Privacy Policy (GDPR)

Last updated: June 17, 2026.

Back

1. Data Controller

The Allergia application is published by Allergia, an activity operated as a sole proprietorship.

For any question relating to personal data protection, users may contact the data controller through the contact address shown on Allergia’s official website.

2. Purpose of this Policy

The purpose of this policy is to inform users of the Allergia application about the data processing carried out, its purposes, legal bases, retention periods, and the rights available to users.

Allergia has been designed according to a data minimization principle. Information relating to allergy profiles is stored locally on the user’s device and is never transmitted to Allergia’s servers without explicit consent.

3. Data Stored Locally on the Device

To enable the application to function, certain data is stored locally on the user’s device.

  • profiles created by the user;
  • allergens associated with each profile;
  • the history of scans performed;
  • application preferences;
  • consent settings.

This information is stored locally in an encrypted database.

Encryption relies on a cryptographic key specific to the user’s device. This key is stored in the operating system security mechanisms: Keychain on iOS and Android Keystore on Android.

Local data is encrypted using an AES-256 algorithm.

No automatic synchronization of this data to Allergia’s servers is performed.

4. Allergy-Related Data

Information relating to allergies or food intolerances entered by the user is used exclusively to enable analysis of scanned products and display compatibility alerts.

This information is stored locally on the user’s device in an encrypted database.

By default, allergy profiles, selected allergens, and the associated history are not transmitted to Allergia’s servers.

The processing used to compare identified ingredients with configured allergens is performed locally on the user’s device.

Allergia does not create a centralized database of individual allergy profiles of its users.

5. Enhanced Protection for Users Under 16

Allergia applies an enhanced protection policy for profiles declared as being under 16 years of age.

No information relating to allergies, food intolerances, or allergy profiles of these users is transmitted to Allergia’s servers, including in statistical form.

Information associated with these profiles remains stored exclusively on the user’s device.

The optional statistical features described in Article 6 are automatically disabled for profiles declared as being under 16 years of age.

6. Allergy-Related Statistics

Subject to separate explicit consent, Allergia may collect certain statistical information intended to improve knowledge of food allergies and produce aggregated analyses.

The information transmitted is strictly limited to the following elements:

  • an age range;
  • a region;
  • a list of allergens;
  • a country.

No direct or indirect identifier is associated with this information.

These statistics are never collected for profiles declared as being under 16 years of age.

The following are not collected as part of this feature:

- last name,

- first name,

- email address,

- telephone number,

- account identifier,

- advertising identifier,

- device identifier,

- retained IP address,

- scan history,

- precise geolocation data,

- any identifier that would make it possible to link these statistics to a specific user.

The information transmitted is recorded in an exclusively statistical form and does not make it possible to directly or indirectly identify a natural person.

These statistics are collected independently from the usage data described in Article 7 and do not include any common identifier enabling the two processing operations to be linked.

Legal basis: explicit user consent.

Retention period: 30 days maximum from receipt.

7. Usage Statistics

Subject to separate explicit consent, Allergia may collect certain information relating to use of the application.

This data may include screens viewed, features used, types of scans performed, whether Premium features are used, and certain technical events relating to use of the application.

This information is associated with a randomly generated pseudonymous technical identifier.

This identifier does not directly identify the user.

Legal basis: explicit consent.

Retention period: 30 days maximum.

8. Minimal Technical Telemetry

To ensure the stability and proper operation of the service, Allergia may record certain minimal technical information that does not identify a user.

This information may include the type of platform used (iOS or Android) and technical events necessary to monitor the proper operation of the application.

Legal basis: legitimate interest of the data controller.

9. Reporting Products Missing from the Database

When a product is not available in the databases queried by the application, the user may choose to voluntarily submit a report.

Information that may be transmitted includes the product barcode, brand, product name, product type, country of purchase, and up to three photographs.

This data is transmitted only at the user’s initiative.

Legal basis: explicit consent.

Retention period: until the report is processed, then deletion or integration into internal data improvement processes.

10. Advertising

Users of the free version may see advertisements.

By default, only non-personalized advertisements are displayed.

Personalized advertisements are enabled only after explicit user consent.

This consent may be withdrawn at any time from the application’s privacy settings.

On iOS, activation of personalized advertisements is subject to the App Tracking Transparency (ATT) system authorization.

11. Premium Subscription Management

Premium subscriptions are managed by RevenueCat and the Apple App Store or Google Play platforms.

Allergia does not collect users’ payment information.

Payment information is processed directly by the distribution platforms and their technical partners.

Legal basis: performance of a contract.

12. Data Recipients

Data may be processed by the following providers:

  • Supabase: hosting of application services and certain server-side data. The project is currently hosted in the European Union;
  • RevenueCat: management of Premium subscriptions and validation of associated rights;
  • Google AdMob: display of advertisements in the free version, if used;
  • Open Food Facts: consultation of public information relating to food products based on their barcode.

13. Transfers Outside the European Union

Some providers may be located or operate outside the European Union.

Where such transfers exist, they are governed by the mechanisms provided for by applicable regulations, including the Standard Contractual Clauses adopted by the European Commission.

14. Retention Periods

Local data is retained until it is deleted by the user or until the application is uninstalled.

Anonymous allergy-related statistics are retained for a maximum period of 30 days before automatic deletion.

Usage statistics are retained for a maximum period of 30 days before automatic deletion.

Product reports are retained for the time necessary to process them.

15. User Rights

In accordance with applicable regulations, users have in particular:

  • a right of access;
  • a right of rectification;
  • a right to erasure;
  • a right to object;
  • a right to restriction of processing;
  • a right to portability where applicable;
  • the right to withdraw consent at any time.

Users also have the right to lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL).

For any question relating to personal data: contact@allergia.fr.

16. Withdrawal of Consent

Consents granted in the application may be withdrawn at any time from the privacy settings.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Without consent, Allergia limits processing to technical data strictly necessary for operation of the service, with no commercial exploitation and no transmission of allergy-related information to Allergia’s servers.

17. Cookies, SDKs, and Trackers

The Allergia website limits cookies to elements strictly necessary for its operation.

Statistical, advertising, or audience measurement trackers are enabled only with clear information and, where required, prior consent.

The application may integrate technical SDKs necessary for operation of the service, subscription management, or display of advertisements depending on the user’s choices.

18. Policy Update

This policy may be modified to reflect changes in the application, regulations, or services used.