Privacy Policy

Spatial World LLC runs Bhojan and is responsible for your data. Questions: support@spatialojas.com. [LEGAL REVIEW]

1. Data we collect

• Account: email address, or the ID from Google or Apple sign-in; optional name, profile photo and country.
• Preferences: goals and dietary restrictions you choose during setup. Ingredient alerts and saved products stay on your phone.
• Scans: the barcodes you scan and when, to show your history and count scans.
• Product photos: pictures of a pack you choose to send when we don’t know a product (see section 2).
• Install ID: a random ID the app creates on first launch (see section 3).
• Purchases: subscription status from Apple or Google through RevenueCat. We never see your card details.
• Nepal passes: payment reference and an optional phone number for renewal reminders.
• Guest use: a random install ID created by the app, and your IP address, to limit free scans without an account. They are not linked to your name or email.
• Welcome period: a one-way keyed hash of your email address, kept after you delete your account so the ad-free welcome period is given once per person. We cannot recover your email from it. [LEGAL REVIEW]
• Ads (free plan): Google AdMob may collect device identifiers and usage data to show and measure ads, subject to your consent where required. On iPhone, ads are personalized only if you allow tracking when the app asks; otherwise they are not personalized.
• Product lookups: when you scan a barcode we don't have yet, we look up only the barcode number in Open Food Facts and UPCitemdb. No personal data is sent.
• Connection data: your IP address, used to pick your country’s product catalog when you haven’t set one, and to limit abuse.

[LEGAL REVIEW] Legal bases (contract, consent, legitimate interest) for each item.

2. Photos you send for scanning

• You choose to send them, after agreeing to the photo terms in the app. Take pictures of the pack only, not of people.
• Our own server first checks each photo for adult content. Then the text on the pack (name, ingredients, nutrition table) is read by Qwen, a vision AI model run by Alibaba Cloud (Model Studio, international service in Singapore). Alibaba Cloud processes the photo to return the text to us. [LEGAL REVIEW: confirm Alibaba Cloud’s data processing terms, retention and training use.]
• Photos are stored in Cloudflare R2. Only you and, when a submission needs a human review, Bhojan’s reviewers see them, through links that expire within minutes.
• The product facts read from photos may be published in the shared food catalog once other users confirm them. Published data never links back to you.

3. How we use the install ID

The app creates a random install ID. It is not your phone’s hardware or advertising ID, and it changes if you reinstall the app. The app sends it with every request. We use it to:

• Count free scans for people who use the app without an account.
• Check, before you send photos, that this phone is not under an upload ban.
• Make sure that confirmations of a product’s facts come from different phones.
• Start a new account on a phone that was linked to a banned account with one strike, instead of a clean record.

Your scan history is linked to your account, not to the install ID. Deleting your account removes the install ID from your photo submissions. The app keeps the install ID on your phone after you delete your account, so:

• The free scan count without an account carries on from where it was. That count is linked to the install ID only, never to an account, and expires 365 days after the last scan.
• If a ban record was kept (section 4), it can match this phone’s install ID, and a new account made on it starts with the old strikes.

Reinstalling the app creates a new install ID. [LEGAL REVIEW]

4. Ban records

When an account with safety strikes or a restriction is deleted, we keep a ban record so the same person can’t start again with a clean slate. It holds salted hashes (HMAC-SHA256 with a secret key) of the email address and install IDs, never the values themselves, plus the strike count and the restriction type and end date. Ban records are deleted 2 years after they are made. [LEGAL REVIEW]

5. Who processes your data

These service providers run parts of Bhojan for us. We do not sell your personal data. [LEGAL REVIEW: list each provider’s country and the transfer safeguards.]

• Alibaba Cloud (Model Studio, Singapore): reads product photos with the Qwen vision model.
• Cloudflare: R2 storage for product photos and offline packs; hosting, CDN and the country check (from your IP address) for this website.
• Contabo GmbH (Germany, EU data centre): runs the Bhojan server, its database and cache.
• Twilio SendGrid: sends sign-in and account deletion codes by email.
• Google: Google sign-in, Google Play billing, AdMob ads on the free plan, and Google Fonts, which the app downloads from Google’s servers. On Android, barcodes are read on your phone by Google ML Kit; the camera image does not leave the phone. [LEGAL REVIEW: ML Kit usage data.]
• Apple: Sign in with Apple, App Store billing and the App Tracking Transparency prompt.
• RevenueCat: keeps track of App Store and Google Play subscriptions.
• PayBridgeNP (Nepal only): takes payment for Nepal passes.
• [SMS PROVIDER] (Nepal only, not active yet): renewal reminders to the phone number you give. [PLACEHOLDER]
• ipwho.is: turns your IP address into a country when you haven’t set one. We cache the answer for 24 hours.
• Open Food Facts and UPCitemDB: we look up unknown barcodes there. Only the barcode is sent. Product pictures in the app load straight from Open Food Facts (including its Amazon Web Services mirror), which sees your IP address.

6. How long we keep data

• Account, preferences and scan history: until you delete your account.
• Sign-in: sign-in codes work for 5 minutes, account deletion codes for 10 minutes. A session ends after 90 days without use.
• Product photos: kept while a submission is checked or waits for confirmation. Once it is published, rejected or fails, its photos are deleted 90 days later by a daily cleanup. Photos are deleted sooner if you delete your account.
• Photos flagged as adult or unsafe content: moved to a locked area and kept, also after account deletion, as evidence. They are never deleted automatically. [LEGAL REVIEW: set a period.]
• Ban records: 2 years (section 4).
• After you delete your account: for 24 hours we keep a hashed record of the deletion code with the deleted account’s ID, so that sending the same request twice gets the same answer.
• Free scan counters without an account: 365 days per install ID, 24 hours per IP address.
• Payment records: as long as tax and accounting law requires, [X] years. [LEGAL REVIEW]

7. Deleting your account

Delete your account in the app (Settings › Account › Delete account) or on the account deletion page, which needs only your email and a code. We delete your account, profile, preferences, scan history, sessions and unpublished photos straight away. We keep the payment records the law requires (without your phone number or email), published food data with no link to you, flagged photos, ban records, and admin logs with your ID replaced. Deleting your account does not cancel an App Store or Google Play subscription. [LEGAL REVIEW]

8. Your choices

• Where the law requires it, the app asks for your ad consent on first launch. Premium has no ads.
• Access, correct or export your data by emailing support@spatialojas.com.

9. Regional rights

[LEGAL REVIEW] GDPR / UK GDPR (EEA and UK), CCPA/CPRA (California) and other applicable laws.

10. Children

Bhojan is not directed at children under [13/16]. [LEGAL REVIEW]

11. This website

This site uses no tracking cookies. It stores your theme and country choice in your browser, and a sign-in token when you sign in. [LEGAL REVIEW]

Contact

Spatial World LLC, [REGISTERED ADDRESS]. Email support@spatialojas.com.