PluckFresh is designed with your privacy in mind. We collect only what is needed to deliver the app experience, protect your data with encryption, and never sell your information.
1. Introduction
This Privacy Policy explains how PluckFresh ("we", "our", or "the app") collects, uses, and protects information when you use our iOS application. PluckFresh is a produce freshness scanner and social discovery platform powered by AI.
By using PluckFresh, you agree to the practices described in this policy. If you do not agree, please do not use the app.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Authentication data — email address and authentication tokens via Firebase Authentication (supports Apple Sign In, Google Sign In, and email/password)
- Profile information — display name and optional profile photo that you choose to provide
2.2 Photos & Scan Data
When you scan produce, PluckFresh captures a photo using your device camera or accepts an image from your photo library. These images are:
- Sent to our secure cloud service for AI analysis (see Section 3)
- Stored locally on your device in encrypted form for your scan history
- Optionally shared to the community feed if you choose to post them
2.3 Scan Results & AI Interactions
Analysis results (produce name, freshness status, tips, recipes, and voice narration text) are stored both locally on your device and in our cloud database associated with your account. Conversations with NutriChef AI are processed through our cloud service. If you correct a scan result (for example, by selecting the variety), your correction is saved with that scan.
2.4 Social & Community Data
When you use PluckFresh's social features, we collect:
- Posts — content, images, and captions you share to the community feed
- Comments & Likes — interactions you make on other users' posts
- Follows — your follower and following relationships
- Direct Messages — messages you send to and receive from other users
2.5 Usage Data
We may collect anonymized and aggregated usage data, such as feature usage frequency and scan patterns, to understand how users interact with the app and improve its performance. This data is stripped of personally identifiable information.
2.6 Scan Contributions (optional)
If you turn on Help Improve PluckFresh, we keep a copy of the produce photos you scan on our servers, together with the AI result for each scan and any correction you make. We call these Scan Contributions.
This is optional and is off unless you turn it on. If it is off, your scan photos are sent to our cloud service only to be analyzed, and we do not keep them on our servers.
Scan Contributions are stored separately from your profile, under an identifier that is not your name or email address. We remove location data from the photo file. Please do not include people, faces or personal documents in the photos you scan.
3. How We Use Your Information
3.1 AI Analysis & Processing
When you scan produce or interact with NutriChef AI, your data is processed through the following services:
- Produce scanning — Produce photos you scan, including live camera identification, are analyzed by AI models from OpenAI or Anthropic. We encourage you to review OpenAI's Privacy Policy and Anthropic's Privacy Policy.
- NutriChef AI chat — your NutriChef AI chat conversations, including any photos you share in the chat, are processed by Anthropic's Claude API. We encourage you to review Anthropic's Privacy Policy. Other users can ask NutriChef AI about a post you share in the community feed; when they do, that post's photo and caption are sent to Anthropic's Claude API to generate a reply, and the caption is saved in that user's chat history.
- Recipe images — recipe images are generated by OpenAI. We encourage you to review OpenAI's Privacy Policy.
Voice narration is spoken aloud on your device using Apple's built-in speech synthesis — the narration text is generated during scan analysis, and no separate voice service receives your data.
3.2 Account & Cloud Services
We use Google Firebase to provide:
- Authentication — secure account sign-in and management
- Cloud Firestore — storing your profile, posts, comments, follows, messages, and scan data
- Cloud Storage — storing images you upload (profile photos, post images)
- Cloud Functions — processing AI requests securely on the server side
3.3 On-Device Storage
Scan history and images are also stored locally on your device for offline access. Images are encrypted using AES-GCM 256-bit encryption before being saved locally. The encryption key is stored in the iOS Keychain, protected by your device passcode and the Secure Enclave.
3.4 Service Improvement
We may use anonymized and aggregated data — including scan results and interaction patterns — to review, analyze, and improve the accuracy of our AI models and the overall user experience. This data is stripped of personally identifiable information before any analysis.
If you have turned on Help Improve PluckFresh, we use your Scan Contributions to test, measure and improve the accuracy of produce identification and freshness estimates. This includes training and fine-tuning AI models and building reference data about produce. Authorized staff and contractors, bound by confidentiality, may review Scan Contributions. Service providers that host or process data for us may handle them on our behalf. We do not sell Scan Contributions, we do not use them for advertising, and we do not use them to identify you or anyone else.
3.5 Email Measurement
Emails we send (such as our newsletter) may contain links that pass through our servers before reaching their destination, and a small invisible image that loads when the email is opened. When you click a link or open an email, we record it — including which email and which link — to measure which content is useful and improve what we send. Open detection is approximate: some mail apps load images automatically whether or not you read the message. You can stop receiving these emails at any time using the unsubscribe link included in every message.
When you sign up for our newsletter, we first send a confirmation email and only add you to the list after you click the link in it. To protect the sign-up form from abuse, we also record a shortened cryptographic hash of your IP address (not the IP address itself) and your browser's user-agent string; we delete these after 90 days and never use them for analytics.
4. Data Security
We take the security of your data seriously:
- Encryption at rest: locally stored images are encrypted with AES-GCM 256-bit encryption
- Keychain storage: sensitive values (encryption keys) are stored in the iOS Keychain
- TLS in transit: all communication with our servers and third-party APIs uses HTTPS
- Firebase Security Rules: strict server-side rules ensure users can only access their own data
- Authenticated access: all API requests require a valid authentication token
5. Third-Party Services
PluckFresh uses the following third-party services:
- Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions) — for account management, data storage, and server-side processing. Subject to Google's Privacy Policy.
- OpenAI API — for produce scan analysis (including live camera identification) and recipe image generation. Subject to OpenAI's Privacy Policy.
- Anthropic Claude API — for produce scan analysis and NutriChef AI chat. Subject to Anthropic's Privacy Policy.
- Resend — for delivering email we send you (welcome emails, our newsletter, and account-related messages); Resend receives your email address. Subject to Resend's Privacy Policy.
- Google Places API — when you search for nearby restaurants, the location you share is sent to Google to find results. Subject to Google's Privacy Policy.
We do not use any advertising SDKs, social media tracking tools, or third-party analytics services.
6. Data Retention & Deletion
We retain your data as follows:
- Account data — retained while your account is active
- Posts & social data — retained while your account is active or until you delete specific content
- Scan history — retained both locally and in the cloud while your account is active
- Messages — retained while your account is active
- Newsletter sign-up data — email address and subscription status while subscribed; abuse-prevention data (hashed IP, browser user agent) deleted after 90 days
- Scan Contributions — kept until you delete your account or ask us to delete them
You can turn off Help Improve PluckFresh at any time in Settings. We then stop collecting new Scan Contributions. To delete contributions you have already made, email privacy@pluckfresh.app; deleting your account also deletes them. Improvements already made to our models, and statistics that contain no photos or personal information, cannot be reversed.
You can delete your account at any time through the app's settings. When you delete your account:
- Your profile, posts, comments, follows, and messages are permanently removed from our servers
- Local data is removed when you uninstall the app
- Some anonymized and aggregated data that has already been processed for service improvement may be retained, as it cannot be linked back to you
7. International Data Transfers
PluckFresh's servers are located in the United States. If you are accessing the app from outside the United States, please be aware that your data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
By using the app, you consent to the transfer of your information to the United States and its processing in accordance with this Privacy Policy.
8. Your Privacy Rights
8.1 All Users
Regardless of your location, you have the right to:
- Access your personal data through the app
- Delete your account and associated data
- Update your profile information at any time
- Delete individual posts, comments, or scans
8.2 European Economic Area (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate personal data
- Right to erasure — request deletion of your personal data
- Right to data portability — request a machine-readable copy of your data
- Right to object — object to the processing of your personal data for certain purposes
- Right to restrict processing — request that we limit processing of your personal data
The legal basis for processing your data is: (a) your consent when creating an account and using the app, (b) performance of a contract (providing the service), and (c) legitimate interests (improving our service and ensuring security). Scan Contributions are processed only on the basis of your consent, which you can withdraw at any time in Settings.
To exercise any of these rights, contact us at privacy@pluckfresh.app. We will respond within 30 days.
8.3 California Residents (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know — what personal information we collect, use, and disclose
- Right to delete — request deletion of your personal information
- Right to opt-out — opt out of the sale or sharing of your personal information (we do not sell your data)
- Right to non-discrimination — we will not discriminate against you for exercising your rights
We do not sell your personal information and have not done so in the preceding 12 months.
9. Children's Privacy
PluckFresh is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at privacy@pluckfresh.app.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. If we make material changes, we will notify you through the app or by email. Continued use of the app after changes constitutes acceptance of the revised policy.
11. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:
Email: privacy@pluckfresh.app