REDIE PRIVACY POLICY

Effective date: 12 October 2026

Redie is operated by Semih Altın ("Redie", "we", "us", or "our"). This Privacy Policy explains how information is handled when you use the Redie mobile application and related services. For privacy requests, contact semihaltin99@gmail.com or +90 553 762 30 98.

1. What Redie does

Redie lets you choose a product category, submit a photo of a product label, and receive an AI-generated explanation of ingredients visible in the photo and, when possible, an approximate label-based score. The app also provides scan history, articles, frequently asked questions, support, notifications, and optional Premium features.

Redie has no name-and-password registration. When the app starts using the service, our server creates an installation-based profile with a randomly generated identifier. This identifier is pseudonymous, not necessarily anonymous: scans, a support email, or a purchase may be associated with it.

2. Information we collect and where it comes from

• App and session information: installation identifier, profile creation date, selected language, and session credentials. Our server stores hashes of authentication tokens rather than the token values themselves.
• Scan information: the product category and photo you choose to submit; the resulting product name, summary, ingredient names and descriptions, approximate score if one can be supported, status or error information, and timestamps. A photo may also contain incidental information outside the label, so please avoid including people or private material.
• Notifications: the device push token and related Firebase installation information, plus messages placed in your in-app notification inbox. Firebase may generate an installation identifier when its messaging service is initialized, even if you do not allow notifications to be displayed by your operating system.
• Premium purchases: your Redie app user identifier, subscription entitlement and status, and purchase-related information made available through the relevant app store and RevenueCat. We do not receive your full payment card number.
• Support requests: the message and any email address you choose to provide. A request may be linked to your app profile when submitted while your session is active.
• Technical information: information needed to operate and secure the service, such as IP address, request time, device or app characteristics made available to the service, and error or security records.

We receive this information from you, from the app and your device, and from Apple, Google, Firebase, or RevenueCat when you use their related features. We do not request your name or precise location for a scan, and we do not use the camera continuously.

3. Purposes and legal grounds

We process app identifiers, sessions, submitted photos, and scan records to deliver the scans and history you request, apply the free daily scan allowance, and provide content in your selected language. We process purchase information to verify Premium access; support messages to respond to you; notification data to operate push delivery and the in-app inbox; and technical records to maintain security, prevent abuse, troubleshoot faults, and comply with legal obligations.

Where a legal basis is required, processing needed to provide requested features or purchases is based on performance of our agreement with you or steps you request before entering it. Security, troubleshooting, abuse prevention, and responding to support requests may rely on our legitimate interests where permitted by law. We rely on a legal obligation where processing is required by law, and on consent where applicable law requires it. You can control whether the operating system displays push notifications in device settings; that setting does not necessarily stop Firebase from creating a technical installation identifier.

We do not sell personal information or use submitted label photos for targeted advertising. Redie's approximate scores do not make decisions that have legal or similarly significant effects on you.

4. Photo analysis and AI provider

When you submit a photo, our server sends the image, selected category, and instructions to OpenAI's API to generate an analysis. We do not save the original uploaded photo in Redie's scan-history database. The server requests that OpenAI not store the response as a reusable response object. This is not a promise of zero retention by OpenAI: OpenAI may retain content or related safety records under its API data controls. The generated result and scan status are stored by Redie as described below.

AI may misread a label or miss an ingredient, especially if the image is blurry, incomplete, or translated. A completely unreadable label does not consume the daily free scan allowance. Redie is an informational aid and its score is not a safety or medical finding.

5. Who receives information

We share information only to operate Redie, handle purchases and support, protect the service, or meet legal requirements:

• OpenAI receives submitted label photos and scan instructions to produce analyses.
• Google Firebase Cloud Messaging processes installation and push delivery information so notifications can be delivered.
• RevenueCat receives an app user identifier and purchase or entitlement information so Premium status can be managed.
• Apple App Store and Google Play process purchases and payment information under their own terms and privacy notices.
• Backend hosting and infrastructure providers process data needed to run our server, database, and related technical services.

We may disclose information to authorities when required by law or where necessary to protect rights, users, or the service. We do not give support emails or scan records to advertisers. Some providers operate internationally, so information may be processed outside your country. Applicable cross-border transfer rules and the providers' own privacy terms govern that processing. Contact us for information about a particular transfer.

6. How long information is kept

Your app profile, scan records (including unsuccessful attempts), daily usage records, notification inbox entries, stored push token, and support requests linked to the profile remain in Redie's active database until you delete that profile, unless a longer period is required by law. On profile deletion, Redie removes those associated records from its active database and invalidates the related sessions. Raw uploaded photos are not retained as part of scan history.

Support requests submitted without a linked profile are kept for as long as reasonably needed to handle the request, address follow-up or disputes, and meet applicable legal duties; they are then deleted or de-identified. Technical logs are kept only while needed for service operation, security, incident investigation, or legal duties, according to the retention configuration of the production infrastructure. If backup copies exist, deleted records may remain in those copies until normal backup rotation or a legal preservation duty ends; backups are not used to restore deleted profiles for ordinary use. OpenAI, Firebase, RevenueCat, and the app stores apply their own retention rules to data they process.

Uninstalling Redie does not itself delete server records. You can delete your app profile in the app's settings. If you keep using the app after deletion, a new installation-based profile may be created. Deleting a Redie profile does not cancel a store subscription; cancel it through Apple or Google separately.

7. Your choices and rights

You can change your language, delete your Redie profile in the app, and control notification display through your device settings. You may also email semihaltin99@gmail.com to request access to, information about, correction of, or deletion of your personal data; to ask about recipients and purposes; or to exercise any other right available under applicable law, including restriction, objection, portability, withdrawal of consent, or a complaint to a competent privacy authority. Where applicable, you may object to a result produced solely by automated processing and ask that a correction or deletion be communicated to recipients.

We may need to verify that a request relates to your installation-based profile before acting. Because there is no conventional login, losing the device or local session credentials may make a prior profile harder to identify. Withdrawing consent does not affect processing already carried out lawfully or processing supported by another legal ground.

8. Security

We use measures intended to protect information, including authenticated access to profile-specific records and limited access to service credentials. No system is completely secure. Avoid putting unrelated personal or sensitive information into product photos or support messages.

9. Children

Redie is intended for people aged 18 or older. We do not knowingly seek information from children. If you believe a child has provided information through Redie, contact us so we can review and address it.

10. Changes and contact

We may update this policy to reflect changes to Redie or legal requirements. The current version will show its effective date, and we will provide additional notice where required by law.

Data controller and contact: Semih Altın Email: semihaltin99@gmail.com Phone: +90 553 762 30 98