LabelFlip

LabelFlip

Privacy policy

Last updated 2026-08-22 · applies to LabelFlip for iPhone and to this website

The short version. There is no account. Your cards, your flip count, your watch list and your queue live on your iPhone and nowhere else. The camera reads barcodes on the phone; frames are never uploaded. There is no analytics SDK, no advertising identifier and no third-party tracker in this app. The only things that ever reach us are a notification token if you turn Recall Watch on, photos you choose to submit, and a flag if you report something — and every one of those has a delete.

1. Who we are

LabelFlip is made by PLAYRIOT LLC. This policy covers the LabelFlip iPhone app and labelflip.aiappnation.com. Questions, or a deletion request: [email protected].

2. No account, ever

LabelFlip has no sign-in. No email address, no password, no phone number, no social login. You are not a row in a users table because there is no users table. We do not know your name and we have no way to look you up.

3. What stays on your phone

  • Every card you flip, and your History. Stored as files in the app's own container on the device.
  • Your flip count for the month, which is what the free quota is measured against.
  • Your watch list — the products the recall check is matched against. It never leaves the phone. See section 6.
  • The submission queue for photos that have not been sent yet.
  • Camera frames. The barcode is read on-device with Apple's Vision framework. When you photograph an ingredients panel for a product we do not have, the text is read on-device too. No frame and no live camera feed is ever uploaded.

There is no cloud copy of any of it. LabelFlip has no CloudKit container and no iCloud sync. Deleting the app deletes all of it, permanently, and we cannot get it back for you because we never had it.

4. What leaves your phone — the whole list

This is every outbound request the app can make. Nothing else goes anywhere.

WhatWhere it goesWhy
The barcode you scanned Open Food Facts (world.openfoodfacts.org) To look up the product. Open Food Facts is an independent open-data project with its own privacy policy and terms.
The barcode, if Open Food Facts has nothing USDA FoodData Central (api.nal.usda.gov) Second lookup. A US government database.
The barcode, if both miss Our server (api.aiappnation.com) Third lookup, against products the community has submitted. This request carries no device id and no account, so it is not attached to you. Like any web server, ours keeps short-lived request logs that contain the URL.
The brand name on the card openFDA (api.fda.gov) The recall check. A US government API.
Nothing. A download only Our server, for the recall digest See section 6 — the list comes down; nothing about you goes up.
An Apple push token and whether the build is sandbox or production — only if you turn Recall Watch on Our server So we can send a contentless wake-up. Section 6.
Photos you submit, plus the barcode, the on-device text read, and a random app-generated device id — only when you tap submit Our server and our private storage bucket So a person can read the label and add the product. Section 7.
A report you file — the barcode or card, your reason, your note, the same device id Our server So we can review flagged content. Section 8.

Each of those third parties sees the request coming from your device's IP address, as any web request does. We have no arrangement with any of them to share anything about you, because we have nothing about you to share.

5. What we do not do

  • No analytics SDK. Not Firebase, not Amplitude, not Mixpanel, not anything. The app ships with no third-party packages at all.
  • No advertising identifier. LabelFlip never asks for tracking permission because it has nothing to track you with. It does not read the IDFA.
  • No ads anywhere in the app.
  • We do not sell your data, and we do not share it with data brokers, advertisers or brands. Brands never pay us.
  • No location, no contacts, no health data, no microphone.

6. Recall Watch, and why it is built backwards

The obvious way to build a recall alert is: the phone uploads what you scanned, the server matches it against recalls and pushes you. That would make us a company holding a record of what you buy, for an app whose whole promise is that it holds nothing. So it works the other way round:

  • Our server publishes a digest of recent US food recalls. It is identical for every phone, contains nothing about anybody, and is cached like any public file.
  • Your phone downloads it and matches it against your own History, on your own device.
  • None of our endpoints will accept a barcode, a product name or a history for this. There is no such field.
  • When new records land we send a contentless push — the payload is {"aps":{"content-available":1},"lf":"recalls"} and nothing more. It cannot name a product, because our server does not know what you scanned.

The only per-device thing we store for this is the Apple push token itself. Turn notifications off, or delete the app, and it stops being used; you can also remove it from the app.

7. Photos you submit

When LabelFlip cannot find a product, you can photograph the front of the pack and the ingredients panel and send them in. This only happens if you tap submit.

  • What is sent: the two JPEGs, the barcode, the text the phone read off the ingredients photo, and a random identifier the app generated for itself and keeps in the iPhone Keychain. That identifier is not your Apple ID, not your phone number and not Apple's advertising identifier — it exists so the app can ask about its own submissions and so the daily cap works.
  • Location and camera metadata is stripped before upload. The app re-encodes each image from pixels at 1600px or smaller, which drops every EXIF tag, including GPS.
  • Where they live: a private Cloudflare R2 storage bucket that is not publicly readable, plus a row in our Postgres database on our own server. Only we can open them.
  • They are never shown to other users. A person reads the label and publishes what the label says — the product name, brand and ingredient text — as a product row that later scans of that barcode can read. Your photo itself is never published.
  • Deleting them: Settings › Data & Privacy › Delete my submissions removes the images and the text read from our storage and database immediately. What remains is the barcode and the review status, with no photos and no text attached — we keep that much so a product we already published does not silently change provenance. If a submission is rejected, its images are deleted at that moment.

8. Reporting content

Because a published submission becomes a product card other people can see, there is a way to flag one. A report sends the barcode or card it is about, the reason you picked, any note you write, and the same app-generated device identifier. We read reports and can remove or correct the row. Do not put personal information in the note field.

9. Rate limiting, and the one thing we hash

To stop somebody dumping unlimited photos into our storage, submissions and reports are capped per device and per network. For the network cap we store a salted one-way hash of your IP address next to the row — not the address itself. It is used only to count how many requests came from the same bucket in a day, and it is deleted with the row.

10. Payments

LabelFlip Pro is sold by Apple through the App Store. Apple handles the entire transaction. We never see your card number, your billing address or your Apple ID. What we receive from Apple is an anonymous, aggregated sales report — how many subscriptions in which country — which does not identify anyone.

11. The Amazon link

When a card names a swap, the button opens an Amazon search that carries our Amazon Associates tag, and we earn a small commission if you buy. The button says so on its face before you tap it. Once you are on Amazon you are on Amazon's site under Amazon's privacy policy; we get commission reports from them, not your identity or your order.

12. How long we keep things

  • Submitted photos and text: until you delete them, or until a submission is rejected — whichever comes first. There is no other copy.
  • The barcode and review status of a submission: kept as a record of what we published.
  • Push tokens: until you remove them or Apple tells us the token is dead.
  • Reports: until reviewed, then kept as a record that the flag was handled.
  • Recall records: these are public FDA data, not yours. We hold roughly the last year and drop the rest.
  • Web server logs: short-lived operational logs, as any server keeps.

13. Your choices and your rights

  • Delete your submissions any time: Settings › Data & Privacy › Delete my submissions.
  • Turn Recall Watch notifications off in the app or in iOS Settings.
  • Delete the app. Everything on the device goes with it.
  • Email [email protected] and we will delete anything we hold. Because there is no account, please include the barcode you submitted so we can find the right row — it is the only handle we have.

If you are in the EEA, the UK or California: we do not sell or share personal information as those laws define it, we run no cross-context behavioural advertising, and the legal basis for the little we do process is your consent (a submission or a push token) and our legitimate interest in stopping abuse (the hashed rate-limit value).

14. Children

LabelFlip is not directed to children under 13 and we do not knowingly collect anything from them. If you believe a child has submitted a photo, email us and we will delete it.

15. Security

Traffic is HTTPS end to end. The storage bucket is private and its credentials are scoped to that bucket alone. Internal endpoints require a key. We are a small team and cannot promise a system is unbreakable, but the honest defence here is that there is very little to take.

16. Changes

If we change this policy we will update the date at the top and ship the new text with the next app version. The version on this page is always the current one. Material changes will be called out in the app.

Data sources named on this page: Open Food Facts (world.openfoodfacts.org), USDA FoodData Central (fdc.nal.usda.gov), openFDA food enforcement (open.fda.gov/apis/food/enforcement/).