Privacy policy
The short version
- You can use MEBA without an account. Your allergens, fasting and gluten-free settings and scan history then stay on your phone.
- We don't sell your data and we don't use it for advertising.
- The camera is used only to read barcodes and, if you choose, the ingredient list on a pack. Photos are read on your phone and never sent or stored; only the text you then check is sent.
- You can delete your account and all its data at any time, from the app.
What we collect
Without an account: when you check a product, we receive the barcode (or the ingredient text you pasted) and the allergens you're checking for, so we can give you the answer. We don't keep them linked to you. Your choices and history are saved only on your phone.
With an account (optional, to sync between phones), we also store:
- your email address and name (if you give one);
- your password, stored only as a secure one-way hash;
- your allergens and your fasting and gluten-free settings;
- your scan history (products you checked), unless you turn history off in Account;
- basic sign-in records (the type of device and browser, and when you last used the app), so you can see and end your sessions.
Emails: we use your email address only for your account: a welcome message, password-reset links, a notice when your password changes and, if a subscription applies, payment receipts and reminders before it ends. No newsletters or marketing.
Allergy information is health-related, so we treat it with extra care: it is used only to give you results and is never shared for advertising or marketing.
Usage numbers: to see how the app is used and which products we're missing, we log each scan: the product, the result, the type of device and when. We never log your allergens or diet with it. Guests are counted with a code that changes every day. These records are deleted after about 13 months, or with your account.
Who else receives data
- Product databases — we look up the barcode in Open Food Facts (and its sister databases for beauty products, pet food and other products), USDA FoodData Central, the US FDA's drug labels (openFDA), Open Library, Google Books, MusicBrainz and UPCitemdb to find out what the product is: its name, ingredients, labels, packaging and nutrition. Only the barcode is sent, never who you are.
- Reading ingredient photos — the text-recognition program is downloaded from the jsDelivr network the first time you use it, then runs on your phone. Your photo is not sent anywhere unless you tick “Share this label”.
- Anthropic (AI photo reading) — when this feature is on, label and dish photos you take in the app are sent to Anthropic, our AI provider, to be read. We don't store them. A dish estimate is not an allergy check.
- Labels you choose to share — if a product has no ingredients and you tick “Share this label”, a small copy of your photo and the text go to our team. We check them, then delete the photo; the approved ingredient list is shown to everyone who scans that product. Please photograph only the label.
- Stripe or Square — if you pay online, the payment page is theirs: your card details go to them, never to us. We only keep the amount, the date and their payment reference.
- Google Workspace — account emails are sent through ORYXUN GLOBAL's Google mailbox (info@oryxunglobal.com).
- Our hosting provider runs our server in the United States and stores the data above on our behalf.
- Google / Apple — in the store apps, the phone's built-in barcode scanner (Google code scanner on Android) reads the barcode on your device.
Recall alerts: to warn you when something you scanned is recalled, the app sends the barcodes in your scan history to our server, which compares them with the FDA's public recall list. We don't keep that list of barcodes.
App updates: the store apps ask our server whether newer screens are available, sending the app version, the phone's platform and a random ID made by the update component. We use it only to answer that question and don't keep it.
We don't use advertising or analytics trackers. If we ever add ads, they will not be personalised using your allergy data, and we will update this page first.
Answers about packaging
When you answer a question like “Does the pack say BPA-free?”, we store your answer with the barcode so other people can see how many said yes or no. It's linked to your account if you're signed in; otherwise only to a random number your phone made up (we keep a scrambled version of it), not to you. Deleting your account deletes the answers linked to it.
How long we keep it
Account data is kept until you delete your account. Scan history keeps your most recent 200 products. Product information from Open Food Facts is cached on our server for up to 7 days and isn't linked to you.
Deleting your account and data
In the app: Account → Delete account, then enter your password. This immediately and permanently deletes your account, allergens, settings and scan history.
Can't sign in? Email info@oryxunglobal.com from the address you signed up with, and we'll delete it within 30 days.
Without an account, your data is only on your phone: sign out (if signed in) or clear the app's data / uninstall it.
Security
All connections use HTTPS. Passwords are hashed (scrypt), and sign-in tokens are stored only as hashes.
Children
MEBA is meant for adults and families managing food allergies. It isn't directed at children under 13, and we don't knowingly collect their personal information.
Not medical advice
MEBA uses product data from Open Food Facts, which can be incomplete or out of date. Always read the label, and talk to your doctor about your allergies.
Changes and contact
If this policy changes, we'll update this page and the date above. Questions: info@oryxunglobal.com · ORYXUN GLOBAL.