Privacy Policy — Good For Me

App: Good For Me (Android, package com.goodforme.app)

Effective date: 3 October 2026

Last updated: 3 October 2026

Developer: The Zen Garden of Brains, Australia (independent developer)

Contact: joshwaters.brains@gmail.com

Good For Me ("the App", "we", "us") lets you scan food and skincare products, read their ingredients, flag things you want to avoid, compare products and ask questions about them. This policy explains what data the App handles, who it goes to, why, and the choices you have.

Summary

• No account, no sign-in. We do not sell your data. Our only server is a shared product cache (barcode → product summary) that never receives your profile, photos or questions.
• Your allergen / sensitivity profile is stored on your device, but it is sent to Google Gemini (Google's AI service) together with product details whenever the App writes a personalised summary, comparison verdict or chat answer for you. You can clear it at any time in Settings.
• Barcodes and product names are looked up in public product databases (Open Beauty Facts, Open Food Facts, Open Products Facts, UPCitemdb, Go-UPC). These lookups do not include your profile or identity.
• Label photos you capture are sent to Google Gemini to identify the product when the barcode lookup fails.
• Free users see ads from Google AdMob. AdMob collects device identifiers and related data for advertising, analytics and fraud prevention. Premium users see no ads.
• Crash reports go to Firebase Crashlytics, and Firebase App Check (with Google Play Integrity) checks requests come from a genuine copy of the App.
• Purchases are handled by Google Play. We never see your payment details.
• The App provides general information only, not medical advice.

1. Data stored on your device

The following stays on your phone unless it is sent to a service described in section 2:

• Allergen / sensitivity profile — the allergen categories you switch on and any custom ingredient terms you type. Stored in Android DataStore. It is excluded from Android cloud backup and device-to-device transfer.
• Scan history and saved comparisons (Favourites) — stored in a local database on the device.
• Usage counters and tier — e.g. how many free comparisons and AI questions you have used this week, and whether you have Premium (Google Play is the authority for purchases).
• Ad consent choices — stored on the device by Google's User Messaging Platform (see section 2.4).

We cannot access this on-device data.

2. Data that leaves your device, and who receives it

2.1 Camera and on-device processing

The App uses the CAMERA permission to scan barcodes and photograph product labels. Barcode detection and text recognition run on your device using Google ML Kit. Live camera frames are not uploaded.

2.2 Public product databases (barcode and name lookups)

When you scan a product, the App sends the barcode number (and, if needed, a product name search) to:

These requests do not include your allergen profile, scan history, chat questions or any account identifier. Like any internet request, the receiving server sees your device's IP address.

2.2a Good For Me product cache (Cloudflare)

To make results faster and cheaper, the App first asks our own product cache, hosted on Cloudflare Workers, whether it already has a product's details and a general (non-personalised) summary. The App sends only the barcode. When you have no allergen profile set and the App generates a new general summary, it may send that product's data and general summary back to the cache so other users get it instantly; this upload never includes your profile, photos, chat questions or any identifier, and is protected by Firebase App Check. Cloudflare, as our service provider, processes your IP address to deliver the request and may keep standard request logs for a short period. Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

Product data in the cache comes from Open Food Facts and Open Beauty Facts and is available under the Open Database License (ODbL).

2.3 Google Gemini (AI features)

The App uses Google's Gemini AI models, accessed through Google Firebase AI Logic or directly through the Gemini API, to:

• identify a product from a label photo you capture when the barcode lookup fails;
• write the plain-language product summary and comparison verdict;
• answer questions you type in the product chat.

Depending on the feature, Google receives:

• product details (name, brand, ingredients, nutrition facts);
• the label photo (identification only);
• your allergen / sensitivity profile — the allergen categories you enabled and the custom terms you typed — so the answer can be personalised. Because this can reveal health-related information (for example, a food allergy), we treat it as health information;
• the chat questions you type.

Google acts as our service provider for these requests. Data is sent encrypted (HTTPS). It is not used by us for advertising and is not sent to AdMob. We do not store photos, prompts, personalised answers or chat on any server of ours. Google processes and may temporarily retain these requests under its own terms, including for abuse monitoring. We use Google's paid service tier for these requests, under which Google's terms state it does not use your prompts or responses to improve its products:

• Gemini API Additional Terms: https://ai.google.dev/gemini-api/terms
• Firebase AI Logic privacy and data handling: https://firebase.google.com/support/privacy
• Google Privacy Policy: https://policies.google.com/privacy

If you prefer not to send your profile to Google, clear it in Settings → Clear profile (or switch off all allergen categories and remove custom terms). Personalised flags will stop, and the AI features will work without the profile. Do not type information into the chat that you do not want sent to Google.

2.4 Advertising — Google AdMob (free tier only)

Free users see banner, interstitial (full-screen) and optional rewarded ads served by Google AdMob. The Google Mobile Ads SDK collects:

• device identifiers, including the Android Advertising ID;
• device and app information (model, OS version, app version, language);
• approximate location derived from your IP address;
• ad interactions (views, taps) and diagnostic information.

Google uses this data for advertising (including personalised ads where permitted), measurement and analytics, and fraud prevention. See:

• How Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites
• Google advertising technologies: https://policies.google.com/technologies/ads
• AdMob data disclosure: https://developers.google.com/admob/android/privacy/play-data-disclosure

Consent. In the European Economic Area, the UK and Switzerland, the App asks for your consent through Google's User Messaging Platform before personalised ads are shown. In US states with privacy laws, the App shows the applicable opt-out notice. You can change your choice at any time in Settings → Privacy options.

Other controls. You can reset or delete your Advertising ID in Android Settings → Google → Ads (or Settings → Privacy → Ads, depending on your device). Upgrading to Premium removes all ads.

The App does not let advertisers target ads based on your allergen profile, scans or chat questions — that data is not sent to AdMob.

2.5 Crash reporting — Firebase Crashlytics

If the App crashes or hits a serious error, Firebase Crashlytics (Google) receives a crash log, device and OS details, app version, diagnostic data and a Firebase installation ID. We use it only to find and fix bugs. Crash reports do not intentionally include your profile, photos or chat questions. Firebase privacy information: https://firebase.google.com/support/privacy

2.6 Security — Firebase App Check and Google Play Integrity

To protect the App's AI features from abuse, Firebase App Check uses the Google Play Integrity API to confirm requests come from a genuine, unmodified copy of the App on a genuine device. This sends device integrity signals and app identifiers to Google. It is used only for security and fraud prevention.

2.7 Purchases — Google Play Billing

Premium is available as a monthly or annual subscription (the annual plan may include a free trial) or a one-time lifetime purchase. Payments are processed entirely by Google Play under the Google Play Terms of Service and Google Privacy Policy. We never receive your card or payment details; the App only receives confirmation of which Premium purchase or subscription your Google account owns.

Manage or cancel subscriptions in the Google Play Store → Profile → Payments & subscriptions → Subscriptions. Refunds follow Google Play's refund policy: https://support.google.com/googleplay/answer/2479637

3. What we do not do

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising other than through AdMob as described above (which you can opt out of).
• We do not require an account, and do not collect your name, email address, phone number or contacts.
• We do not collect precise (GPS) location.
• We do not read your photos library, files, messages, contacts or calendar.

4. Why we use your data (legal bases)

For users in the EEA, UK and Switzerland, we rely on:

• Performance of our service (providing the features you ask for) — product lookups, label identification, summaries, chat, purchases.
• Explicit consent — for processing your allergen / sensitivity profile, which may be health data. You give this by entering a profile, and you can withdraw it at any time by clearing the profile.
• Consent — for personalised advertising, through the consent message.
• Legitimate interests — crash reporting, security, fraud prevention and non-personalised ads, balanced against your rights.

5. Retention and deletion

• On your device: data stays until you delete it. Use Settings → Clear profile, Clear scan history and Clear favourites, or uninstall the App to remove everything stored by the App.
• Google services: Gemini requests, AdMob data, Crashlytics reports and App Check signals are retained by Google according to its policies and retention periods. Ad-related data can be managed through your Advertising ID controls and Google's ad settings (https://myadcenter.google.com).
• Open product databases: barcode/name lookups are handled under each database's own policy.
• Because the App has no accounts, we hold no personal data we can look up by your identity. If you have a question or want help with a deletion request to a service above, email us.

6. Children

The App is not directed to children under 13 (or the equivalent minimum age in your country), and we do not knowingly collect personal information from children. If you believe a child has used the App and provided information, contact us and we will help remove it.

7. International transfers

We are based in Australia. Google, the Open Food Facts association (France), UPCitemdb and Go-UPC may process data in the United States, the European Union and other countries whose privacy laws may differ from yours. Google relies on recognised transfer mechanisms such as Standard Contractual Clauses and the EU–US Data Privacy Framework where required. By using the App, you understand your information may be processed outside your country.

8. Security

Data on your device is protected by Android's app sandbox. Data sent over the internet is encrypted in transit (HTTPS/TLS). No system is perfectly secure; please keep your device and the App up to date.

9. Your rights

Australia. We handle personal information in line with the Australian Privacy Principles in the *Privacy Act 1988* (Cth). You can ask about the information we handle and request access or correction. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: https://www.oaic.gov.au

EEA, UK and Switzerland (GDPR / UK GDPR). You have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time (without affecting earlier processing). You can also complain to your local data protection authority (in the UK, the ICO: https://ico.org.uk).

US states with privacy laws. You may have rights to know, delete, correct and opt out of targeted advertising. Use Settings → Privacy options to opt out of ad personalisation, or contact us.

Most data is held on your own device, where you can view and delete it directly. For anything else, email joshwaters.brains@gmail.com. We aim to respond within 30 days.

10. Health information disclaimer

Ingredient ratings, allergen flags, summaries and chat answers are general information only and are not medical, dietary or allergy advice. Ratings combine crowd-sourced database data with AI-assisted analysis and may be incomplete, outdated or wrong. Always read the product label and consult a qualified health professional about allergies, sensitivities or medical conditions.

11. Changes to this policy

We will update this policy when the App's data practices change and revise the "Last updated" date above. Material changes will be highlighted in the App or on the Play Store listing.

12. Contact

Privacy questions, requests or complaints: joshwaters.brains@gmail.com

Good For Me