Halify Privacy Policy

Who we are#

Halify is a mobile app that shows whether a food product is halal, haram, mushbooh (doubtful) or unknown, from its barcode, its name or a photo of its ingredients label. It is made by Halify. You can contact us at halify.app@gmail.com. This policy is published at https://halify.app/privacy.

This policy says what the app collects, why, who receives it, how long it is kept and how you can remove it.

Our privacy promise#

We do not sell your personal data. Label photos are never stored. If you choose personalised ads, Google AdMob uses your phone's advertising ID to show them. You can switch to non-personalised ads in the app, or reset your advertising ID in Android settings. You can delete your account any time.

What we collect and why#

You can scan barcodes, search, browse products and read about E-numbers without an account. The items below are the complete list of what the app collects or shares.

Your Google sign-in identity#

If you sign in with Google, we receive your Google account name and email address, and Google's identifier for your account. We use them to create your account and to recognise you when you sign in again. Signing in is optional.

Saved products, scan history and search history#

When you are signed in, we keep the products you save, your last 50 scans and your last 20 searches, each with its date and time, so you can see them on any phone you sign in on. Older scans and searches are removed automatically. You can clear your history in the app at any time. Admins cannot see your saved products or your history.

Flags you send#

When you flag a verdict you think is wrong, we keep the reason you chose, your note if you wrote one, the product (or, for a label check, the ingredients read and the verdict shown, never the photo), the date and your account. The app asks you not to put personal details in the note. Admins use flags to correct verdicts. You can send up to 5 flags a day.

Product submissions and their photos#

From public release, you will be able to send us a product we do not have yet: its barcode, name, brand and ingredients, and optionally a photo of it. If you add a photo of the ingredients label, the photo is sent from our server to Google Gemini to read the ingredients (as under "Label photos"), and the text it reads is put in the form for you to check. We keep what you send and its photo so an admin can review it and add the product. We keep a small count of how many label reads each account made that day, to apply a daily limit, for 2 days.

Label photos#

When you check a product by photographing its ingredients label, the photo is sent from our server to Google Gemini, an AI service, to read the ingredients. We do not store the photo. We keep only the result (the ingredients read and the verdict), and only in your scan history if you are signed in.

Advertising ID and device information#

The app shows banner ads to pay for the service, served by Google AdMob. Once you have made your ad choice, Google AdMob collects your phone's advertising ID and device information (for example the phone model, operating system version and language) to show ads, count them and prevent fraud. This happens also when you choose non-personalised ads. Your advertising ID is collected and shared with Google AdMob for this purpose. With personalised ads, AdMob also uses your advertising ID to choose ads that may interest you. You can reset or delete your advertising ID in your phone's settings.

Ads are limited to the maximum ad content rating G (suitable for all audiences). Nothing is sent to any ad network before you make your ad choice.

IP address#

Every request from the app to our server carries your phone's IP address. Our server uses it to limit how many requests one device can make, to keep the service fair and protect it from abuse. The address is held in memory only, for the one minute the limit counts, and is then forgotten. It is never written to a log: our server keeps no access log.

Push notification token#

From public release, if you allow notifications, your phone's notification service gives the app a token so we can tell you when a product you submitted has been added or declined. We keep the token with your account and sign-in session, and remove it when you sign out, turn notifications off, delete your account, or when it has not been seen for 90 days. We also keep a short record of each notification we sent, so that none is sent twice: notification records are kept for 30 days.

Who receives your data#

We share data only with the services below, and only for the purpose given.

Google sign-in#

Google handles signing in with your Google account. Google's own privacy policy applies: policies.google.com/privacy.

Google Gemini#

Our server sends label photos to Google Gemini to read the ingredients, with no name or email address. We use the paid Gemini API. Under Google's terms for paid use, Google does not use what we send to improve its products; it keeps it for a limited time only to detect abuse and meet legal duties. See Gemini API Additional Terms.

The ad network#

The ad network is Google AdMob. It receives your IP address, advertising ID and device information after you make your ad choice, as described under "Advertising ID and device information". Google's own privacy policy applies: policies.google.com/privacy.

Amazon Web Services#

Our server and database run on Amazon Web Services (AWS) in Sydney (ap-southeast-2), which hosts and stores the data described in this policy for us. Its own privacy notice applies: aws.amazon.com/privacy.

The notification service#

From public release, the notification service is Expo's push notification service, which passes them to Google Firebase Cloud Messaging (FCM) to reach your Android phone. They receive your push notification token and the notification text (for example the product name and whether it was added). Their own privacy policies apply: expo.dev/privacy and policies.google.com/privacy.

Ads and your choice#

Before any ad is shown, the app asks you to choose "Personalised ads" or "Non-personalised ads only", using Google's consent form for AdMob (the User Messaging Platform). Your choice stays on your phone; it is not sent to our server. Nothing is sent to any ad network before you make this choice.

After you choose, the consent form and AdMob's ads receive your phone's IP address, advertising ID and device information, for either choice. Ads are banners shown only on Home, in search results and in the browse list, never on the scanner or a verdict, and ads never influence verdicts.

You can change your choice at any time in Me > Ad preferences. The new choice applies to the next ads the app asks for.

Other records we keep#

Records about admins#

Every change an admin makes to products, verdicts, sources, ingredients, E-numbers or a user's status is recorded with the admin's name, what changed and when. These records are kept for 1 year.

The ban list#

If an account is banned for abuse, we keep a hashed (one-way scrambled) form of its Google identity, so the same Google account cannot sign up again. It is kept even if the account is deleted, and for as long as the ban lasts. We review the ban list every 2 years. After a ban is lifted, we remove the entry on request.

How long we keep data#

• Your account, saved products and submissions: until you delete your account.
• Submission photos: 30 days after review (an admin reviewing the submission), or 30 days after the submission expires unreviewed.
• Notification records: 30 days.
• Label-read counts for submissions: 2 days.
• Push notification tokens: until you sign out, turn notifications off or delete your account, or 90 days after the app was last seen with it.
• Internal delivery records of our own events (for example "a submission was reviewed"): delivered ones 7 days, failed ones 30 days.
• Scan and search history: your last 50 scans and last 20 searches, until you clear them or delete your account.
• Flags: kept after your account is deleted, with your name and email removed.
• Label photos: not kept at all.
• IP addresses: one minute, in memory only.
• Admin change records: 1 year.
• Backups: we back up our database every day and keep each backup for 7 days, so deleted data leaves our backups within 7 days. If we ever restore a backup, every account deleted after that backup was taken is deleted again before the service reopens.

Delete your account#

You can delete your account in the app: Me > Delete account. Before anything is deleted, the app lists what will be removed: your account, saved products, scan and search history, your submissions and their photos, and your push notification tokens. Flags you sent stay, with your name and email removed, so admins can still correct verdicts.

Your ad choice is stored only on your phone. Change it in Me > Ad preferences, or remove it by uninstalling the app.

Children#

Halify is for people aged 13 and over (13 to 15, 16 to 17 and 18 and over); nothing in the app is aimed at anyone under 13, and we do not knowingly collect data from them. The app tells Google AdMob that it is not directed at children under 13. If you believe a child under 13 has given us personal data, contact us and we will delete it.

Product photos and data#

Some product data comes from Open Food Facts, available under the Open Database Licence (ODbL). Some product photos are by Open Food Facts contributors, under CC BY-SA 3.0, and are credited where they appear in the app. See openfoodfacts.org.

Security#

The app talks to our server only over an encrypted connection (HTTPS). Only admins on our admin list can sign in to the admin panel, and every admin change is recorded.

Changes to this policy#

When we change this policy, we update this page and the date at the top.