Who is responsible for your data?
Glyk is published by Adrien Audouard, the controller responsible for the processing described in this policy. For questions about your personal data or to exercise your rights, please contact us:
The data we use
The data used depends on the features you choose.
- Product browsing: barcodes, searches and product selections needed to find and display the information you request. Barcode lookups are recorded on the server with their date and outcome, without a user identifier in that record.
- History and nutrition plans: scan history, plans and some preferences stored locally on your device.
- Service access: a technical identifier generated by Firebase Authentication to authenticate requests and protect contributions against abuse. This identifier lets you use the app without registering with your name; it does not make all data anonymous.
- Contributions and reports: proposed corrections, descriptions, product information and attached photos used to check and improve product listings. Barcode contributions are associated with your technical identifier.
- Operation and security: connection data, including the IP address used to limit abuse, and technical request logs.
- Analytics and diagnostics: browsing information, screens viewed, technical device information and crash reports.
- Contact: your email address and the content of your messages, so we can respond to your requests.
Camera access and your photos
Glyk requests camera access to scan barcodes and read packaging. You can withdraw this permission in your device settings. The corresponding features will then be unavailable.
For photo searches, text is recognised on your device and then sent to the server to identify the product. The search photo is not uploaded in this process, and its temporary file is deleted after recognition unless local cleanup fails.
When you voluntarily attach photos to a report, those photos are uploaded and stored so we can review it. Adding photos is optional. Avoid including people or personal information unrelated to the product.
Analytics and cookies
The website uses Google Analytics through Firebase to measure visits, only with your permission. You can accept, decline or change your choice at any time using “Analytics settings” in the footer. Declining does not prevent you from browsing the website.
Your choice is saved in your browser’s local storage. It stays there until you change it or clear the website’s data; no automatic expiry is currently set.
The mobile app uses Firebase Analytics to measure usage and Firebase Crashlytics to diagnose crashes. These services are currently enabled by default in production versions. The app does not yet provide a setting to disable this collection. Your website choice does not apply to the app.
Firebase Analytics advertising storage and advertising personalisation options are disabled on the website and in the app.
The website loads its fonts from Google Fonts. Your browser therefore connects to Google’s servers to display them, independently of your analytics choice.
Why we use this data
Data needed for product searches and the features you request is used to provide that service. Contributions and reports help us check catalogue information. Contact details are used to respond to your messages.
Website analytics relies on your consent. Protecting the service and preventing abuse serve Glyk’s legitimate interest in maintaining its security.
The legal bases for other processing, including in-app analytics and diagnostics, are still being formalised. This policy does not constitute consent to that processing.
Recipients and service providers
Data is accessible to Adrien Audouard and the providers involved in operating Glyk, according to their roles.
- Google / Firebase: technical authentication, analytics and crash diagnostics.
- Cloudflare: website hosting and storage of report photos using R2.
- Heroku: hosting the API that processes app requests.
- MongoDB: hosting the database used by the API.
- Google Fonts: providing the website’s fonts.
- The email service used to receive and respond to your requests.
International transfers
Some of Glyk’s providers operate internationally. Depending on the service and its configuration, data may be processed outside the European Economic Area.
The countries of processing and safeguards applicable to each service still need to be specified in this policy. Please contact us with any questions about a provider or transfer.
Data retention
Retention arrangements vary by data type. Periods that have not yet been set below still need to be specified.
- Local data: plans, history and preferences remain on your device until they are deleted or the app’s data is cleared. Your device backups may also contain a copy.
- Website analytics choice: stored in your browser until you change it or clear the website’s data.
- Received reports, photos and contributions: no automatic deletion after a fixed period is currently implemented. You can request deletion of personal data relating to you.
- Firebase Analytics, technical identifiers, logs and emails: retention periods still need to be specified based on service settings and the needs of each processing activity.
- Firebase Crashlytics: Google states that crash reports and associated identifiers are retained for 90 days before deletion from live and backup systems begins.
Your rights and choices
Depending on the processing and applicable conditions, you can request access, rectification, erasure, restriction or portability of your data, and object to certain processing.
Where processing relies on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
To exercise your rights, email us with details of your request. If necessary, we will ask for information that helps us locate the relevant data. Clearing the app’s data on your device does not erase contributions or reports already sent to the server.
Changes to this policy
This policy may change as Glyk’s features and service providers evolve. The update date appears at the top of this page. Significant changes to processing will be communicated through appropriate information notices.