Privacy Policy

Snacco Privacy Policy

Last updated: 9 October 2026

Who we are

Snacco is developed by Josh Waller (Kovus), based in Australia. Contact: josh@kovus.dev. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles.

What leaves your device, and when

Snacco is designed so that as little as possible leaves your phone:

• Label scans (free): the photo of an ingredients label is processed entirely on your device using on-device text recognition. The photo is never uploaded. Only the recognised ingredient text is sent to our server to be checked against our toxin database and is processed transiently rather than retained on Snacco's backend. Separate abuse and security records are described below.
• Barcode scans: the barcode number is looked up against Open Pet Food Facts, an open public database. The returned product information is then checked against our toxin database the same way as label text.
• "Can my dog or cat eat this?" photo checks: this optional feature sends the single photo you take to our server, where Google's Gemini API is used only to name the food in the photo. Before upload, the photo is downscaled and its metadata (including any location data) is stripped. Snacco does not retain the submitted photo on its backend. Separately, in version 3.2 you can choose to keep a photo copy in Snacco's app storage on this iPhone, as described below.
• App verification for Snacco+ photo checks: Apple App Attest gives our server an installation public key, an Apple attestation receipt, and a changing assertion counter. We store these pseudonymous security records with a server-issued RevenueCat identifier so we can verify the app and subscription before processing a photo. The records link an app installation with its verified subscription; random or keyed identifiers do not make that mapping anonymous. You do not need to register an account or provide contact details for these checks.
• Recall alerts (optional): if you enable recall alerts, a device push token is registered with our server so we can send a silent "recall list updated" signal to that device. Matching recalls against your scan history happens entirely on your device; your history is not uploaded for recall matching. Turning recall alerts off in Snacco requests removal of the token and retries after a temporary failure. If you turn notification permission off in iOS Settings, Snacco does the same when you next open the app.
• Purchases: the optional Snacco+ subscription is processed by Apple and managed through RevenueCat's subscription SDK. RevenueCat initially uses its own anonymous app identifier; Snacco uses a server-issued pseudonymous identifier after app verification, linked to the installation and subscription security records described above. Purchase and entitlement information supports subscription management, receipt verification and subscription analytics. Snacco does not receive your name, email, or payment-card details.

What stays on your device

• Your scan history, favourites, pet profiles, and optional pet profile photos.
• Recall matching against your history.
• App preferences (onboarding state, notification choices).

Deleting the app removes its local database, scan history, and app-managed photos. iOS Keychain items used for security and preferences may persist if the same app is reinstalled. The random secret used to request exact recall-token removal is held only in Keychain; if it is unavailable, the server token can remain until a later delivery failure identifies it as inactive.

Optional photos saved on your iPhone

In version 3.2, you can choose to keep a separate photo copy with a scan or pack on this iPhone. Choosing to keep a copy does not add another upload. Label photos are read on the device; an optional Photo check still sends a reduced, metadata-stripped image through our backend to Google Gemini to identify the food.

You can remove a saved copy, or clear saved scan and pack photos in Settings, without removing your text history or pet-profile photos. Removing a copy from Snacco does not delete the original image from your Photos library. If a local deletion fails, Snacco reports that it needs to be retried.

App storage may be included in device backups according to your device settings. We do not promise that an on-device copy is excluded from backups.

What the app does not request

• Using Snacco does not require account registration or providing a name, email address or phone number.
• Snacco does not request GPS or precise device location.
• No ad networks or advertising trackers. Snacco includes RevenueCat's subscription SDK and Sentry's crash-reporting SDK. RevenueCat handles subscription information; Sentry receives crash, error and session-health diagnostics. Crash-reporting settings minimise personal information; the configured fields removed from reports are described below.
• No sale or sharing of personal information with data brokers — ever.

Service providers

We use a small number of infrastructure providers to run Snacco:

• Supabase — hosts our backend and toxin/recall database.
• Google (Gemini API) — processes photos from the optional "Can my dog or cat eat this?" feature, solely to identify the food. We use Gemini API Paid Services through a billing-enabled Google Cloud project. Under Google's Paid Services terms, Google does not use submitted prompts, photos or responses to improve its products. Snacco disables optional developer request logging for Photo checks. Google may still log prompts and responses for a limited period for safety, security and legal obligations. Provider retention is separate from Snacco's backend processing. Processing may take place in countries where Google or its agents maintain facilities. See the Gemini API terms.
• Open Pet Food Facts — public product database queried for barcode lookups.
• Expo — delivers push notifications for recall alerts.
• RevenueCat & Apple — process and manage subscriptions. RevenueCat's SDK initially uses its own anonymous app identifier, then Snacco supplies a server-issued pseudonymous identifier after app verification. The retained installation and subscription records deliberately preserve linkage. RevenueCat uses app identifiers and purchase/entitlement information for subscription management and subscription analytics; Apple handles payment.
• Sentry — receives crash, error and session-health diagnostics so we can fix faults. Reports can include error messages, exception details and diagnostic context, along with device, iOS and app-version information. Snacco configures default personal-information collection, screenshot attachments and view-hierarchy attachments off, and sets performance transaction sampling to zero. For JavaScript error events handled by Snacco's custom filter, user, request, extra, breadcrumb and tag fields are removed; messages, exception values and other context can remain. Native crash reports use the native SDK and do not pass through that custom JavaScript filter; native diagnostic context and breadcrumbs can remain. These controls minimise personal information but do not guarantee that every report is free of user content.

These providers process data for the purposes described above; their terms also govern their infrastructure logging and retention.

Data retention

• Ingredient text and photos sent for checking are processed transiently and are not retained on Snacco's backend. Optional photo copies you choose to keep remain in app storage on your iPhone until removed through the app or when the app's local data is deleted. The original photo in your Photos library is separate.
• Pseudonymous app-verification and subscription security records, including App Attest keys, receipts and counters, server-issued identifiers and keyed purchase-verification hashes, are retained for subscription enforcement, replay prevention and abuse protection. These records retain an installation/subscription mapping. Reinstalling the app may create a new installation record and does not automatically remove server records.
• Device push tokens are retained until Snacco successfully requests removal or Expo reports the token inactive after a delivery failure. Snacco requests removal after you turn alerts off in the app or return with notification permission off, and retries after a temporary failure.
• Public-endpoint abuse counters use a keyed hash of the request network address; Snacco's rate-limit table stores this keyed value rather than the raw address. An hourly cleanup targets buckets older than two days, calculated from rounded hourly windows. This is a scheduled retention target, not a strict 48-hour deletion guarantee: interruptions can delay cleanup. The keyed value is not used to locate you or for advertising. Hosting infrastructure also processes connection data under its own logging and retention arrangements.
• Our service providers may retain transient data for their own security and abuse-prevention periods under their service terms.

Children

Snacco is not directed at children. The data handling described in this policy still applies when the app is used. If you believe a child has submitted personal information, contact us so we can review it.

Not veterinary advice

Snacco is an informational tool. It is not veterinary advice and not a medical device. If your pet has eaten something concerning, contact your veterinarian or nearest emergency veterinary clinic. The Animal Poisons Helpline lists 1300 869 738 for Australia and (917) 722-5958 for the United States.

Changes and contact

If this policy changes, the updated version will be published at this address with a new "last updated" date. Questions, or want something deleted? Email josh@kovus.dev. Because Snacco does not require account registration, tell us which feature the request concerns. We will explain whether the relevant pseudonymous app/subscription record or device push token can be located, the applicable retention period, and any legal or security reason for retaining it. You may also lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au).