Privacy Policy
Updated 2026-11-05.
Operated by Fireborne XIII Foundry LLC, 5900 Balcones Drive STE 100, Austin, TX 78731, United States. FoodKompass support: foodkompass-support@f13foundry.com.
Local and cloud records
Saved checks, journal, and preferences use browser storage. Optional automatic cloud sync sends saved checks and journal entries to your private Supabase account, after explicit opt-in. Photos stay in memory and are excluded from saved history and cloud sync. Anyone with access to your browser profile may see local records.
AI research
With your consent, your label photo and optional details are sent through our Vercel backend to OpenAI. Research uses web search. We request store:false; provider security and abuse-monitoring retention can still apply. Avoid faces, medical records, addresses, and other sensitive information in uploads.
Accounts, payments and security
Supabase handles identity and database storage. Resend delivers account emails. Google processes identity if you choose Google sign-in. Stripe processes subscriptions and payment information; we do not handle card numbers. Cloudflare Turnstile, when enabled, processes device/network signals to protect authentication. Browser sessions persist until sign-out, revocation, expiry or storage clearing.
Essential operational records
We record signed-in AI model calls, token counts, search counts, estimated costs, success and timing. We do not add product names, photos, questions or medical details to these records. Client error reporting records an event category without message, stack, URL or form contents. Authentication limits use keyed hashes of email/network identifiers. No advertising or optional analytics cookies are installed.
Retention and your choices
Cloud checks and journals are retained up to 365 days; AI usage, account security and daily counters up to 90 days; client error categories up to 30 days; short-term sign-in attempt records up to one day; billing event identifiers up to 365 days. Scheduled jobs enforce these periods. Backup copies follow their configured retention, and Stripe may retain legally required payment records.
Use You to export JSON/CSV, disable future sync, erase local data, revoke sessions, or request account deletion. Deletion has a seven-day cooling-off period; cancel explicitly in You before the deadline. A daily job then removes the account and associated private data. Subscription cancellation remains effective even if deletion is cancelled. Erase local browser data separately.
Rights and contact
Contact the company support address above for access, correction, deletion, restriction, objection or appeal requests available under applicable law. We verify identity and respond within applicable deadlines, generally one month for GDPR requests and 45 days under applicable US state law, with notice of permitted extensions. We do not sell personal information or share it for cross-context advertising. Providers process data in the United States; applicable provider agreements and transfer safeguards govern their processing.