Privacy Policy

GutenGluten collects the information you type into it, and almost nothing else. There is no analytics, no advertising, no third-party tracking, and nothing is ever sold or shared for marketing. The app does not ask for or use your location.

Your saved venues and scan history are private to your account. Reviews and reaction reports are public, because other people who eat gluten free rely on them.

Account. You can sign in with email, with Apple or with Google. With email we store your email address and a securely hashed version of your password. With Apple or Google we store the email address and name that provider gives us. You can also continue as a guest, in which case no email address is collected at all.

Profile. A display name, and optionally how you describe your situation (diagnosed coeliac disease, awaiting diagnosis, gluten sensitive, family or carer, other).

Waitlist. If you join the waitlist on this website, we store your email address and use it only to tell you when the app launches.

Private to your account. Only ever shown back to you:

• Saved venues
• Barcode scan history: the barcode, the matched product and the result
• Personal access tokens you create to connect an AI assistant

Public contributions. Shown to other people in the app:

• Venue reviews, with your display name: your rating, whether you consider the venue safe for a strict gluten-free diet, your notes and your visit date
• Gluten reaction reports: severity, what you ate, your description and the date. These appear as safety signal on the venue without your name.
• Venue and product submissions you send in, including answers to a venue questionnaire. These are added to the shared dataset and are not shown with your name.

Your situation (such as a coeliac disease diagnosis) and your reaction reports can be sensitive information under Australian privacy law. By entering them you consent to them being stored so the app can use them.

Your situation stays private to your account. Reaction reports are published against the venue, without your name, because warning other people is the point of them. The app tells you this before you submit one.

• Location. The app never asks for location permission and does not use it. The map opens on a fixed view of Perth.
• Camera images. The barcode scanner reads codes on your device. Frames are never stored or uploaded. Only the decoded barcode number is sent, so a product can be looked up in our database or in Open Food Facts.
• Pasted text. Ingredient lists and menus you paste in are checked and then discarded. They are not saved to your account.
• Analytics, advertising and tracking. There are no such SDKs in the app, and we do not track you across other apps or websites.
• Contacts, photo library, microphone, health app data and device identifiers for advertising.

We do not sell your personal information, and we do not share it for advertising or marketing purposes.

App data is stored with Convex, our backend provider, on infrastructure located in the United States. This means your information is stored and processed overseas. We rely on Convex’s own security and privacy commitments for that hosting.

Traffic between the app and the backend is encrypted in transit. Passwords are stored hashed, never in plain text.

You can delete your account from inside the app: open the menu, go to Settings, and choose Delete account.

Deletion permanently removes your login, profile, saved venues, scan history and access tokens.

Your reviews and reaction reports are kept, but anonymised: your name is replaced with “Deleted member” and they are no longer linked to you. This is deliberate. Removing them would silently change the safety picture that other people who eat gluten free rely on. If you want a specific review or report removed as well, email us and we will remove it.

Backups may retain deleted data for a short period before they age out.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you can ask for access to the personal information we hold about you, ask us to correct it, or complain about how we have handled it. Email me@lucasknight.com.au and we will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.