Can I Eat? – AI Food Check

Privacy Policy

Can I Eat? – AI Food Check

Can I Eat? Privacy Policy

MintSoft (“we”, “us”) provides the mobile app “Can I Eat?” (“the App”). This policy explains what information the App handles, where it goes, and the choices you have. The App has no sign-up or account, and your health profile and records are kept on your own device.

Effective date: September 23, 2026

1. Summary

  • Your health profile, history, photos and meal log stay on your device.
  • A food photo is sent (through our relay, which does not store it) to Google Gemini only when you ask for an analysis.
  • For “Eat with care” or “Better to skip” results, only the food, its recognized ingredients, estimated nutrients, and your condition names and severity are sent to Anthropic’s Claude to write an explanation — never your name, age, sex, medication or allergies.
  • We do not sell your data or use your health information for advertising.

2. Information stored only on your device

  • Health profile: registered conditions, severity, whether you take medication, allergies, and optionally name, birth year and sex — stored in encrypted secure storage (iOS Keychain / Android encrypted storage).
  • App data: scan history, photos you took, your “I ate this” meal log, streaks and settings — stored in a local database and app storage.

We do not operate an account system and cannot see this information.

3. Information sent when you use a feature

  • Photo analysis: the photo (JPEG; gallery images are downscaled and re-encoded) and the app language are sent over HTTPS to our relay server (Cloudflare Workers), which forwards them to the Google Gemini API to identify the food and estimate nutrients. Our relay does not store photos.
  • Explanations: if a verdict is “Eat with care” or “Better to skip”, the food name, recognized ingredients, estimated nutrients, the names and severity of your registered conditions, and the verdicts are sent through the relay to Anthropic’s Claude API to generate an explanation. Your name, age, sex, medication status and allergies are not sent.
  • Barcode scan: only the barcode number is sent to Open Food Facts (openfoodfacts.org), a public food database. No health information is sent.
  • Shopping recommendations: your locale and the name/category of the food you checked are sent to our relay, which fetches Coupang Partners (Korean) or AliExpress (other languages) affiliate products. Health information such as conditions or allergies is never used or sent for this. Tapping a product opens the store; if you buy something, we may earn a commission. The store’s own privacy policy applies there.
  • Advertising: Google AdMob receives your advertising identifier, device information and ad-related usage data. The App requests non-personalized ads only and never uses health information for advertising.
  • Reporting an AI result: only if you choose to report a result, the reason, result ID, food name, analysis time, AI source name, the result text shown on screen (verdicts, reasons, tips and explanation — which may name the conditions it was checked against), app version, language and platform are sent to our relay so we can review it. Your allergies, medication status and photos are not included.
  • Purchases: Apple or Google processes payments. RevenueCat receives an anonymous app user ID, the product ID and transaction status to manage your Pro access. We never receive your payment card details.
  • Crash reports: in release builds, Firebase Crashlytics receives crash stack traces, device model, OS version, app version and an anonymous installation ID.
  • Update check: the App asks the App Store or Google Play for the latest version number.

Daily reminders are local notifications scheduled on your device; nothing is sent to a server for them.

4. Health information

Health information is sensitive. We use the health details you enter only to produce the result you ask for. Entering it is optional, but personalized verdicts need it. Only condition names and severity ever leave your device — to generate an explanation for a cautionary verdict, or inside a result you choose to report. Google and Anthropic process requests under their API terms (both state that API data is not used to train their models by default and may be retained for a limited period for abuse monitoring). We do not sell data or use health information for advertising. Before your first photo analysis or barcode lookup, the App shows exactly what is sent, to whom and that it is transferred to the United States, and asks for your separate consent; if you decline, nothing is sent. You can withdraw consent at any time in Settings → “Withdraw AI analysis consent”.

5. Service providers and international transfers

All transfers happen over HTTPS at the time you use the relevant feature. Some providers are located outside your country:

  • Cloudflare, Inc. (USA) — request relay; stores nothing
  • Google LLC (USA) — Gemini API, AdMob, Firebase Crashlytics, Google Play
  • Anthropic, PBC (USA) — Claude API explanations
  • RevenueCat, Inc. (USA) — purchase status management
  • Apple Inc. (USA) — App Store payments and updates
  • Open Food Facts (France) — barcode lookups
  • Coupang Corp. (Korea) and Alibaba Group / AliExpress (Singapore, China) — affiliate product recommendations

6. Advertising choices

In the EEA and UK we ask for consent through Google’s User Messaging Platform (UMP). The App requests non-personalized ads only and does not track you, so it does not show the iOS App Tracking Transparency prompt. You can change your choice at any time in Settings → “Ad privacy options”, reset or limit your advertising ID in your device settings, or remove ads entirely with Can I Eat Pro.

7. Retention and deletion

  • On-device data stays until you delete it: Settings → delete all records, or uninstall the App to remove everything.
  • Our relay does not retain photos or request contents.
  • AI result reports are kept on our relay (Cloudflare) for 180 days for review and then deleted automatically.
  • Service providers retain data according to their own policies (for example, Crashlytics keeps crash data for up to 90 days).

8. Your rights

You can view and edit your profile in the App, delete all records, and export or import your data as a JSON file (you start export/import yourself and are responsible for the file you create). Depending on where you live (for example under the GDPR or Korea’s Personal Information Protection Act), you may have rights to access, correct, delete, restrict or object to processing, and to withdraw consent. Contact us at app@mint-soft.com; you may also complain to your local data protection authority.

9. Security

We encrypt the health profile on your device, use HTTPS for all network traffic, keep AI API keys on our relay rather than in the App, and minimize what is sent to each provider.

10. Children

The App is not directed to children and is not intended for anyone under 13 (under 14 in Korea). If you believe a child has provided information, contact us and we will help delete it.

11. Not medical advice

The App is not a medical device. Results are for information only; consult a doctor or dietitian about your diet.

12. Changes and contact

We may update this policy and will announce changes in the App or at https://app.mint-soft.com/apps/caneat/privacy before they take effect. Controller and contact: MintSoft, app@mint-soft.com.