OptimallyPrivacy Policy
Who we are
Optimally is an iOS app that scans food and personal-care products and shows an ingredient-based score. This policy explains exactly what data the app handles and where it goes. It applies to the Optimally iOS app and to this website.
Optimally is operated by Nathaniel Fiskå, a sole trader based in Norway. For any privacy question, email nathanielfiska@gmail.com.
No account, ever
Optimally does not have accounts. We never ask for your name, email address, phone number or date of birth, and there is nothing to sign in to.
Data stored on your device
Your profile answers, scan history, saved items and shopping list are stored locally on your device and are not uploaded to any Optimally server. You can erase all of it at any time in Settings → Reset everything, or by deleting the app.
Product lookups
When you scan a barcode or search for a product name, that barcode or search term is sent to Open Food Facts — and, for personal-care items, Open Beauty Facts — to retrieve the product’s details. These are free, open, community-built databases. The request contains the barcode or search term only; it carries no identifier for you or your device. See the Open Food Facts privacy policy.
Other services the app contacts
| Service | What is sent | Why |
|---|---|---|
| Open Food Facts / Open Beauty Facts | A barcode, or a product search term | To look up the product’s ingredients and details |
| Optimally swap service (our Cloudflare Worker) | A barcode, and nothing else | To generate suggested alternatives for that product. The service looks the product up itself, so no text you type and no personal data ever reaches it. Results are cached by barcode and are identical for every user. |
| openFDA (U.S. Food & Drug Administration) | A brand name or product name | To check whether that product or brand appears in the public U.S. food recall database |
| Apple | Your purchase, handled entirely by Apple | To sell and manage Optimally subscriptions |
| RevenueCat | An anonymous subscription ID generated by RevenueCat, plus basic device and app information their SDK collects (including Apple’s per-vendor device identifier) | To tell the app whether your subscription is active. Not linked to your name or email. |
| PostHog (EU region) | Anonymous usage events — see below | Product analytics |
None of these requests include your name, email address, contacts, precise location, or your scan history.
Camera and photos
Barcodes are read entirely on your device. The barcode scanner never uploads an image.
When you photograph a product or a meal, that photo is uploaded to our server and passed to OpenAI, which identifies what is in the picture and sends the answer back. This is the only way the photo scanner can work, and it is the only feature that sends an image anywhere. We send the photo and nothing else: no name, no email, no account, no advertising identifier and no location. We do not keep the photo after the answer comes back. Under OpenAI’s API terms the image is not used to train their models, and they may retain it for up to 30 days for abuse monitoring before deleting it.
How we collect it, and what it is used for. The image is collected only at the moment you press the shutter on the photo scanner, never in the background and never from your photo library unless you pick a picture yourself. It is used for exactly one purpose, identifying the food in the picture so it can be scored. It is not used for advertising, not used to build a profile of you, not sold, and not shared with anyone other than OpenAI for that single purpose.
Third-party protection. OpenAI processes this image under their API data usage policies, which commit them to a standard of protection equal to the one described on this page: no training on your content, no sale of it, use limited to returning the result, and deletion after the retention window above. We do not share your images with any other third party.
You are asked for permission inside the app before the first photo is ever sent, and the barcode scanner remains fully on-device for anyone who declines.
If you would rather no image ever left your phone, use the barcode scanner, which gives an exact answer without uploading anything.
Saving a share card to your Photos happens only when you tap to save it.
Analytics — specifically
Optimally sends a small number of anonymous usage events to PostHog, hosted in the European Union, so we can see where people get stuck and improve the app.
Each event is tagged with:
- A random identifier generated on your device the first time you open the app. It is not Apple’s advertising identifier (IDFA), not the vendor identifier (IDFV), and it is not linked to any identity. Deleting and reinstalling the app generates a new one.
- The app version, your iOS version, and whether the device is a phone or a tablet. Never the exact device model.
The events themselves cover: progress through onboarding and the answers you pick there, that a scan started, succeeded or failed and the score band it fell into, which sections of a verdict you opened, and whether the paywall was shown or a purchase was made.
What is never sent to analytics: no barcodes, no product names, no photos, no scan history, no name or email, no advertising identifier, and no precise location. Photos are never sent to analytics; the photo scanner sends them to OpenAI instead, and only for as long as it takes to answer. See Camera and photos above.
We do not track you across other apps or websites, and Optimally does not integrate any advertising SDK.
Subscriptions
Optimally is sold as a subscription through Apple’s App Store. Apple processes your payment and manages your subscription — we never see your card or payment details. We use RevenueCat to tell the app whether your subscription is active; RevenueCat identifies your purchase with an anonymous ID, not with your name or email. Apple’s handling of your data is governed by Apple’s privacy policy, and RevenueCat’s by RevenueCat’s.
What we don’t do
- We don’t sell or rent your personal data to anyone, for any price.
- We don’t show third-party ads or use advertising trackers.
- We don’t require an account, name or email to use the app.
- We don’t take money from food brands, and no brand can pay to change a score.
Your rights
Because Optimally has no accounts, we hold no file on you that could be looked up, exported or corrected — there is no name or email to search by. Everything personal to you lives on your device, and Settings → Reset everything erases it immediately and permanently.
If you are in the EU, UK, or a U.S. state with a privacy law, and you want the anonymous analytics events from your device deleted, email nathanielfiska@gmail.com and we will do it. We may need you to tell us roughly when you used the app, since there is no identifier tying those events to you.
Data retention
On-device data stays until you delete it. Anonymous analytics events are retained for up to 12 months and then deleted.
Children
Optimally is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, email us and we will remove it.
Changes
If this policy changes, we’ll update this page and the effective date at the top. Material changes will also be flagged in the app.
Contact
Questions about privacy, or a request under a privacy law? Email nathanielfiska@gmail.com. We aim to reply within a few days.