SuitBite Privacy Policy

1. Scope and operator

This Policy explains how information is collected, used, shared, stored, and protected when you use the SuitBite mobile app (宜食 in Chinese), website, and download page.

Operator and data controller: SuitBite Project Team (individual developer Patricia Lu).

2. Information we process

2.1 Food analysis and personalization

• Food content: photos you take or select of food packaging, ingredient lists, nutrition facts, and barcodes, together with extracted text, barcodes, product names, brands, ingredients, nutrition, additives, allergen notices, and analysis results.
• Health goals and preferences: goals you select, such as sugar control, sodium control, fat loss, gout, child, or general health, and your nutrition-reference standard. These details personalize scores and explanations and are not used for medical diagnosis.
• Scan history: a random user ID or account ID, scan time, image URL, product details, results, and cache status. When you are signed out, an on-device random ID is still used to save history and enforce usage limits.

2.2 Account and sign-in information

• When you use Sign in with Apple or Google, we receive the platform user identifier and any name or email you authorize the platform to provide. Apple may provide a private relay address.
• When you sign in by email code, we process your email address, verification status, session, and abuse-prevention records. Codes are valid for five minutes.
• We process any display name you choose and account data needed to sync health goals, scan records, and subscription status across devices.

2.3 Usage, device, and network information

• App platform and version, device model, interface language, random session ID, feature interactions, scan flow, error type, response time, and subscription status.
• Your public IP address and the IP lookup source, used for rate limiting, abuse prevention, network diagnostics, and aggregated service-quality analysis by region.
• The website and download page record page views, download-button interactions, platform, language, and referrer. Browser local storage holds your language preference and a random landing-page ID. We do not use this information for cross-site advertising.

2.4 Feedback and diagnostic information

• Feedback type and text, optional contact details, related product and score, and screenshots you choose to submit.
• The app keeps size-limited runtime logs on your device. They may include device model, app version, operation flow, and errors. Logs are normally uploaded only after you confirm. If diagnostic support has been enabled for your user ID while troubleshooting an issue with you, logs may be uploaded periodically.

2.5 Purchases and subscriptions

Apple, Google, and RevenueCat process purchase and subscription transactions. We receive and retain the user, product, transaction or receipt identifiers, and entitlement status needed to unlock features. We do not receive your full card or payment-account details.

3. Purposes and legal bases

We use the information described above to:

• recognize food labels, match products, and generate rules-based scores and personalized explanations;
• save and sync scan history, account details, health goals, and subscription entitlements;
• provide support, handle feedback, troubleshoot issues, and improve recognition quality and user experience;
• apply usage limits, protect accounts and the Service, and prevent fraud or abuse; and
• comply with legal obligations and respond to valid rights requests.

Where applicable law requires a legal basis, we rely on performance of the service you request, consent, our legitimate interests (such as security and product improvement), or legal obligations. You may withdraw consent-based processing as described in this Policy; withdrawal does not affect prior lawful processing.

4. AI and service providers

We transfer information to the following processors or platforms only as needed to provide the Service. We do not sell information to them, and we require providers to protect data under their contracts and applicable law.

• Alibaba Cloud: provides serverless computing, object and table storage, logs, verification email, and Model Studio AI services. Food photos, extracted text, and analysis instructions are sent to visual language models hosted through Model Studio (currently including Qwen and Kimi) to create structured results. See the Alibaba Cloud Privacy Policy.
• Apple and Google: provide sign-in, app distribution, and in-app purchases. See Apple Privacy Policy and Google Privacy Policy.
• RevenueCat: processes subscription entitlements, receipts or purchase tokens, user IDs, and limited device and transaction details. See the RevenueCat Privacy Policy.
• Cloudflare: supports website/CDN delivery and proxies some subscription-service requests in certain regions, so it may process IP addresses, request logs, and proxied traffic. See the Cloudflare Privacy Policy.
• Public-IP lookup services: the app may request its current public IP from icanhazip, ipify, or IP.SB. These services necessarily receive the requesting IP and basic request information.
• Open Food Facts: our product catalog includes product records and images from this open database. We do not intentionally send your account information to it. See Open Food Facts Privacy.

We do not sell or rent personal information, use third-party advertising SDKs, or track your activity across other companies' apps or websites for advertising.

5. Storage and international transfers

Primary Service data is stored in Alibaba Cloud regions in mainland China. Apple, Google, RevenueCat, Cloudflare, and other providers may process information outside your country or region. Where cross-border processing occurs, we use reasonable safeguards required by applicable law and provider agreements.

Some preferences, cache entries, pending scans, and diagnostic logs are first stored on your device. Uninstalling the app or clearing local data does not automatically delete information already uploaded to the cloud.

6. Retention and deletion

• Account details, personal scan history, and health goals are generally retained until you delete your account or record, or we complete a valid deletion request.
• Food-label photos you upload and product facts extracted from them may remain in the shared product catalog after being disassociated from your user record. Account deletion does not automatically remove this disassociated product data. Contact us if an image contains personal information or you have another valid reason to request its removal.
• Uploaded diagnostic logs have a seven-day automatic lifecycle. Local logs are cleared after a successful upload. Feedback, analytics, security, and abuse-prevention records are kept only as long as needed for their stated purposes or legal requirements.
• Deletion markers, audit records, backups, or legally required data may remain in restricted storage and will be deleted or anonymized when the applicable period ends.

7. Your rights and choices

• Camera and photos: revoke permission in system settings. Related capture or selection features will stop working.
• Records and preferences: delete individual or all personal scans in the app and change your health goals at any time.
• Account deletion: signed-in users can delete their account under Settings → Account. This removes account profile fields, personal scans, related usage-limit records, and local authentication and cache data. Disassociated shared product data and transaction records retained lawfully by third parties may not be deleted at the same time.
• Third-party accounts and subscriptions: revoke sign-in access in your Apple or Google account settings and manage subscriptions through the App Store or Google Play. Deleting your SuitBite account does not automatically cancel an active subscription.
• Privacy requests: subject to applicable law, you may request access, correction, deletion, restriction, portability, withdrawal of consent, or objection. We may verify your identity first.

8. Security

We use reasonable safeguards such as HTTPS transmission, access controls, least privilege, environment separation, credential rotation, and monitoring. No internet transmission or electronic storage is completely secure. Do not include identity documents, payment details, or other sensitive personal information unrelated to food analysis in food photos, feedback screenshots, or text.

9. Children

The “Child” health goal is intended for a parent or guardian evaluating food and does not mean the Service is designed for independent use by children under 13. We do not knowingly collect personal information from children under 13. If you believe a child submitted information without appropriate parental consent, please contact us.

10. Health information and automated analysis notice

SuitBite uses AI to recognize labels and a rules engine to generate scores and notices. Results can be affected by photo quality, label content, database records, and model error. They are general food information and purchase guidance only—not medical diagnosis, treatment advice, or an individualized nutrition prescription. For allergies, medical conditions, medication, or other health concerns, consult a qualified professional and rely on the physical product label.

11. Changes to this Policy

If data categories, purposes, service providers, or the operator materially change, we will update the version and date and provide notice through the app, website, or another appropriate channel. If applicable law requires new consent, we will request it before the relevant processing begins.

12. Contact us

We respond to verifiable privacy requests within a reasonable period.