Privacy Policy

This Privacy Policy explains how the mobile application Yllo, published by Arynass IT, handles your information when you use the app on Android or iOS devices.

Data controller: Arynass IT. Contact: [email protected]

1. What we do not collect

We never collect or receive:

• Your real name, email, phone, address, contacts
• Your location (approximate or precise)
• Your photos or videos
• Your social-media identifiers
• Health data beyond the intolerance flags you choose locally
• Analytics, app usage events, advertising identifiers
• Any data that would let us identify you as an individual

We do not have any database, server, or account system on our side. There is nothing to "log in to" and no profile of you on our servers.

2. What stays on your device only

All of the following is stored locally on your phone (SQLite database + AsyncStorage). It never leaves your device, we never see it, and no third party receives it:

• Profile data — the free-text first name / last name labels you type, plus the intolerances you tick
• Scan history — barcodes you've scanned and the product info we fetched for them
• App preferences — language, theme, Healing Path toggle, daily scan counter
• Camera feed — processed in real time during scanning, never captured or stored

Uninstalling the app removes everything in this section from your phone. You can also clear it from inside the app at any time (Profile → Delete scan history, and My Profiles → Delete).

3. What leaves your device, and why

3.1 Barcode lookups (Open Food Facts)

Each time you scan a new product, the app sends an HTTPS request to https://world.openfoodfacts.org containing only the 8–13-digit barcode of the product. No user identifier or personal information is included.

Open Food Facts is a non-profit collaborative food database; its privacy policy is available at openfoodfacts.org/cgi/privacy.pl.

3.2 Premium subscription (RevenueCat + Google Play Billing or the Apple App Store)

If — and only if — you choose to upgrade to Premium, the following flow happens:

• RevenueCat (subscription orchestration) receives an anonymous identifier generated by the app, your purchase events from Google Play on Android or from the App Store on iOS, your country code, and basic device metadata. It does not receive your name, email, profiles, or scan history. Their privacy policy: revenuecat.com/privacy.
• Google Play Billing processes the actual payment on Android. We never see your card details. Google's privacy policy: policies.google.com/privacy.
• The Apple App Store processes the actual payment on iOS, through the system's own purchase sheet. We never see your card details there either. Apple's privacy policy: apple.com/legal/privacy.

These two services have their own data-controller status: we are not the controller of the data they store. If you cancel your subscription and want the residual purchase records erased, you must contact each provider directly using the links above. We can write to RevenueCat on your behalf — see Section 7.

3.3 Operating system crash / diagnostic data

Android (Google) and iOS (Apple) may automatically collect crash and performance reports under their own privacy policies. We do not have access to any identifying information in those reports.

4. Permissions the app requests

• Camera — required to read product barcodes. The camera is only active while the scanner screen is open. We do not take photos or videos, do not store frames, and never upload anything from the camera.
• Internet — required to query Open Food Facts for product information and to communicate with RevenueCat and your app store — Google Play or the App Store — if you have a Premium subscription.
• Billing (com.android.vending.BILLING) — Android only — required to let you purchase a Premium subscription through Google Play. iOS has no equivalent permission: a purchase there goes through the system's own purchase sheet.

5. Data security

All network traffic between the app and our third-party providers (Open Food Facts, RevenueCat, and Google Play or the App Store) is encrypted over HTTPS / TLS. Local data on your phone benefits from the operating system's sandbox protections (Android scoped storage, iOS app container).

6. Children's privacy

Yllo is intended for users aged 13 or older. It is not directed to children under 13 and does not knowingly collect personal information from them. If you believe a child under 13 has provided personal data through the app, please contact us so we can help.

7. Your rights and how to delete your data

Because the app has no backend and no centralised account, the way to exercise data-protection rights is slightly different from a typical "delete my account" flow. Here's how it works:

7.1 Data stored on your phone

You control it directly. To remove it:

• Open the app, then: Profile → Delete scan history — wipes all scanned products
• Profile → My Profiles → tap a profile → delete — removes that profile and its intolerances

7.2 Subscription / billing data

To stop or cancel a Premium subscription, use the store you bought it from. On Android: Play Store → Profile → Payments & subscriptions → Subscriptions. On iOS: Settings → your name → Subscriptions. To request deletion of historical purchase records held by Google, Apple or RevenueCat, contact them directly using the links in Section 3.2. If you'd like us to forward a deletion request to RevenueCat on your behalf, write to us — we will do so within 30 days.

7.3 Statutory rights (GDPR, UK GDPR, CCPA, LGPD…)

Where you are protected by a privacy law that gives you the right to access, correct, delete, restrict, object to or port your personal data, you can exercise those rights against the data controllers listed in Section 3.2 (RevenueCat, Google) which are the only parties that hold any personally connectable data related to your use of Yllo. We do not hold any personal data on you.

You can always reach us at [email protected] if you have a privacy question or need help; we will reply within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

8. International data transfers

Because we do not run a backend, we do not transfer your data ourselves. The third-party providers used by the app (RevenueCat, Google) may process data outside your country, including in the United States, under their own legal frameworks (such as Standard Contractual Clauses approved by the European Commission). Their privacy policies are linked in Section 3.2.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the app or in applicable law. Any changes will be posted on this page with an updated "Last updated" date. Material changes will also be announced inside the app on next launch.

10. Contact

Arynass IT
Email: [email protected]

© 2026 Yllo – com.hazarapp.foodfit