Effective date: November 6, 2026
HormoneGuard is a mobile app for iPhone and Android that reads the ingredients of cosmetics, personal-care and food products and explains them in the light of the hormonal-health topics you choose. It is published by Inumimo Idowu ("we", "us"). You can reach us at info@hormoneguard.com.
This policy explains what the app keeps on your device, what leaves it, who receives it, and how to remove it.
The short version
- There is nothing to sign up for. On first launch the app creates an anonymous account for you automatically. We never ask for your name, email address, phone number or date of birth, and the app has no sign-in.
- Your history stays on your phone. Scan history, saved products, search history and the health topics you choose are stored on your device only.
- Your health topics are never sent anywhere. Not to us, not to our AI provider, not to our analytics provider — and neither is anything worked out from them, such as a verdict. Every result is worked out on your phone.
- Product details, not personal details, go to our AI provider. When the app's own ingredient database does not recognise an ingredient, the product's name, brand, category and ingredient list are sent through our server to Google's Gemini model to be classified. If you photograph an ingredients panel, the photo goes the same way to be read — only after you have allowed it, and without its location or other metadata. We do not keep the photo.
- Analytics are about the app, not about you. They record which features are used and whether they worked, never what you scanned or which health topics you chose. Where the law requires consent, they wait for it; you can switch them off at any time in Settings → Data & privacy.
- The free version shows ads from Google AdMob. They are never personalised, and the app never asks to track you. Subscribers see none.
- "Delete account and data" in Settings removes your anonymous account, the records we hold under it, and everything the app stored on your device.
1. What stays on your device
| Data | Where it lives |
|---|---|
| Scan history | This device only, in the app's local database |
| Saved products | This device only |
| Search history | This device only |
| Health topics you select | This device only |
| Text read from a label photo | This device; for a product no database knows, also our server, without anything about you (section 2.3) |
| Product records the app has looked up | This device, plus the shared product cache described in section 2.3 |
| App settings (for example, whether analytics is on) | This device only |
We never upload any of this, and we cannot read it.
Backups. None of this is backed up off your device. On Android, the app is excluded from Google's device backup and from device-to-device transfer. On iPhone, the app's database — which holds your history, saved products, search history, health topics and settings — is excluded from iCloud and computer backups. So on both, uninstalling the app removes this data for good.
Photos. A label photo you take is used to read the ingredients and is not added to your history or your photo library. The app keeps it in its own temporary storage only while the label reader is open, and deletes it when the reader closes — which it does once the label has been read.
Removing it. "Reset local data" in Settings clears everything above and gives the app a fresh analytics identifier. "Delete account and data" does the same and also deletes your anonymous account (section 5). Uninstalling the app removes it from the device.
2. What leaves your device, and why
2.1 Your anonymous account
On first launch the app signs in to Firebase Authentication (Google) anonymously. This creates a random account identifier with no name, email or password attached. It is used to:
- authenticate the app's requests to our servers, so that only the app can use them;
- count requests per account, so that one person cannot exhaust the service for everyone (section 2.4);
- link a subscription to your copy of the app (section 2.7).
2.2 Looking up a product
When you scan or type a barcode the app has not seen before, it asks the public Open Beauty Facts and Open Food Facts databases for that barcode, directly from your device. Those requests carry the barcode, the app's name and version, and — like any internet request — your device's IP address. Product photos shown in the app are loaded from the same projects' image servers. Open Food Facts and Open Beauty Facts are independent, non-profit, open databases; their own privacy policies apply to those requests. Their data is published under the Open Database License (ODbL) and their images under Creative Commons Attribution-ShareAlike, and we credit them as their licences require.
2.3 The shared product cache
After a successful lookup, the app sends the barcode — and only the barcode — to our server, which fetches the public product record itself and stores it in a shared cache, so the next person to scan that product gets an answer without another lookup. The cached record contains public product facts only: name, brand, ingredients, image link and which database it came from. It contains nothing about you — no account identifier, no time of your scan, no location.
When no database knows a barcode, the app sends that barcode — and whether the product was missing or listed without ingredients — to our server, which adds one to a count of how many times it has been asked for, so our team knows which products to add. If you choose to tell us what the product is, we receive the name and brand you type, with the barcode, for our team to check. If you photograph the ingredients panel of such a product (section 2.5), our server also keeps the text read from it — the product name, brand, size and ingredient list — with the barcode, as a draft our team reviews before adding the product. The photo itself is not kept. None of these records contains anything about you: no account identifier, no device, no time of your own request.
When the app shows you a product, it also reads any warning (for example a recall) or review our team has published for that barcode. That read carries the barcode only.
2.4 Ingredient analysis (Google Gemini)
The app scores every product against its own built-in ingredient database. When a product lists ingredients that database does not recognise, the app asks our server to classify them. Our server (Google Cloud Functions, part of Firebase) receives:
- the barcode, product name, brand and category;
- which database the record came from, and whether it was confirmed there;
- the product's ingredient list, and which of those ingredients need classifying.
The server checks the request, then sends the product name, brand, category, source and ingredient list to the Google Gemini API and returns the classification to the app. The barcode is not sent to Gemini. Your health topics, your history, and the score your device calculated are not sent at all — our server rejects a request that includes them.
Results produced this way are labelled model-assisted wherever they appear in the app.
2.5 Reading an ingredients panel from a photo
If a product is not in any database, you can photograph its ingredients panel. The first time, the app explains where the photo goes and asks your permission; nothing is sent until you allow it, and you can still type the barcode instead. The app reduces the photo's size and re-encodes it without its metadata — the EXIF block where a camera records details such as the time, the device and, if location tagging is on, where the photo was taken — then sends it, with the barcode it belongs to, to our server, which passes the image to the Google Gemini API to read the text. The text comes back to your device and is saved there. Our server does not store the photo, write it to any database, or record it in its logs. When no database knows the barcode, our server keeps the text it read, with the barcode and nothing about you, for our team to review (section 2.3). Please photograph only the ingredients panel.
When a product read from a photo has no picture of its own, our server looks for one with the barcode, product name and brand that were read — first in Open Food Facts, Open Beauty Facts and Open Products Facts, then with Brave Search: its web search, with the barcode, to find the product's brand and name when the photo did not show them, and its image search. Nothing about you is sent to either. A picture found this way is shown on your result, credited to where it came from, and is not shared with other users; for a product no database knows, our team also sees it as a suggestion when adding the product.
Google processes what our server sends to Gemini on our behalf, under Google's terms for the paid Gemini API (https://ai.google.dev/gemini-api/terms), which also describe how long Google may keep API data to detect abuse.
2.6 Usage limits
To keep the service available and its costs bounded, our server counts how many analyses, label reads and cache updates each anonymous account makes per minute and per day. These counters hold the account identifier, the counts and the times of the current windows — nothing about what was looked up. They expire automatically about two days after the start of the day they count (the database removes expired records shortly after that), and are deleted when you delete your account.
2.7 Subscriptions (Apple, Google and RevenueCat)
Purchases are made through the App Store or Google Play. We never see your payment details. RevenueCat receives the purchase records the store provides — product, dates, renewal status, store transaction identifiers — together with your anonymous account identifier, and tells the app whether your subscription is active. So that the app can ask, RevenueCat keeps a customer record under the anonymous identifier for every copy of the app, including ones that never buy anything.
2.8 Advertising (Google AdMob)
The free version shows ads from Google AdMob, including an optional ad you can watch for an extra scan. Subscribers see no ads at all. Every ad the app requests is non-personalised: in Google's terms, it is not based on your past behaviour, but chosen from context such as the app you are using and your approximate location. The app does not track you, and never asks for permission to. To serve and measure ads, and to prevent ad fraud, the Google Mobile Ads SDK collects information such as an identifier for your device, an approximate location derived from your IP address, device and app information, and how you interact with ads. Ad content is restricted to the "G" (general audiences) rating.
- On iPhone, the app never shows iOS's tracking prompt, so iOS does not give AdMob your device's advertising identifier.
- On Android, the Google Mobile Ads SDK can read your device's advertising ID; you can reset or delete it in your device's Google settings.
- In the EEA, the UK and Switzerland — the app checks the region your device is set to — no ad is requested until you have been shown Google's consent message where it applies, and ads are then served only as your answer allows. The message also asks whether analytics may run (section 2.9). Whatever you answer, the app asks only for non-personalised ads. Where the message applies, Settings → Data & privacy → Privacy options lets you change your choices at any time; to stop analytics, use the Share usage analytics switch on the same screen, which takes effect at once.
- Everywhere else, nothing is asked: the free version shows its non-personalised ads from the start.
Google uses this information under its own privacy policy: https://policies.google.com/technologies/ads
2.9 Usage analytics (Mixpanel)
When analytics is allowed, the app sends Mixpanel a record of what happened in the app — for example, that onboarding was finished, that a lookup found a product and how long it took, that a purchase failed — together with:
- a random identifier the app generates on your device, which "Reset local data" replaces;
- device and app details Mixpanel's SDK adds, such as device model, operating system and app version.
The app tells Mixpanel not to work out your location from your IP address.
When it is allowed. Where the law requires consent (the EEA, the UK and Switzerland — the app asks Google's consent service only when your device is set to one of them), analytics run only if you agree, in Google's consent message, to information being stored on your device and to content performance being measured; until that message has been answered, nothing is sent. Elsewhere, analytics are on unless you turn them off. Either way, turn off Share usage analytics in Settings → Data & privacy and nothing further is sent; your choice is remembered, including through "Reset local data".
Analytics never include a barcode, product name, ingredient text, photo, or your health topics — at most, how many topics you chose — and never a result worked out from your topics, such as a verdict or a score.
2.10 Crash reports (Firebase Crashlytics)
When the app crashes or hits an unexpected error, Firebase Crashlytics (Google) receives a report: the error, the technical stack trace, the device model, operating system and app version, a few app-state flags (such as whether onboarding is finished), and the same random identifier analytics uses. Reports never contain barcodes, product names, ingredient text or your health topics; the app removes long digit runs (which could be barcodes) and database contents from error messages before they are sent. Crashlytics keeps crash reports for 90 days.
2.11 App integrity checks
To stop copies of the app that are not genuine from using our servers, the app uses Firebase App Check, which asks Apple (App Attest / DeviceCheck) or Google (Play Integrity) to confirm that a request comes from an unmodified copy of HormoneGuard on a real device.
2.12 Server logs
Our servers keep operational logs — errors, timings, token counts from the AI provider, and which product record was added to the shared cache. Our code does not write your anonymous account identifier to them, and they never contain a photo, an ingredient list or your health topics. Google Cloud also keeps its own technical request logs, such as the time, outcome and network address of each call. Google Cloud Logging keeps all of them for 30 days.
2.13 Contacting us
If you email us, we receive your email address and whatever you write, and use them only to answer you.
2.14 This website
This website uses no cookies, no analytics and no advertising, and it asks you for nothing. Google Firebase Hosting serves it and, like any web host, processes the technical details of each request, such as your IP address and browser type, to deliver the page and keep the service secure. Links to other sites take you to their own privacy practices.
3. Who receives data
We do not sell your personal information, and we do not share it with data brokers. The services that receive data are:
| Service | Provider | What it receives | Role |
|---|---|---|---|
| Firebase Authentication, Cloud Firestore, Cloud Functions, App Check, Crashlytics, Cloud Logging | Google LLC | Anonymous account ID, usage counters, product requests, crash reports, logs | Service provider (processor) |
| Gemini API | Google LLC | Product name, brand, category, ingredient list; label photos (without their metadata) | Service provider (processor) |
| AdMob | Google LLC | A device identifier (on Android, the advertising ID; on iPhone, never the advertising identifier), approximate location, device and ad-interaction data — for non-personalised ads only | Advertising partner, under Google's own terms |
| Mixpanel | Mixpanel, Inc. | Usage events, random app identifier, device details | Service provider (processor) |
| RevenueCat | RevenueCat, Inc. | Anonymous account ID; purchase records, if you subscribe | Service provider (processor) |
| App Store / Google Play | Apple Inc. / Google LLC | Your purchase, under your store account | Independent (their terms apply) |
| Open Food Facts / Open Beauty Facts | Open Food Facts (non-profit) | Barcodes looked up, IP address | Independent public database |
| Brave Search API | Brave Software, Inc. | The barcode, name and brand of a product read from a label photo, sent by our server to find its picture; nothing about you | Service provider (processor) |
We may also disclose information if the law requires it, or to protect the safety of users or the service.
4. How long we keep it
| Data | Kept |
|---|---|
| Data on your device | Until you reset, delete or uninstall |
| Anonymous account | Until you delete it in the app |
| Usage counters | About two days from the start of the day they count; deleted with your account |
| Label photos | Not stored by us |
| Text read from a label photo of a product no database knows | With the barcode, until our team adds the product or discards the draft; contains nothing about you |
| Product details sent for analysis | Not stored by us |
| Shared product cache | Kept as public product data; contains nothing about you |
| Crash reports | 90 days |
| Analytics events | About 2 years |
| Purchase records (RevenueCat) | While the subscription exists, then as long as needed for our accounting and legal obligations |
| Server logs | 30 days |
| Support emails | Until your request is resolved, then only as long as needed for our records |
5. Deleting your data
In the app: Settings → Delete account and data. This deletes your anonymous account, the usage counters held under it, and all data the app stored on your device. It cannot be undone. It does not cancel a subscription — the App Store or Google Play bills that, and you cancel it there — but it does unlink the subscription from the app; "Restore purchase" with the same store account links it again.
Our sign-in provider only lets the app delete an account shortly after it signed in. If it refuses, the app tells you that nothing was deleted and offers to clear everything on your device and sign out of the account instead. The account then holds no personal data and is never used again, and its usage counters expire within a few days (section 2.6).
What deletion cannot reach, and why:
- Purchase records at Apple or Google, which they keep under your store account, and at RevenueCat, which stay under the deleted anonymous identifier. Email us with the order number from your store receipt and we will delete the RevenueCat record.
- Analytics events and crash reports already sent, which are tied only to a random identifier that deletion discards. Nothing links that identifier to you any more, so we cannot single those records out; they expire as described in section 4.
Full instructions, including what to do if the app is no longer installed, are at /delete-account.
6. Your rights
Depending on where you live — including under the EU and UK GDPR and California law — you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, to withdraw consent, and to complain to your data-protection authority.
Most of your data never reaches us, so you exercise those rights directly in the app: everything stored on your device is under your control, "Delete account and data" removes what we hold under your anonymous account, and the analytics switch stops analytics. Because we never learn who you are, we usually cannot find records about you from an email alone; if you contact us, we will tell you what we can and cannot locate.
Legal bases (EU/UK). We process data to provide the app you asked for (the anonymous account, product lookups, analysis, label reading and subscriptions — a label photo is only sent once you have allowed it); for our legitimate interests in keeping the service secure, reliable and affordable (usage limits, integrity checks, logs, crash reports); and, with your consent, for analytics and for showing ads, which are never personalised (sections 2.8 and 2.9). You can withdraw consent at any time in Settings → Data & privacy: the Share usage analytics switch stops analytics at once, and Privacy options changes your advertising choices.
California. We do not sell personal information. The app never asks for personalised ads — every ad request is non-personalised, so ads are not chosen from your activity across other companies' apps and websites — and it never asks to track you on iPhone. On Android you can also delete your advertising ID in your device's Google settings, and subscribing removes ads altogether. Your health topics are never collected.
Canada. Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and similar provincial laws, you may ask to access or correct your personal information and withdraw consent, and you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. Contact us first if you can, at info@hormoneguard.com, so we can try to put it right.
Consumer health data (United States). Some states, including Washington and Nevada, have laws about consumer health data. The app is built so that the health topics you choose stay on your phone and are never collected. What we do receive is described in section 2, and you can delete it as described in section 5. If you are in one of those states and have a question or request, contact us at info@hormoneguard.com.
International transfers. Our providers may process data in the United States and other countries. Our Firebase project runs in the United States (Firestore multi-region nam5; Cloud Functions in us-central1). Where the law requires it, transfers rely on the European Commission's Standard Contractual Clauses or the EU–U.S. Data Privacy Framework, as offered by each provider.
7. Children
HormoneGuard is not directed to children under 13 (or the higher age your country sets for digital consent), and we do not knowingly collect their data. The "Children's products" topic is meant for parents and carers choosing products for a child.
8. Security
All traffic between the app and our servers is encrypted in transit. Our server rejects requests that are not authenticated, checks every field it receives against a fixed format, and holds the AI provider's key itself — it is never in the app. No method of transmission or storage is perfectly secure, but keeping your history on your device means there is very little about you on our side to protect.
9. Not medical advice
HormoneGuard is an educational product-information tool. It does not diagnose conditions, predict outcomes, or replace medical advice. See the Terms of Use.
10. Changes
If we change this policy, we will update the effective date above, and for a significant change we will tell you in the app before it takes effect.
11. Contact
Inumimo Idowu · info@hormoneguard.com