains no account ID, email, name, location, photos, screenshots, scanned text, barcodes, symptoms or profile settings. Google keeps reports for 90 days. We use them, as a legitimate interest, to find and fix bugs.
- Share usage analytics (off until you turn it on): the app sends a short list of events to Google Analytics for Firebase, such as "a scan was completed" with how it was started and the type of result, "the paywall was shown" with what opened it, or "a review was submitted". Google links these events to a random ID for this installation of the app. They never include your account, email, scanned text, barcodes, symptoms, severity, city or location; like any web service, Google works out an approximate area (such as the country) from your connection's IP address. The app does not read your phone's advertising ID, and the data is not used for advertising or shared with advertisers. Google keeps it for 2 months. We use it, with your consent, to see which features help people. Turning the switch off stops it at once and deletes the random ID.
The app works the same with both switches off.
Separately, the app downloads a few settings from Google Firebase Remote Config, such as how many free scans a day are included, at most twice a day. These requests carry a random ID for this installation of the app and the app version, nothing about you, and are needed for the app to work as configured, so they do not depend on the switches above.
NoCrumb Premium and purchases
NoCrumb Premium is an optional subscription or one-time purchase. It is billed by Apple through the App Store or by Google through Google Play, under your Apple or Google account. NoCrumb never receives your card or bank details.
Purchases are managed for us by RevenueCat, a service that checks which purchases are active and keeps them working on your other phones. RevenueCat receives:
- an app user ID. When you are signed out this is a random ID created on your phone. When you sign in, it is your NoCrumb account ID, so Premium can follow you to another phone.
- your purchase history from the App Store or Google Play: what you bought, when, the price and currency, and whether a subscription is active;
- standard technical details such as the app version, your phone's operating system and your IP address, which it uses to work out your store country.
RevenueCat does not receive your email, display name, profile, scans or symptoms. The app uses what RevenueCat returns only to unlock Premium features. Apple and Google process the payment under their own privacy policies.
Deleting your data or your NoCrumb account does not cancel a subscription. To stop it renewing, cancel it in the App Store or Google Play. See the terms of use for how subscriptions and refunds work.
Other services the app talks to
- Open Food Facts (privacy): when you scan a barcode, the barcode number is sent to look up the product. Nothing else is sent.
- Google Maps Platform, Map Tiles API (privacy): the restaurant map loads map tiles from Google's servers. Google sees your IP address and which map area you view. Your location dot is drawn on your phone and is not part of the request. When you tap "Open in Google Maps" on a restaurant, NoCrumb's server looks up that restaurant's Google place ID by its name and address (no data about you is sent). Opening the link then takes you to Google Maps, under Google's own terms and privacy policy.
- Google (privacy) and Apple (privacy): to sign you in and, when you delete your account, to revoke NoCrumb's access to your Google or Apple account.
- Supabase (privacy): hosts NoCrumb's database, sign-in service and profile photo storage, acting on our behalf.
- Anthropic (privacy): for NoCrumb server AI meal plans, generates the plan on our behalf (see AI meal plans). If you use your own Anthropic key, it is a separate service you contract directly.
- Google Firebase Crashlytics (privacy): receives crash and error reports, if "Send crash reports" is on (see above), acting on our behalf.
- Google Firebase Remote Config (privacy): provides app settings such as the daily free-scan limit, acting on our behalf.
- Google Firebase Cloud Messaging (privacy) and Apple Push Notification service (privacy): deliver contribution updates to your phone, only if you turned them on (see above), acting on our behalf.
- Google Analytics for Firebase (privacy): receives usage events, only if you turned on "Share usage analytics" (see above), acting on our behalf.
- RevenueCat (privacy): manages Premium purchases on our behalf (see NoCrumb Premium).
- Apple App Store and Google Play billing: take payment for Premium under your store account.
- Map and call buttons: when you tap to open a restaurant in your maps app or to call it, your phone hands the address or number to the app you choose.
AI meal plans
"Generate my week" is optional and part of Premium. It works in one of two ways.
NoCrumb server plans (Premium, needs sign-in). No key is needed. Your planning choices (servings, meals, preferred grains, ingredients to avoid and slots already filled) and NoCrumb's recipe list are sent through NoCrumb's server to Anthropic, which acts as our processor and generates the plan. Before it does, NoCrumb's server asks RevenueCat whether your account has Premium, using your NoCrumb account ID. The request does not contain your profile, scan history or symptoms. NoCrumb does not store your choices or the plan. We record only the time of each request, to enforce a limit of 3 plans per 24 hours; these records are deleted with your account.
Your own key. You can instead add your own API key from Anthropic, Google Gemini or OpenAI. The key is stored in your phone's secure storage. It is checked once by contacting that provider, and then used only for your plan requests. Requests go directly from your phone to the provider you chose. They are never sent through NoCrumb, and NoCrumb never receives your key or the plan.
A request contains NoCrumb's recipe list and your planning choices: servings, meals, preferred grains, ingredients to avoid and slots already filled. It does not contain your profile, scan history or symptoms. The provider's own privacy policy applies to what you send them, and you pay them directly under your own account: Anthropic, Google, OpenAI. Deleting your data in the app removes your saved keys from the phone.
What we do not do
- No advertising, no ad networks and no tracking across apps or sites.
- No analytics unless you turn it on, and no crash reports if you turn them off (see Crash reports and usage analytics).
- We do not sell your data.
- We do not collect your location.
- This website sets no cookies, runs no scripts and loads nothing from other sites.
How long we keep things
- Account data, your profile photo and the things you posted are kept until you delete your account. A removed or replaced profile photo is deleted straight away.
- After deletion, copies may remain in our hosting provider's encrypted backups for up to 30 days, until those backups are overwritten. They are not used or restored.
- If you delete your account in the app, it is deleted immediately.
- If you ask by email, we delete it within 30 days.
- Data on your phone stays until you delete it in the app or uninstall NoCrumb.
- Wrong-verdict reports stay on our server until a moderator has decided on them, and are then deleted 180 days after that decision.
- Crash reports are kept by Google (Crashlytics) for 90 days; usage analytics are kept by Google for 2 months.
- A notification token is kept until you turn contribution updates off, sign out or delete your account. Undelivered updates are dropped after 7 days, and records of sent ones after 30 days.
- Purchase records are kept by Apple or Google, and by RevenueCat on our behalf, under their own retention rules, for example for tax and refunds. Deleting your NoCrumb account does not delete them. Email us to ask for your RevenueCat record to be deleted.
When an account is deleted, your email, display name, profile photo, reviews, flags, reports (including wrong-verdict reports), suggestions, product submissions and notification tokens are removed. A restaurant that moderators created from your suggestion remains in the directory as a business listing, but is no longer linked to you. See how to delete your account.
Your rights
You can ask to see, correct, export or delete the data we hold about you, and to object to or restrict how it is used. You can change your display name and profile photo in the app under Profile, Account. For anything else, or if you are in the European Economic Area, the UK or another place with data protection laws that give you these rights, email us and we will reply within 30 days. You may also complain to your local data protection authority.
We process your account data and purchases to run the features you ask for (a contract), and process contributions and abuse limits for the legitimate interest of keeping the community directory accurate and fair. Crash reports rely on our legitimate interest in fixing bugs, and you can object at any time with the switch in the app. Usage analytics rely on your consent, which you can withdraw at any time with its switch.
Children
NoCrumb is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
Changes to this policy
If we change what the app collects, we will update this page and its effective date before the change takes effect.