Privacy policy

Effective 12 October 2026

1. Who we are

Yasno is provided by Hawk Minds Ltd (UIC 205119042, registered in Bulgaria), 19A Pushkin Street, Velingrad, Bulgaria ("we", "us"). We are the controller of the personal data described here. You can contact us about privacy at privacy@yasnoapp.com.

2. What we process, and why

Label photos

When you photograph a label, the app makes the photo smaller and sends it over an encrypted connection to our server in the EU. Our server passes it to our label-reading provider, OpenAI, whose AI model copies out the ingredient list and the nutrition panel. The text comes back to your phone.

• We don't save the photo, and we don't write it to our logs. It exists on our server only while it is being read.
• OpenAI processes it under its business terms. These don't allow it to use the photo to train its models, and allow it to keep it for up to 30 days only to detect abuse.
• The photo is sent without your name, account or profile. Please photograph only the label, not people or documents.
• A small preview of the photo is kept in the scan history on your phone. It is never uploaded.

Legal basis: performing our contract with you, which is providing the scan you asked for.

Ingredient lists you type

If you type an ingredient list instead of taking a photo, it is analysed on your phone. It is sent to us only if you sync your history (see below) or send a problem report.

Your health profile (optional)

You can tell Yasno about allergies, pregnancy, breastfeeding or trying to conceive, a child in the household, some health conditions, your skin type, and ingredients you want to avoid. This is health information, a special category of personal data under the GDPR.

• Each part has its own switch. Leaving them all off doesn't limit any other part of the app.
• Without an account, the profile is stored only in your phone's secure storage. It is used on your phone to add personal warnings to your results. We never receive it.
• If you sign in, the profile is also stored on our server so it can reach your other devices. It is encrypted on our server with AES-256 before being saved, and decrypted only to send it back to you.
• Your profile is never sent to OpenAI or any other AI provider.

Legal basis: your explicit consent, which you give by switching a part on. You can withdraw it at any time by switching that part off, or by deleting your profile or account.

Scan history

Every scan is saved on your phone so you can open it again, even offline. If you sign in, your history is also stored on our server. For each scan this includes the product name as read from the label, the ingredient text, the nutrition figures, and the result as you saw it. That includes any personal warnings, so it can reveal health information, such as an allergy.

Legal basis: performing our contract with you. Where a saved result contains personal warnings, it relies on the same explicit consent as your profile.

Your account (optional)

Accounts use Sign in with Apple. We receive an identifier from Apple and, if you choose to share it, your email address. This may be an Apple private relay address. We also store a token from Apple so that we can tell Apple to disconnect Yasno when you delete your account.

Legal basis: performing our contract with you.

Subscriptions

Payments are handled entirely by Apple. We never see your card or bank details. We use RevenueCat to manage subscriptions. RevenueCat receives your purchase receipts, an app user identifier (random, or your Yasno account identifier if you're signed in) and basic device information such as the device model, system version and country. It tells us whether your subscription is active, which plan you have and when it renews or ends.

Your free monthly scan count is kept only on your phone.

Legal basis: performing our contract with you.

Problem reports

If you send a "Report a problem", we receive the category you chose, your note if you wrote one, the ingredient text, the app's language, and a copy of the result with all personal warnings removed. Reports are not linked to your account.

Legal basis: our legitimate interest in correcting mistakes and keeping our information accurate.

Ingredients we haven't assessed yet

If a scan contains an ingredient that isn't in our database yet, the app sends that ingredient's identifier to our server so we can research it. Nothing else is sent with it.

Technical data

Like any internet service, our server and hosting provider see your IP address and basic request details, such as the time and the page or function used. We use these to run the service and to prevent abuse, for example by limiting how many requests one connection can make. The limit counters are kept in memory only. Server logs are kept for a short period set by our hosting provider, currently up to 30 days.

The app downloads the ingredient database from our content-delivery provider, Cloudflare, which sees your IP address when it does.

If you've allowed it in your iPhone settings, Apple shares crash reports and usage statistics with us. These don't identify you.

Legal basis: our legitimate interest in running a secure, reliable service.

3. What we don't do

• No advertising, and no sale or rental of your data.
• No analytics, advertising or tracking tools in the app or on this website. No cookies.
• Your health information is never used for anything except your own results.
• Your photos and data are not used to train AI models.
• No automated decisions with legal or similarly significant effects on you.

4. Who processes data for us

We use these service providers. Each processes data only on our instructions, under a data-processing agreement.

Where data goes outside the European Economic Area, it is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

5. How long we keep it

• Label photos: not stored by us. OpenAI may keep them for up to 30 days.
• Profile and history on our server: until you delete them or your account. Signing out removes them from your phone but keeps them in your account.
• Account details: until you delete your account.
• Problem reports: as long as we need them to fix the problem and keep a record of the correction, and no longer than 3 years.
• Server logs: up to 30 days.
• On your phone: until you delete it in the app or remove the app. Your free-scan count may survive reinstalling the app, because it is kept in the phone's secure storage.

6. Your rights

Under the GDPR you have the right to:

• get a copy of your data, including in a machine-readable format;
• have it corrected;
• have it deleted;
• restrict or object to how we use it;
• withdraw consent at any time, without affecting what was done before.

Delete everything: in the app, open Account and choose Delete account. This permanently deletes your account, profile and history from our servers and from your phone, and disconnects Yasno from your Apple ID.

For anything else, email privacy@yasnoapp.com. We'll reply within one month. You can also complain to a data protection authority, for example the one in the EU country where you live. In Bulgaria, this is the Commission for Personal Data Protection (cpdp.bg).

7. Security

All connections between the app and our server are encrypted. Health profiles are encrypted on our server before they are saved. Our server and database run in the EU, and access to them is limited to the people who operate the service.

8. Children

Yasno is not intended for children under 16, and we don't knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

9. Changes

If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell you in the app first.