Privacy Policy

Who we are

fufu is a food label checker operated by Fufu Technologies B.V., trading as fufu, registered office Papaverweg 34, Unit B100, 1032 KJ Amsterdam, the Netherlands, KvK number 42043464. We decide how your personal data is used, which makes us the “controller” under data protection law.

Questions about this policy or your data: hello@getfufu.app.

What we collect

• Your account: your email address and, if you give one, your name. If you sign in with Apple or Google, they tell us your email address, and Apple may also share your name if you allow it.
• Your household: the people you add, with a name for each, their allergies and intolerances, which allergies are severe, their age group (including pregnancy, breastfeeding, and baby and toddler stages), their diets and any faith rules they follow. Pets: species and what they should avoid. Allergies, intolerances and life stage are health data, and faith rules reveal religious belief. The law gives both extra protection, and so do we — see “Why we may use it” below.
• Your scans: the photos you take of labels and menus (sent to be read, not kept — see “Photos”), and your scan history: what you scanned, the result for each person and when. If you choose to tag a scan with a restaurant, the restaurant’s name is saved with it.
• Your kitchen: your pantry, shopping list, saved recipes and favourites.
• Your country and region, if you choose them, including a country you are travelling in. We never work this out from your phone.
• Your location, only when restaurant tagging is on and you search for restaurants nearby — see “Location”.
• Your plan: which plan you have and until when. Card details are held by Paddle, Apple or Google, never by us.
• Your devices: for each device you are signed in on, its type, app version and a label such as “Safari on Mac”, so you can see and sign out devices; and a push token, so we can send you notifications.
• Error reports: when the app or website breaks, a technical report of what went wrong (see Sentry, below).
• Device checks, for fraud prevention only: to stop free scans being claimed again by deleting and reinstalling the app. On iPhone, the app uses Apple DeviceCheck, which lets Apple store two yes-or-no values for the device on our behalf, and Apple App Attest. On Android, it uses Google Play Integrity and the device’s Android ID, which we store only as a keyed hash: scrambled with a secret key, so it cannot be turned back into the ID or matched with anyone else’s records. App Attest and Play Integrity confirm that a request comes from the genuine fufu app. We use these checks for nothing else — not for advertising, and not to track you — and keep them for 12 months.

Photos

When you scan a label or a menu, the photo goes to our server and on to Google’s Gemini AI service, which reads the text in it. We do not save your photos — not on our servers, not in our database. Once the text is read, the photo is discarded. If Google’s automated checks flag a request as possible abuse of its service, Google keeps that request for up to 90 days, then deletes it (see Google, below).

The text read from the label is kept as part of our scan records — see “How long we keep it”.

Location

When fufu asks: only when you have switched on restaurant tagging. If tagging is off, the app does not ask for your location and does not use it.

What is sent, and why: when you search for a restaurant near you, the app sends your phone’s current coordinates (latitude and longitude) to our server, which uses them for that search only — to find restaurants within a few kilometres. No other company receives them.

What is stored: nothing. Your coordinates are never stored or logged, and are not linked to your account.

Restaurant tags: when tagging is on, the name of the restaurant you pick is saved with that scan. If you switch tagging off, which withdraws your consent, every restaurant tag on your scans is erased. Otherwise tags are kept until you delete the scan or your account.

Analytics

Off unless you turn it on. The app asks whether you want to share analytics, and you can change your answer at any time in Settings → Privacy. The website has no analytics.

What is recorded: how the app is used — which screens you open, the type of each scan and its result, steps through the paywall and purchases, and when an error message appears. Each event carries your device type, operating system, app version and language, and is linked to your fufu account’s random identifier.

What is never recorded: your email address, name, IP address or location, the barcodes you scan, or any detail of anyone’s diet, allergies, faith or life stage.

Who receives it: PostHog, on its EU Cloud (see below). If you turn analytics off, the app stops sending events. When you delete your account, your analytics data at PostHog is deleted too.

Why we may use it (legal basis)

• To provide fufu (contract, Art. 6(1)(b) GDPR): your account, your household, your scans and your plan.
• Your explicit consent (Art. 9(2)(a) GDPR) for the special categories: health data (allergies, intolerances, life stage) and religious or philosophical belief (faith rules, and diets held as a belief, such as vegan). We ask for each separately, record which version of this policy you agreed to, and you can withdraw at any time without losing the rest of fufu.
• Your consent (Art. 6(1)(a) GDPR) for restaurant tagging and for analytics, each off unless you switch it on.
• Our legitimate interests (Art. 6(1)(f) GDPR) in keeping fufu secure and working: error reports, device sign-in records, and the device checks that prevent free-scan fraud.
• Legal obligation (Art. 6(1)(c) GDPR) for payment records, which tax law requires to be kept.

What we do not do

• We never sell or share your personal data for advertising, under any definition in European or United States law. We have no advertising business and no data partners.
• No tracking. fufu records no sessions, uses no advertising identifiers and does not follow you across other apps or websites. The only analytics are the app’s, and only if you turn them on (see “Analytics”).
• No guessing about you. We use your data to run the checks you ask for, not to infer your health, beliefs or circumstances.
• AI never decides a result. fufu’s own rules decide every result. AI reads photos and suggests recipes, and fufu’s rules then check its output against your household.

Who processes it for us

These companies process personal data for us, only on our instructions. Where one is outside the European Union, the transfer relies on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

• Supabase (Ireland): our database and sign-in service. Your account, household, scans, kitchen and settings are stored here.
• Railway (Netherlands): runs our server, the part of fufu that checks food. It receives your household data — names, allergies, age groups, diets and faith rules — every time you scan, so the check can be made, along with your photos on their way to Google, and your coordinates when you search for restaurants, which it uses for that search and never stores or logs. It does not store your household; that stays in Supabase.
• Vercel (Ireland): runs this website. Pages are delivered from Vercel’s network nearest to you; the website’s server code runs in Dublin.
• Google (Gemini AI): reads the photos you scan and the text of menus, and suggests recipes. For recipes it receives your pantry and, for each person, their allergies, age group, diets and faith rules — but never who they are: names are replaced with “Person 1”, “Person 2” before anything is sent. We use Google’s paid service on Google Cloud, where Google does not use what we send to train its models. This processing happens in the European Union, on Google’s Vertex AI service in the Netherlands. If Google’s automated checks flag a request as possible abuse, Google keeps it for up to 90 days, then deletes it.
• Sentry (Germany): receives error reports from the app, the website and our server so we can fix crashes. Before a report leaves, we remove email addresses, sign-in tokens, passwords and request contents, and we do not record screens or sessions.
• PostHog (Germany): receives the app’s analytics, only if you turn analytics on — the events described under “Analytics”, linked to your fufu account’s random identifier. Never your name, email address, IP address, location, or anyone’s health or faith information.
• Expo (United States): delivers push notifications to your phone, via Apple or Google. It receives your device’s push token and the notification itself, which can include a product name (for example, a recall or a pantry reminder). Expo also delivers app updates, and sees your device’s IP address when the app checks for one.
• RevenueCat (United States): manages purchases made in the app through the App Store or Google Play. It receives your fufu account’s random identifier — not your name or email address — and your purchase history.
• Paddle (United Kingdom): sells fufu on our website as merchant of record. It collects your payment details, email address, billing address and tax information, issues invoices, and keeps its own customer record of you.
• Resend (Ireland): sends our emails, such as sign-in codes and account notices. It receives your email address and each message, and keeps a log of sent messages for a limited time.
• Cloudflare: runs the DNS for getfufu.app — the system that tells browsers and the app where our servers are. It does not receive your account or household data.
• Google Workspace: handles email you send us at hello@getfufu.app.
• Apple and Google sign-in: if you sign in with Apple or Google, they confirm who you are and share your email address (and with Apple, optionally your name). They learn that you use fufu.
• Apple and Google as app stores: if you buy in the app, Apple or Google takes the payment under their own privacy policies, and they deliver push notifications to your phone.

Only Supabase, Railway and Google receive your household’s health or faith information. None of the others do.

How long we keep it

• Household profiles until you delete them — one person at a time, everyone with Reset household data in Settings, or by deleting your account. Past scans are not deleted with a profile; clear them in History.
• Scan history and favourites until you delete them in History, or delete your account.
• Restaurant tags until you delete the scan or your account, or switch restaurant tagging off — which erases them all.
• Photos: not kept by us. Google: up to 90 days, and only if its abuse checks flag the request, as above.
• Restaurant search coordinates: never stored or logged.
• Scan records: to improve our checks, we keep a record of each scan: the product, up to 2,048 characters of the text read from the label, the result, and the age group, diet and faith rules it was checked against. We also keep technical notes on how well text was read (method, language, confidence, text length — never the photo or the text). Neither is linked to your account, and both are deleted after 12 months.
• Devices and push tokens until you sign out on that device, the token stops working, or you delete your account.
• Free-scan records for two hours.
• Device checks for fraud prevention, for 12 months.
• Analytics, if you turned it on, until you delete your account.
• Guest households — fufu used without an account — are deleted after 30 days unused.
• Consent records for as long as your account exists, so we can show what you agreed to. When you delete your account, a copy is kept for three years under a coded reference, without your name, email address or anything else that identifies you, and then deleted.
• Payment records for seven years, by Paddle as merchant of record, because tax law requires it. Store purchases are held by Apple or Google.

When you delete your account, your profiles, scans, kitchen and settings are erased straight away. Deleted data can stay in our database provider’s backups for a short time, until they are replaced; we never restore deleted data from them. See how to delete your account for exactly what is removed and what is kept.

Your rights

Under the GDPR you can:

• Access the personal data we hold about you.
• Correct it — most of it directly in the app.
• Delete your account and its data.
• Take it with you in a structured, machine-readable format.
• Withdraw consent at any time.
• Object to processing based on our legitimate interests.

Email hello@getfufu.app. We reply within 30 days. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Cookies

The website sets one cookie of its own: the sign-in cookie that keeps you signed in. It also uses your browser’s storage briefly while you sign in from an email link. There are no tracking, advertising or analytics cookies. On the checkout page, Paddle’s checkout may set its own cookies to process your payment. The app does not use cookies.

If you are in the United States

fufu is run from the Netherlands. The rights below are in addition to everything above — we apply one standard everywhere.

Health data. Washington’s My Health My Data Act, and similar laws in Nevada and elsewhere, treat information about health and nutrition as consumer health data, which covers most of a fufu profile. We publish a separate Consumer Health Data Privacy Policy, as those laws require.

Sensitive personal information. Under California’s CPRA and similar laws in other states, health information, religious belief and precise location are sensitive. We ask for your consent before collecting health and faith information, use all three only to run the features you ask for, and never use them to infer anything further.

Depending on your state, you can:

• Know what personal information we hold, and get a copy.
• Correct it.
• Delete it.
• Limit how we use sensitive personal information.
• Opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of — including through a Global Privacy Control signal — but we will confirm it in writing if you ask.
• Appeal if we refuse a request, and contact your state Attorney General.
• Not be treated differently for using these rights.

We reply within 45 days, extendable once where the law allows.

If you are in Canada

We handle your information in line with PIPEDA and, in Quebec, Law 25. Health information and religious belief are sensitive under both, and we ask for your express consent before collecting either. You can ask for access, correction, deletion and portability using the contact details above, and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Children

The account holder must be an adult. fufu is not aimed at children. If you are under 16, or under the age of digital consent where you live, please do not create an account.

You can add children to your household — the age groups include babies and toddlers. When you do, you are giving us health information about a child in your care, and you confirm you are their parent or guardian. It is protected like everything else here, used only for your checks, and erased when you delete the profile or your account.

Changes to this policy

If we make important changes, we will tell you by email or in the app at least 14 days before they take effect. The date at the top always shows the latest version.