Privacy Policy
This Privacy Policy explains what personal data the Watsin app (“Watsin”, “the app”) collects, how we use it, and the rights you have over it. It applies to Watsin for iPhone; we will update it before an Android version is released. Watsin is operated by Synion OÜ.
At a glance
| Topic | Summary |
|---|---|
| Who controls your data | Synion OÜ (Estonia) |
| Account identifier | Your email address (sign-in uses a one-time code; no password) |
| Tracking across other apps or websites | No. Watsin does not track you and does not share data for advertising. |
| Photos | Package photos you take during a scan are uploaded so we can identify the product. The app never opens your photo library. |
| AI processing | The front-of-package photo goes to our own image-recognition service and, when the product is not in our database, to OpenAI to find it on the web. Label photos go to Google Cloud Vision and OpenAI to read the ingredients and nutrition. Your chat messages and product context go to OpenAI to generate replies. These providers do not use our inputs to train their models. |
| Where your data is stored | In the European Union (Supabase and Fly.io in Stockholm, Sentry and PostHog in the EU). OpenAI, Google, RevenueCat and Resend process some data in the United States. |
| Analytics | PostHog (EU). You can switch it off and delete past events at any time in the Drawer → Profile → Account. |
| Children | Watsin is not intended for users under 16. |
| Contact | contact@watsin.app |
01Who we are
The data controller for Watsin is:
Synion OÜ Liiva 28, Salme alevik 93201 Estonia Estonian business register code: 14933333
For any privacy question, including to exercise the rights described in section 9, contact us at contact@watsin.app.
Our lead supervisory authority under the GDPR is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) — https://www.aki.ee/en.
We have not appointed a Data Protection Officer because we are not required to do so under Article 37 GDPR.
02Scope
This policy covers the Watsin app for iPhone, the backend services the app communicates with, and the emails we send: your one-time sign-in code and the invitations you ask us to send to friends. Our emails come from hello@watsin.app.
Our website, watsin.app, sets no cookies and runs no analytics. The only personal data it collects is what you type into its contact form (section 3.9).
03Data we collect, how we use it, and our legal basis
We organise this by category. The “Legal basis” column refers to the General Data Protection Regulation (GDPR).
3.1Account data
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address | You provide it at sign-up and sign-in | Create your account; check that it is not already registered; send your one-time sign-in code | Art. 6(1)(b) — performance of a contract |
| Display name (optional) | You provide it at sign-up | Personalise the app; shown as the sender’s name in invitations you send | Art. 6(1)(a) — consent |
| App language | The app, from your language setting | Send your sign-in code and the invitations you send in your language | Art. 6(1)(b) |
| Coupon code and its partner identifier (optional) | You enter it at sign-up | Credit your account; attribute referrals to partners | Art. 6(1)(b) and Art. 6(1)(f) — legitimate interest in operating a referral programme |
3.2Product capture data
When you scan a grocery product, the following is uploaded to our backend so the app can recognise it, retrieve its data, or build a new record when no match exists.
| Data | Purpose | Legal basis |
|---|---|---|
| Front-of-package photo | Identify the product: our image-recognition service turns it into an image embedding; when the barcode is not in our database, OpenAI reads the photo to search the web for the product, and reads it again with the label photos. Stored in our private product image storage. | Art. 6(1)(b) — performance of the service you requested |
| Barcode value | Look up product information | Art. 6(1)(b) |
| Image embedding (a 512-dimensional numeric vector) | Match your photo against our product database | Art. 6(1)(b) |
| Label photos you take during the OCR fallback or an OCR re-scan | Sent to Google Cloud Vision to extract the text, then with that text to OpenAI, which reads the ingredients and nutrition from them. Until you tap “Process” they are held in a private storage area only our backend can read; they are deleted once read, and any left behind (for example when you cancel the scan) are deleted within about three hours. The photos are never kept; only the extracted text and the product data read from them are. | Art. 6(1)(b) |
| Extracted label text and the product data read from it | Build and improve our product database so other users — and you on future scans — get accurate results | Art. 6(1)(b); and Art. 6(1)(f) for the database-improvement purpose |
| Capture session record (linked to your account) | Tie a scan to your account so it can be finished and re-scanned | Art. 6(1)(b) |
| Daily scan counter | Apply the daily limit on product recognition (see section 3.5) | Art. 6(1)(b) |
| Product report (if you use the Report panel) | Count the kind of problem you reported against the product, to improve data quality. The report is not linked to your account. | Art. 6(1)(f) — legitimate interest in data accuracy |
The camera permission is requested only when you start a scan. We do not access your photo library.
3.3Chat and AI-generated content
When you chat with Watsin, ask a follow-up in a Thread, or open a product’s evaluation, the following is sent to OpenAI through our backend to generate the response (see section 6).
| Data | Purpose | Legal basis |
|---|---|---|
| Your message and the earlier messages of that conversation | Generate the AI response | Art. 6(1)(b) |
| The product you are looking at (name, ingredients, nutrition) | Provide context to the model | Art. 6(1)(b) |
| Your enabled dietary and allergy fields (see section 3.4) | Personalise the response and the product evaluation | Art. 6(1)(a) and Art. 9(2)(a) — explicit consent |
Your chat history, Threads and saved products are stored on your device only (see section 4). OpenAI receives them only to generate a reply; our backend does not store them.
3.4Profile fields (dietary preferences, allergies)
In the Drawer → Profile you can fill in optional free-text fields about yourself: Dietary preferences, Foods I want to avoid, Mild allergies, and Serious allergies.
These fields are stored only on your device. When the switch next to a field is on, the field’s text is included in requests to OpenAI so that responses and product evaluations can take it into account. When the switch is off, the field is not sent.
Because allergy and dietary information can reveal health information, we treat these fields as special-category data under Article 9 GDPR. The switch on each field is our consent mechanism (Art. 9(2)(a)). You can withdraw consent at any time by switching the field off or clearing its text, with no effect on processing carried out before withdrawal.
3.5Subscription, credits and purchase data
| Data | Source | Purpose | Legal basis |
|---|---|---|---|
| App Store transaction identifiers, product identifier, subscription status, expiry date | Apple, through RevenueCat | Manage your subscription, unlock features you have paid for, prevent fraud | Art. 6(1)(b) |
| Credit balance and the daily scan counter | Our backend | Operate the credit-based usage system and the daily limit | Art. 6(1)(b) |
| Purchase records | Apple and RevenueCat | Keep the accounting records Estonian law requires | Art. 6(1)(c) — legal obligation |
We do not see or store your payment card. Apple processes payments directly.
3.6Diagnostics
| Data | Provider | Purpose | Legal basis |
|---|---|---|---|
| Crash reports, error reports, stack traces, device model, OS version, app version, a log of the app’s recent steps, and your Watsin user identifier | Sentry (EU) | Diagnose crashes and errors and fix bugs | Art. 6(1)(f) — legitimate interest in app stability |
Sentry is configured not to collect default personal information (sendDefaultPii: false). The only identifier attached to a report is your Watsin user identifier, a random code that does not contain your name or email address. We do not record performance traces.
3.7Product analytics
| Data | Provider | Purpose | Legal basis |
|---|---|---|---|
| Event names and counters (for example “scan started” with the scan method and duration, “chat message sent” with the message length), app version, platform, language, and your Watsin user identifier | PostHog (EU) | Understand how the app is used and improve it | Art. 6(1)(f) — legitimate interest in improving the app; you can object at any time by switching analytics off |
Analytics is on by default. You can switch it off at any time with the Analytics switch in the Drawer → Profile → Account; no further events are sent from then on. With Delete my analytics data in the same place you can also delete your past events: we delete your PostHog person and all of its events. Deleting your account does the same. Before you sign up, events are recorded under a random identifier, which is joined to your account when you sign up.
We do not send the text of your chat messages, the contents of your profile fields, your photos or your email address to analytics. We do not record your screen.
3.8Invitations
If you invite a friend, you give us their email address. We use Resend to send them one invitation email, in your app language, showing your display name if you set one. We store the invitation — your email address, your friend’s email address, the invitation code and when it expires (7 days after sending) — so we can credit you both when your friend signs up with the code. We do not contact your friend again. To prevent misuse, one person can send at most 5 invitations a day, and one address receives at most 3 invitations a week.
Legal basis: Art. 6(1)(f) — legitimate interest in operating a referral programme. Your friend can ask us to delete their email address at any time at contact@watsin.app.
3.9Emails you send us
If you write to us at contact@watsin.app, through the contact form on watsin.app, or reply to one of our emails, we receive your email address and your message (and, from the form, your name and the topic you picked), which our email provider (Google Workspace) holds for us. The form sends your message to us as an email through Resend; our backend does not store it. We use all of this only to answer you. Legal basis: Art. 6(1)(f) — legitimate interest in answering you, or Art. 6(1)(c) when your message is a request under section 9.
3.10Service logs
Our backend keeps short-lived technical logs (for example which function was called, when, by which user identifier, and whether it succeeded) to operate and secure the service and to investigate errors. Legal basis: Art. 6(1)(f) — legitimate interest in running a secure service.
3.11Information we do not collect
- Location — we do not request or process location data.
- Contacts, calendar, microphone, motion — never accessed.
- Your photo library — never accessed; the app only uses photos you take with the camera inside the app.
- Advertising identifier (IDFA) — never collected.
- Health app data — we do not connect to Apple Health.
04Data that stays on your device
Some content never leaves your iPhone except when you use a feature that sends it (see sections 3.3 and 3.4). It is kept in the app’s private storage, which other apps cannot read:
- Your chat history (the Chat feed) and your Threads
- Your saved Products list and the product photos shown in it
- Your profile field text (dietary preferences, allergies)
- Your custom daily-intake values
- Your language, analytics and appearance settings
- Your sign-in session, kept in the iOS Keychain
When you sign out, this data stays on the device, tied to your account, and is there again when you sign back in. Deleting your account removes it from the device. Deleting the app removes it too, except that iOS may keep the sign-in session in the Keychain; sign out first if you want that gone as well.
05How long we keep your data
| Category | Retention |
|---|---|
| Account data (email address, display name, app language, coupon code, credits, subscription status) | Until you delete your account |
| Sign-up check (your email address and the coupon code you entered) | Deleted once your account is created, or within one day if sign-up is not completed |
| Capture session records and the daily scan counter | Until you delete your account |
| Front-of-package photos you contribute | Kept as part of Watsin’s product database. When you delete your account, the link between the photo and your account is permanently removed; the photo is stored under the product’s barcode and is not tied to you. |
| Label photos taken during the OCR fallback or an OCR re-scan | Not kept. Held in a private temporary storage area until they are read when you tap “Process”, then deleted; an hourly clean-up deletes any older than two hours, so none is held for more than about three hours. |
| Extracted label text and product records | Kept as part of Watsin’s product database. When you delete your account, the link to your account is permanently removed and only the product data remains. |
| Image embeddings and the shared product catalogue | Kept; not tied to your account |
| Invitations | Deleted 30 days after the invitation expires, when the person who sent it deletes their account, or on request |
| Subscription and purchase records | Until you delete your account; RevenueCat and Apple keep purchase records for as long as accounting law requires (in Estonia, 7 years) |
| Crash and error reports (Sentry) | Up to 90 days |
| Product analytics (PostHog) | Up to 12 months, or until you delete your analytics data or your account |
| Service logs | Up to 7 days |
| Emails you send us | As long as needed to answer you and keep a record of your request |
06Service providers and other recipients
We share data with the following service providers (processors) only to operate Watsin. Each is bound by a data-processing agreement.
| Provider | Role | Data shared | Region |
|---|---|---|---|
| Supabase | Backend platform — database, sign-in, file storage, serverless functions | All server-side data described above | EU (Stockholm) |
| Fly.io | Hosts our own image-recognition (OpenCLIP) service | Front-of-package photos, only while the embedding is computed | EU (Stockholm) |
| Sentry | Crash and error reporting | Diagnostic data described in 3.6 | EU |
| PostHog | Product analytics | Analytics events described in 3.7 | EU |
| OpenAI | AI models for chat replies, Thread answers, product evaluations, ingredient explanations, translations of product names, finding products on the web and reading package photos | Your chat messages; product photos and extracted label text; product data; your enabled profile fields | USA |
| Google (Cloud Vision API) | Reads the text on label photos during the OCR fallback and OCR re-scans | The label photo (Google returns the text and keeps no copy) | USA |
| RevenueCat | Manages subscriptions and credit purchases | Your Watsin user identifier and your App Store purchase events | USA |
| Resend | Sends our emails (sign-in codes and invitations) and delivers contact-form messages to us | Recipient email address and the email’s content; for the contact form, your name, email address and message | USA |
| Google (Workspace) | Hosts our mailboxes | Emails you send us | Global |
Apple distributes the app and processes in-app payments as an independent controller under its own privacy policy; we receive from Apple only the purchase information described in section 3.5.
We do not sell personal data. We do not share personal data with advertising networks. We do not make automated decisions that have legal or similarly significant effects on you.
OpenAI. Data we send to OpenAI through its API is governed by OpenAI’s Data Processing Addendum. Under those terms, API data is not used to train OpenAI’s models and is kept for up to 30 days, for abuse monitoring, before deletion.
Google Cloud Vision. Images we send to the Vision API are governed by the Google Cloud Data Processing Addendum. Under those terms, request content is not used to train Google’s models and is not kept beyond the time needed to return a response, apart from short-term logging for abuse and operational reasons.
07International transfers
Where a provider processes data outside the European Economic Area (currently OpenAI, Google, RevenueCat and Resend in the United States), the transfer is protected by:
- the EU–U.S. Data Privacy Framework where the recipient is certified under it; and / or
- the European Commission’s Standard Contractual Clauses, together with the security measures described in section 8.
You can request a copy of the relevant safeguards from contact@watsin.app.
08Security
We take the following measures to protect your data:
- All network traffic between the app and our backend is encrypted (TLS 1.2 or higher).
- Database access is protected by row-level security rules, so one user cannot read another user’s records.
- Sign-in uses short-lived signed tokens (Supabase Auth); sign-in codes expire after an hour and are rate-limited.
- Label photos are held in private storage that only our backend can read, and deleted as described in section 5.
- Credentials for our service providers are kept as server-side secrets, never in the app.
- Crash reports exclude default personal information.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the Estonian Data Protection Inspectorate in line with Articles 33–34 GDPR.
09Your rights
Under the GDPR you have the following rights in respect of your personal data:
- Access — obtain confirmation that we process your data and a copy of it (Art. 15).
- Rectification — have inaccurate data corrected (Art. 16).
- Erasure — have your data deleted in the circumstances set out in Art. 17 (the “right to be forgotten”).
- Restriction — restrict processing in the circumstances set out in Art. 18.
- Portability — receive your data in a structured, machine-readable format (Art. 20).
- Objection — object to processing based on our legitimate interests, including analytics (Art. 21).
- Withdraw consent — where processing is based on your consent (your display name, the dietary and allergy fields), you may withdraw it at any time without affecting earlier lawful processing.
- Complaint — lodge a complaint with the Estonian Data Protection Inspectorate (https://www.aki.ee/en) or the supervisory authority of your country of residence.
You can exercise most of these rights directly in the app, in the Drawer → Profile → Account:
- Delete account — deletes your account: your email address, display name, credits, subscription status, capture sessions, daily scan counter, and the invitations you sent; removes the link between your account and the photos and label text you contributed (see section 5); deletes your analytics data; and removes your chat history, Threads, saved products and profile fields from the device. Some data may be kept where the law requires it (see section 5).
- Delete my analytics data — deletes your past analytics events without deleting your account.
- Analytics switch — stops further analytics events from being sent.
For any other request, write to contact@watsin.app. We respond within one month. We may need to verify your identity before acting on a request.
10Notice for California residents
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you rights similar to the GDPR, including the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to limit our use of sensitive personal information. The categories of personal information we collect are those described above; we do not “sell” or “share” personal information for cross-context behavioural advertising as those terms are defined under California law. To exercise your rights, contact contact@watsin.app. We will not discriminate against you for exercising them.
11Children
Watsin is not directed at children under 16, and we do not knowingly collect personal data from anyone under that age. If you believe a child has given us personal data, contact contact@watsin.app and we will delete it.
12Changes to this policy
This version of the policy took effect on its “Last updated” date above. We may update this Privacy Policy from time to time; when we do, we will change that date, and the new version takes effect on it. For material changes that affect how we use your data, we will tell you in the app before the change takes effect.
13Contact
Synion OÜ Liiva 28, Salme alevik, 93201 Estonia Email: contact@watsin.app