Privacy
Last updated October 31, 2026
This page says what NightShade Health collects, why, who else handles it, and how to have it deleted. It covers this website, the browser version of the scanner and the NightShade Health app.
Who we are
NightShade Health runs this website and the NightShade Health app. You can reach us at [email protected].
What we collect on this website
If you join the waiting list, we keep your email address and the answers you choose to give us. Those are how you would use NightShade Health, your country (as a three-letter code), the language you prefer, whether you use an iPhone or an Android phone, and the interests you tick. We also keep the date you agreed.
If you tell us you run a restaurant or café, we also keep its name and city, and a contact name and number.
We do not ask about your health on the waiting list or the restaurant form.
The site uses only the cookies it needs to work. You may meet two here: a security cookie that protects our forms from forged posts, and a referral cookie, set only if you open a friend's referral link and kept for 30 days, so we can credit them when you join. In the browser scanner a third keeps you signed in as a guest (see below). It has no analytics or advertising cookies. The forms use a human check from Cloudflare (Turnstile), which runs in your browser and tells us only whether the check passed.
If you pick a light or dark look, your browser remembers it on your device. It is never sent to us.
What the app collects
The app gives your phone a random identifier, kept in the iPhone Keychain. We store only a scrambled copy of it (a digest), your language and the dates your phone last used the app. There is no sign-in and no name.
Your scans are saved against that identifier: the ingredient text, the barcode if you scanned one, the result, and a photo if you took one.
The sensitivity profile you set up is health information, which the GDPR treats as a special category (Article 9). We use it only on your explicit consent, and the app asks for it first: nothing is stored as a profile until you agree. If the wording you agreed to changes, we ask again, and until you do your results are worked out as if you had no profile.
"Delete my data" in Settings removes everything we hold for your phone: the profile, the scans, their results and any stored photos. It cannot be undone.
What the browser scanner collects
Where the browser version of the scanner is available, it makes an anonymous guest on your first scan or when you choose to set up a profile, never just because you opened a page. It sets one cookie that keeps you signed in as that guest. The cookie lasts 90 days.
We store a scrambled copy of the guest's identifier, its language and timestamps. We do not store your network address or browser details on that record. Your scans and, if you consent, your profile are stored the same way as in the app.
A guest who never gave consent is deleted after 30 days without use. A guest who did is deleted after 90 days without use. You can also delete it yourself in Settings.
The browser scanner checks ingredients against our own knowledge base only. It never sends anything to an AI provider.
AI checks in the app
In the iPhone app, on phones that pass Apple's App Attest check, NightShade Health can ask an AI service about an ingredient word it does not know, or read the ingredient list from a photo of a label. These features are switched on gradually and may be off.
For an unknown word, we send only that word and its language, after a filter that keeps out anything that is not an ingredient. For a photo, we send the photo. We never send your profile, your name or your identifier.
Before a photo is sent, we re-encode it, which removes location and camera details, and we shrink it. An AI answer can only make a result more cautious. It is never shown as verified, and a result from a photo is never better than Check.
The AI services we use are Anthropic (Claude) and Google (Gemini). We use their paid business services, never a free tier that lets the provider train on our data. We keep a short record of each call (which model, sizes, cost), without the text or the photo. We remember an AI answer for an ingredient word for up to 90 days so we do not ask twice. That memory holds the word and the answer, not who asked.
Photos of labels are kept for 30 days on Cloudflare R2 storage, then deleted. A scan's text and result stay until you delete them. Delete my data removes the photos at once.
Product look-ups
To find a product's ingredients from a barcode, or from the name and brand on the front of a pack, our server asks Open Food Facts, a public database, and for a barcode it does not have, its sister databases Open Beauty Facts, Open Products Facts and Open Pet Food Facts. It sends the barcode or the name and brand text, and nothing about you: not your identifier, your profile or your address. We keep the product details we get back, so a product is looked up once.
Network addresses
To stop abuse we limit how often one address can use some features. For that we use a scrambled, one-way version of the address (for IPv6, of its first half), not the address itself, and it expires with the limit window. We do not store the address on your record.
Like most servers, ours and our hosting provider's routine logs can briefly show the address a request came from.
Measuring use and fixing errors
Product analytics, if switched on, goes to PostHog (EU), from our server only. There is no analytics code in the app or on the website. An event says that something happened on an anonymous device: that a scan was made (how it was read, the action word shown, which is worked out from your answers, the product's NSX level), that onboarding finished, or that a chef card was opened (its language). The device is identified by a code derived from its identifier that PostHog cannot link back to a record.
We never send ingredient text, the profile, an email address or an AI answer to PostHog.
Error reports go to Sentry. Before one leaves our server we remove the request body, the query string, cookies and almost all headers, and we cut the page address to its first part. Sentry gets no trail of what you tapped.
Why we collect it
We use your email to invite you and to tell you about NightShade Health. We use your answers to decide what to build first.
We use your scans and profile only to show you results in the app. We do not sell your details, and we do not share them for advertising.
Who helps us
These companies handle details for us, only on our instructions:
DigitalOcean hosts the site, the app and the database, in Amsterdam (the Netherlands).
Cloudflare handles web traffic, runs the Turnstile human check, and stores label photos and our encrypted database backups (R2).
SendPulse sends our email.
Sentry receives error reports and PostHog receives product analytics, as described above.
Anthropic and Google process AI requests in the iPhone app, as described above.
Open Food Facts answers product look-ups. It gets a barcode or a product name, as described above.
Backups of the database are encrypted before they leave our server and are deleted automatically after about two weeks. A deletion you ask for is therefore gone from backups within that time.
How long we keep it
Waiting list details: until you ask us to delete them, or until we close the waiting list, whichever comes first.
App scans and profile: until you use Delete my data. Browser guests: 30 or 90 days without use, as above. Label photos: 30 days. Encrypted backups: about two weeks.
Your choices
Every email we send has a link that deletes your details. You can also write to [email protected] to see, correct or delete what we hold.
In the app and the browser scanner, Settings has Delete my data.
Under the EU's GDPR and Egypt's Personal Data Protection Law (Law 151 of 2020), depending on where you live, you can ask to see your details, have them corrected or deleted, and object to how we use them. You can also complain to your data protection authority.
If you agreed to us keeping your sensitivity profile, you can take that back at any time by using Delete my data.
Changes to this page
If we change what we collect or why, we will update this page and its date before the change takes effect.