Privacy Policy

Effective 28 September 2026

HalalScan.AI ("we", "the app") is operated by the developer of com.APhalalscan.app. This policy explains what data the app collects, how it is used, and your rights.

Information we collect

On-device only (never sent to our servers):

• Your scan history (products you have scanned, ingredients, AI verdicts)
• Your madhhab preference and other app settings
• A locally generated anonymous device identifier used to rate-limit AI requests

Sent to our backend (Cloudflare Worker) only when you scan:

• The product name, ingredients text, or photo you are checking
• The anonymous device identifier (used to check your subscription and enforce rate limits)
• Your IP address, processed transiently to enforce rate limits — not stored

We do not collect:

• Your name, email, phone number, or any other personal identifier
• Your precise location
• Contacts, photos beyond what you submit for a scan, or any other on-device data
• Cross-app tracking identifiers, unless you allow tracking (see Advertising measurement)

How your data is used

• Ingredient and image data are forwarded to Anthropic's Claude API to generate a halal verdict, then discarded by our backend. We retain only aggregate rate-limit counters keyed to the anonymous device identifier.
• Anthropic processes the data under its own privacy terms: anthropic.com/legal/privacy. We do not authorize Anthropic to use submissions to train its models.
• USDA FoodData Central and Open Food Facts (world.openfoodfacts.org) are queried for product information, including ingredients and nutrition. Only the barcode or search query you provide is sent. An ingredient list printed in another language is translated by Anthropic's Claude before it is checked.

In-app purchases

If you subscribe to a paid plan, the transaction is processed and billed by Apple's App Store. We never see or receive your payment details.

We use RevenueCat to manage subscription state. When you subscribe, restore a purchase, or your subscription renews or lapses, RevenueCat receives the anonymous device identifier described above together with the transaction details Apple provides (product purchased, purchase and expiry dates, renewal status). It does not receive your name, email, or payment method. RevenueCat notifies our backend of these events so the app knows whether your subscription is active; our backend stores only that active/inactive flag against the anonymous device identifier.

Advertising measurement

We advertise HalalScan.AI on TikTok and use the TikTok Business SDK to learn which ads lead to installs and subscriptions. The app tells TikTok when it is installed and opened, when a scan finishes (its verdict, the product category, and whether it came from a photo or a product lookup), when the subscription screen is shown, and when a subscription is bought, with its price and currency. It never sends ingredients, photos, product names or your scan history. TikTok also receives technical information from your device, such as its model, operating system version and IP address.

Before your device's advertising identifier (IDFA) is shared, the app asks your permission with Apple's App Tracking Transparency prompt. If you decline, it is never shared, and TikTok measures campaigns only through Apple's SKAdNetwork, which reports installs without identifying you. You can change your choice at any time in Settings → Privacy & Security → Tracking.

TikTok handles this data under its Partner Privacy Policy.

Data retention

• On-device data stays on your device. Uninstalling the app removes it.
• Abuse-protection counters on our backend expire automatically within minutes.
• A retired counter of free scans used may still exist against the anonymous device identifier from when the app had a free allowance. It is a number, it is no longer read, and it is not linked to anything about you or to what you scanned.
• Subscription status is retained for as long as the subscription is active, and is keyed only to the anonymous device identifier.
• We do not maintain user accounts, and there is nothing personally identifiable to delete.

Children

HalalScan.AI is not directed to children under 13. We do not knowingly collect data from children.

Your rights

Because we do not collect personally identifiable information, traditional GDPR/CCPA access or deletion requests do not apply. To remove all app data, uninstall the app.

Contact

Questions? Email support@halalscan.org.

Changes

If this policy materially changes, we will update the effective date at the top and post a notice in the app.