Privacy Policy

What is Halal One?

Halal One is a free educational app that helps you understand ingredients in packaged food. We don't sell your data, show ads, or track your activities. This Privacy Policy explains how we handle your information.

Who Is Responsible for Your Data

The controller responsible for your data under the EU General Data Protection Regulation (GDPR) is Mahnoor Manzoor, the developer of Halal One. You can reach us at mahnoor.designsolutions@gmail.com.

What Information We Collect

• When you create an account: your email, your name and your password (stored only in hashed form).
• If you sign in with Google: your name, email and Google account ID, which Google shares with us when you choose this.
• When you use the app: your scan history (products you've scanned, ingredients, verdicts).
• If you use the app as a guest: a random device ID, stored on your phone, so we can show your scan history without an account.
• When you log in or change your account: security data such as your IP address, device name and app or browser information.
• If you send feedback: your message, and your email if you are logged in.
• If you submit a product to Discover: the product details and photos you add, and your name only if you choose to show it publicly.
• If you use AI chat: the questions you ask (not stored, see below).

How We Use Your Data

We use your data only for these purposes, each with a legal basis under the GDPR:

• To run the app and your account (log in, scan history, AI chat, Discover submissions): Art. 6(1)(b) GDPR, because we need it to provide the service you asked for.
• To keep accounts secure and prevent abuse (security data, limits on requests): Art. 6(1)(f) GDPR, our legitimate interest in a safe service.
• To improve the app's accuracy and to read and answer your feedback: Art. 6(1)(f) GDPR, our legitimate interest in a reliable app.
• The guest device ID is stored on your phone because it is strictly necessary for the guest scan history you use (§ 25(2) no. 2 TDDDG).

You don't have to give us personal data. Without an email you can't create an account, but you can still use the scanner as a guest.

Service Providers and AI

We share data only with providers that help us run Halal One. They process it on our behalf and only as we instruct:

• Supabase: our database and photo storage, on servers in the EU (Paris, France).
• Railway: runs our server, which every request from the app passes through.
• Anthropic (Claude): answers your AI chat questions and checks Discover photos for a food product or halal label. We don't store your chat messages, and Anthropic does not use this data for advertising.
• Google: only if you choose “Sign in with Google”.
• Expo: delivers app updates; your phone contacts Expo's servers to check for them.
• Open Food Facts: the public product database. Our server looks up the barcodes you scan without any personal data. Product photos in the app load directly from Open Food Facts, which sees your IP address.
• Netlify: hosts our website (see “Our Website”).

Supabase, Railway, Anthropic, Google, Expo and Netlify are US companies, so data may be processed in the USA. These transfers are protected by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses, as set out in each provider's data processing terms.

Where Your Data Is Stored

Your data is stored securely on Supabase servers in the EU (Paris, France). We use encryption to protect your information in transit and at rest. Passwords are hashed and never stored in plain text.

How Long We Keep Your Data

• Account data: until you delete your account. Your name and email are then removed immediately and you are logged out on all devices.
• Scan history: after you delete your account, it is kept only in anonymous form, for research.
• Guest scan history: linked only to the random device ID. Email us if you want it deleted.
• AI chat messages: not stored.
• Security data: login records are deleted when you delete your account. Security logs of account actions are kept only as long as needed to protect accounts and investigate misuse.
• Feedback: kept to answer you and improve the app. Your email is removed from it when you delete your account.
• Discover submissions: kept while the product is listed in Discover. Email us if you want yours removed.

Your Rights

Under the GDPR you have the right to access your data, correct it, delete it, restrict how we use it, receive it in a portable format, and object to uses based on our legitimate interest (Art. 15–21 GDPR). To use any of these rights, email us.

You can delete your account yourself anytime from Settings → Profile → Delete Account.

You also have the right to complain to a data protection authority, for example the one in the German state where you live.

No Ads, No Tracking

This app has no advertising, no tracking cookies, and no analytics that identify you personally. We never monitor what you do or sell your data to marketers.

We don't make decisions about you based only on automated processing (Art. 22 GDPR). The app's verdicts are information about ingredients, not decisions about you.

Our Website

Our website, halaloneapp.netlify.app, is hosted by Netlify, a US company. When you visit it, Netlify's servers automatically record basic technical data, such as your IP address, browser type and the time of your visit, to deliver the website and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest in a working, secure website). Netlify keeps these logs according to its data processing terms.

The website uses no cookies, no analytics and no tracking. Its fonts and scripts are stored on the website itself, so no other company receives your data when you visit.

Changes to This Policy

If we change this policy, we update it here and change the date at the top.