Privacy Policy

Last updated: 1 October 2026 · Effective: 1 October 2026

1. Data controller

The Mercek app is developed and published by Kaan Eren Memişoğlu. For any question about this policy: kaanerenmemisoglu@gmail.com

2. Data we do not collect

None of the following is requested, generated or stored:

• Phone number, date of birth, address (if you create an account, only your e-mail and optionally your name are processed)
• Location data (coarse or precise)
• Advertising identifier (IDFA), device fingerprint or cross-app tracking data
• Access to contacts, photo library, calendar or health records
• Behavioural telemetry (screen navigation, taps, a log of scanned products), analytics or crash-reporting SDKs — the only usage information sent is the usage signal described in 5.4 (active days and the daily number of scans) and the missing-barcode report in 5.5, which is not linked to any identity

The app contains no third-party ad networks, analytics tools or social media tracking pixels.

3. Data that stays on your device

Everything the app keeps in order to work is stored inside your phone, in the private area the operating system reserves for the app:

• Your scan history — the barcodes you scanned and the calculated scores
• Your saved products — the ones you marked to keep at hand while shopping (if you create an account this list is also stored on our server; see section 6)
• Your sensitivity profile — topics you marked, such as lactose, gluten or palm oil (if you create an account these selections are also stored on our server; see section 6)
• Your appearance and language preferences

Unless you create an account, this data is not sent to us or to any other server, backed up or synced. You can delete all of it with the clear options in the app or by removing the app from your device.

4. Camera

Camera permission is used for two purposes:

• Barcode scanning. Image processing happens entirely on the device and only the barcode digits remain. No photo or video frame is written to disk, stored or sent over the network.
• Adding a product (optional). If you choose to add a product that is not in the database, you take a single photo of the front of the package; if you choose to complete a product whose ingredient list is missing, a single photo of the ingredients section. Only that photo is sent to our server, and only when you tap "send". Details in section 7.

If you don't grant permission the app keeps working; you can type the barcode on screen.

5. Network requests

When you scan a barcode, the app goes online to identify the product. The only information sent is the barcode number itself; nothing that could be linked to your identity is added to these requests.

5.1 Open product databases

For food, cosmetics and cleaning products the barcode is looked up in the open databases Open Food Facts, Open Beauty Facts and Open Products Facts. These services are run by the France-based non-profit Open Food Facts association and are subject to their own privacy practices: openfoodfacts.org/privacy

5.2 Medicine lookup and community records

The barcode is also looked up in the Turkish Medicines and Medical Devices Agency (TİTCK) medicine index on our own server; for products not found in the open databases, records added by community contributions are checked. The server uses the incoming barcode only to answer that request; it does not link the barcode to a user and keeps no scan history.

5.3 Server access logs

Like any web server, ours produces technical access logs (IP address, timestamp, requested address). These are kept only to keep the service running, debug problems and prevent abuse (excessive requests), and are deleted automatically within 14 days at most. They are not used to build profiles, show ads or identify you, are not sold and are not shared with third parties.

5.4 Usage signal and scan counts

The app sends a small signal to our server: on the first launch of the day, at most every five minutes while you scan, and when the app goes to the background. It contains only: a random install ID generated on your device the first time the app runs, the app version, the platform (iOS, Android or web), whether you are signed in, and for each of the last seven days how many scans you made and in how many of them the product was not found. The barcodes, products, scores or sensitivities you scan are not sent with this signal; only the numbers are. The install ID is not linked to your advertising identifier or device hardware, and no IP address is stored with the signal.

If you are signed in, the signal is sent with your session and your scan counts are linked to your account, so we can see how much each account uses the app and when it was last used. If you are not signed in, the counts are kept only under the random install ID and we do not know who you are.

For each install the server keeps the time of the first and last signal, the days on which it was active and the scan counts per day (the last 120 days at most; older days are folded into a single total). It is used only to see active-device and scan numbers, the version/platform split and how much accounts use the app, so we can improve it; it is not used for ads or profiling, not sold and not shared with anyone. If you delete your account, the link between your counts and your account is removed. If you delete and reinstall the app, a new ID is generated.

5.5 Missing product report

If a barcode you scan is not in the open databases, or the product has no ingredients list, the app reports that barcode to our server; when only the list is missing it also sends the product's name, brand and type. No install ID, account, IP address or device information is stored with this report; the server keeps only the barcode, how many times it was requested and when it was first/last requested. The barcode enters a research queue so we can find the product's contents on the public pages of manufacturers, supermarket chains and cosmetics retailers; information found on a trusted source is published in the app with an "added automatically" note.

5.6 Feedback and complaints form

If you fill in the feedback form on the Profile or product screen, the following is sent to our server: the topic and field you chose, your message, the email address you optionally give, the product's barcode and name if you opened the form from a product, the app version, platform, the random install ID described in 5.4 and how long the form took to fill in. If you are signed in, the report is linked to your account and, if you leave the email field empty, your account email is used. Your IP address is not stored as is; only a one-way hash is kept to limit and block spam from the same source. This information is used only to review your report, reply to you if needed and fix wrong information in the app; it is not shared with anyone. You can ask for your reports to be deleted through the support address.

6. Account (optional)

Creating an account is not required; no core feature and not even the Pro subscription requires one. An account backs up your saved products and links your Pro subscription to it. It can be created in three ways: e-mail and password, Continue with Google or Continue with Apple.

6.1 Authentication: Firebase

Sign-in and sign-up run on Google's Firebase Authentication service. Firebase stores: your e-mail address, your name (if provided), your sign-in method, when your account was created and last signed in, your IP address during sign-in (to prevent abuse), and, if you signed up with e-mail, an irreversible hash of your password. Your password never reaches us. Password reset e-mails are sent by Firebase. Firebase processes this data on our behalf under the Firebase privacy and security terms.

• If you continue with Google, only your e-mail address, name and Google user ID are received from your Google account.
• If you continue with Apple, you can choose to hide your e-mail; Apple's private relay address is then used and we never see your real address.

6.2 What our server stores

• Your account ID, e-mail address, name (if any), sign-in method and Firebase user ID
• Your saved products list — to sync it across devices
• Your sensitivity selections (allergen and ingredient topics) — so they also apply when you sign in on another device
• Your subscription status (Pro or not, and until when) — see section 8
• Session token (as a hash only) and last sign-in time
• Your daily scan counts and when you last used the app — numbers only, not which products you scanned (see 5.4)

This data is processed only to operate your account and improve the service; no marketing e-mails are sent, and it is not sold or shared for advertising.

6.3 Deleting your account

You can delete your account at any time: Profile → Delete account. For your security you first verify your identity again (password, Google or Apple). Your record, sessions, saved products list and sensitivity selections are then permanently deleted from our server, the link between your scan counts and your account is removed, and your Firebase account is deleted as well. If you signed in with Apple, the app's authorization on your Apple ID is revoked; if you signed in with Google, Mercek's Google access is revoked. Product contributions you made remain in anonymised form (see section 7). A Pro subscription bought through the store does not stop when the account is deleted; cancel it separately in the App Store or Google Play.

7. Product contribution photos

When you choose to add a product that is not in the database, or to complete a product whose ingredient list is missing:

• The single photo you take — the front of the package for a new product, the ingredients section for a product missing its list — and any note you write are resized on the device and sent to our server.
• The photo is forwarded to the Mercek team by e-mail (through an e-mail delivery provider, which receives only the photo, barcode and your note). The team researches and types up the product details; a record is created only then.
• The team may run the same photo through an AI vision model (Anthropic API) to get a draft. Only the photo and barcode are sent to the model; nothing about your identity is added. The provider processes this data under its commercial terms.
• Copies of processed submissions are deleted after 30 days; photos of a saved product stay with the record.
• The saved product and its photos become a public community record: they may be shown to other users who scan the same barcode as the source of the ingredient list. Please make sure your photos contain nothing personal (faces, addresses, receipts).
• The team may also add the saved product and its photos to the open database Open Food Facts (Open Beauty Facts for cosmetics, Open Products Facts for cleaning products) from Mercek's account. There, product data is published under ODbL and photos under CC BY-SA, and removing them later depends on Open Food Facts' own processes. Your name, e-mail or account are not sent; only a non-reversible random identifier is added so that Open Food Facts moderation can group submissions from the same source.
• If you are signed in, the contribution is linked to your account (who added it is not shown to others); otherwise it is anonymous. If you delete your account the link is removed and the contribution stays anonymous.

You can flag a contribution you believe is wrong with "Wrong? Report" on the product screen; after several reports the record is hidden. To have a photo you added removed, write to us; it will be removed within 30 days.

8. Mercek Pro subscription, ads, sales

Scanning, scores, comparison and the ingredient library are free. There are no in-app ads. The optional Mercek Pro subscription (better alternative suggestions) is sold only through the App Store (iOS) or Google Play (Android):

• Payment is taken by Apple or Google. Your card and billing details never reach us.
• Your subscription status (active or not, when it renews, whether you are in a trial) is processed by our subscription infrastructure provider RevenueCat, Inc. (USA). RevenueCat receives the store's purchase record, a random user ID generated by the app and the device/operating system type. If you are signed in, your account ID (an internal number, not your e-mail) is used instead and your subscription status is also recorded on your account. RevenueCat processes this data under its privacy policy, only to verify the subscription.
• You don't need an account to subscribe. You can manage and cancel your subscription in your App Store or Google Play account settings; refund requests are also made through the store.

No data is sold, rented or shared for marketing purposes.

9. Children

Mercek is not directed at children and does not knowingly collect data from children. If we learn that a user is under 13, we delete their account.

10. Your rights

Under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR) you have the rights of access, rectification, erasure, portability and objection. You can delete your account and its data instantly in the app; for other requests write to kaanerenmemisoglu@gmail.com, and you will receive an answer within 30 days.

11. Security and retention

All traffic between the app and the server is encrypted with TLS (HTTPS). The session token is kept on the device in the operating system's secure storage (iOS Keychain / Android Keystore). Account data is kept until the account is deleted; community contributions until they are removed; access logs for at most 14 days. Our server is hosted in Germany. As service providers, Firebase (Google) and RevenueCat may process data on servers abroad, including in the USA; such transfers take place under the providers' data processing agreements.

12. Changes to this policy

If the policy is updated, the "last updated" date on this page changes. If a change expands the scope of data collected, you will also be informed in the app.

13. Medical disclaimer

Mercek is an information app; it does not provide medical advice, diagnosis or treatment. Medicines are not given a health score and no alternative medicine is suggested. Consult your doctor or pharmacist for decisions about your health.