Privacy Policy

Last updated: July 13, 2026

Information We Collect

Untoxed collects the following information:

• Account Information: Email address and name when you sign in with Apple or Google
• Scan History: Products you scan (including multi-product shelf photos), health preferences, and closet audit results
• Health Profile (optional): Allergies, sensitivities, health conditions, dietary preferences, pregnancy/nursing status, and age group
• Gmail Receipt Import (optional): If you connect Gmail, we use read-only access to find purchase receipts and order confirmations. We process message content and order metadata to identify purchased products and add them to your closet. We do not send, modify, or delete email.
• Subscription Information: Product, purchase, renewal, cancellation, and entitlement status from Apple, Google Play, and RevenueCat. We do not receive payment-card details.
• Usage Data: Features used (debates, What-If Simulator, exposure insights, swap interactions, Tyke companion progress), device type, OS version, and locale/language
• Device Information: Device identifiers used for authentication, analytics, and notifications; device type; locale; app version; crash reports; and diagnostics

How We Use Your Information

• Provide personalized product analysis including toxicity scores, UPF/NOVA food processing levels, and shelf audit grades
• Generate AI-powered ingredient debates for educational purposes
• Calculate exposure insights and health correlations from your product history
• Power the What-If Simulator for hypothetical product substitution analysis
• Save your scan history and product closet across devices
• Import products from purchase receipts when you choose to connect Gmail
• Manage subscriptions and paid entitlements
• Deliver the app in your preferred language
• Improve our ingredient analysis and features

Gmail Data

Gmail connection is optional and uses the gmail.readonly scope. Untoxed queries for likely purchase receipts and order confirmations, then extracts product, brand, retailer, and order context. Recognized receipts are parsed by our service; selected unrecognized receipt content may be processed by Google Cloud Gemini solely to extract purchased products. We do not use Gmail data for advertising or to train generalized AI models.

OAuth tokens are encrypted at rest. You can disconnect Gmail in the app or revoke Untoxed from your Google Account security settings. Disconnecting stops future access. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Service Providers

We use service providers to operate Untoxed: Firebase for authentication; Google Cloud Platform for hosting, Gemini-assisted scanning and receipt extraction, and BigQuery analysis; PostHog for product analytics after age verification; Sentry for crash reports and diagnostics; and RevenueCat for subscriptions. PostHog may receive your Untoxed user ID, email, display name, app interactions, and device information; session replay is disabled. Sentry receives an opaque Untoxed user ID, and automatic PII collection is disabled. These providers process data on our behalf. We do not sell personal data or share it for cross-context behavioral advertising.

Data Security

We use AES-256-GCM encryption for health data, HTTPS/TLS 1.3 for all transmissions, and secure cloud infrastructure (Google Cloud, SOC 2 compliant).

Data Deletion

You can delete your account and all associated data at any time from the app settings. Data is removed within 30 days.

Children's Privacy

Our service is not intended for children under 13 (or 16 in the EU). We do not knowingly collect data from children under these ages.

Contact

Questions? Contact us at support@getuntoxed.com or privacy@getuntoxed.com