Using a gluten app says something about your health. That is why this page is written the way it is: everything below describes what the code does, and most of it can be checked from the outside.
A barcode is decoded on your phone and never leaves it as an image. A photographed label is read once and thrown away. No scan and no verdict ever enters an analytics event, and nothing here is sold or shared.
We use Google Analytics to count page views, and that is all it is allowed to see. It never receives a scan, a verdict, a barcode, an ingredient you looked up in the scanner, or a carbohydrate ratio. Your signed-in account area is excluded from measurement entirely, so nothing about your ratios or your history is measured at all. Search terms and barcodes typed into a lookup box are stripped before a page view is sent. Ad personalisation and Google Signals are switched off. Those are the settings that turn a page view into an advertising audience. Under the FTC Health Breach Notification Rule an analytics call carrying a health signal is a reportable breach with no attacker involved, at $53,088 per violation, so this is a boundary in the code rather than an intention: see components/Analytics.tsx.
Knowing that a lot of people read the page on barley malt tells us which page to improve next. It is the same measurement any publisher runs, with the parts that would make it personal removed. We do not build a profile, we do not attach measurement to your account, and we do not use any of it for advertising, because there is no advertising.
Not to advertisers, not to data brokers, not to food manufacturers, not to insurers. There is no revenue line here that depends on it. The subscription is the business model.
A food company paying for placement inside a safety tool is a conflict of interest we will not have, at any funding stage.
A photo of an ingredient panel is transcribed and then gone. It is never stored, never used to train anything, and never attached to your account. We use the paid tier of the Gemini API specifically because Google does not use paid-tier inputs to improve their products and no human reviews them.
Write to privacy@askcici.com and we will send you everything CiCi holds about you, or delete your account and everything in it. Anything you have saved or logged can also be deleted by you, one entry at a time, from the page it appears on. Deletion is real deletion, not a flag.
| What | Why | Where | How long |
|---|---|---|---|
| Your email address | Sign-in. You can use a password or have CiCi email you a link. CiCi never sees or stores the password itself — it goes to the managed authentication service, which stores it hashed. It is never written to our database and never logged. | Neon Auth (managed Better Auth), hosted in the US | Until you delete your account |
| Barcode lookups | The barcode is decoded on your device and never leaves it as an image. The number is sent to look the product up. | The lookup carries no user id at all, signed in or not. It answers questions about barcodes and never learns who asked. | Not retained |
| Your scan history | If you are signed in, CiCi keeps a list of what you scanned so you do not have to type it into your log later, and so it is there to look back on. Scanning signed out records nothing at all. A scan is never counted as something you ate unless you say so. | Your row in our database, written by a separate endpoint from the lookup | Until you delete the entry or close your account |
| Your glutening log | What you have told CiCi you ate and when you were ill, so the log can show you what those days had in common. It counts overlaps and never names a cause. This is the most sensitive thing on the site and the whole signed-in area is excluded from measurement. | Your row in our database. Never in an analytics event, never sold, never used to infer anything about you. | Until you delete the entry or close your account |
| Photographs of ingredient panels | Read once by Google Gemini to transcribe the text, then discarded. The text goes into the rules engine; the image goes nowhere. | Held in memory for one request. Never written to disk or database. | Not retained |
| Which pages get read | To know which of the thousand-odd reference pages to improve next. Page path only: never a scan, a verdict, a barcode, a ratio, or anything you typed into a search or lookup box. | Google Analytics. Ad personalisation and Google Signals are off, and your signed-in account area is excluded from measurement entirely. | 14 months, then deleted by Google automatically |
| Saved products and lists | So your regular shop is one tap. | Your row in our database, protected by row-level security | Until you delete them or close your account |
| Community posts, reviews and restaurant reports | They are the product. Other people rely on them. | Public, under the display name you choose | Until you delete them |
| Subscription and payment records | Billing, refunds, tax. We never see or store your card. | Stripe. We keep only a customer reference and the plan state. | As long as tax law requires |
When you photograph an ingredient panel, the image goes to Google's Gemini API, which transcribes the printed text and sends it back. The text is then assessed by the same rules engine a barcode scan uses. The image itself is held for the length of that one request and is never written to disk, never written to our database, and never attached to your account.
We use the paidtier of that API. Google's terms say that for unpaid use, submitted content is used to improve their products and human reviewers may read it. Their own documentation tells you not to send sensitive information through it. On the paid tier, prompts are not used to improve their products and are logged only to detect abuse. Paying for that is not optional here.
Wherever you are, you can have everything CiCi holds about you sent to you, and you can have your account and its contents deleted. Write to privacy@askcici.com and we answer within two business days. Anything you have saved, scanned or logged can also be deleted by you, one entry at a time, from the page it appears on. Deletion removes the data rather than hiding it.
If you are in the EU or the UK, GDPR gives you rights of access, correction, erasure, restriction, portability and objection, and a right to complain to your supervisory authority. If you are in California, the CCPA and CPRA give you rights of access, deletion and correction, and a right to limit the use of sensitive personal information. We do not use it for anything beyond running the product, so there is nothing to limit. To exercise any of these, write to privacy@askcici.com and we will respond within two business days.
Coeliac disease is frequently diagnosed in childhood, so children plainly use tools like this. CiCi accounts are for people aged 13 and over; a younger child should use a parent's account rather than their own. We do not knowingly collect data from a child under 13, and if we learn we have, we delete it.
CiCi is built on open data, and several of these licences require us to say so. All of it is about food and places rather than about people.
| Source | Licence | What it is |
|---|---|---|
| USDA FoodData Central | CC0 / public domain | Branded food label data. No attribution required; given anyway. |
| Open Food Facts | Open Database License (ODbL) 1.0 | Product data, and the only source anywhere with cross-contact "may contain" information. ODbL is a share-alike licence, so records derived from it stay identifiable in our database and separable from the rest. |
| OpenStreetMap contributors | Open Database License (ODbL) 1.0 | Every restaurant, bakery and cafe on the map, via the diet:gluten_free tag. Contributor-recorded and not verified by CiCi, which every venue page states. |
| OpenFreeMap / OpenMapTiles | ODbL data, open-source tiles | The basemap itself. |
Everything is served over HTTPS. Sign-in is by magic link, so there is no password to steal from us. Your saved data is protected by row-level security in the database, and access to it is enforced in the server actions that read it rather than trusted to the client. If you find a vulnerability, write to security@askcici.com. We will not threaten you.
If we change something material we will say so here and email anyone with an account. We will not quietly widen what we collect.
Last updated 2026-07-28.