Privacy Policy

🏠 1. Who We Are

Find The REAL Food is an independent app designed to help children and families identify whole, minimally processed foods while grocery shopping. It is operated by A-Sun Truth ("we," "us," or "our").

This Privacy Policy applies to the Find The REAL Food mobile app (iOS and Android) and the website at findtherealfood.com.

📋 2. What We Collect

Information You Provide

• Parent / guardian email address — used to sign in via magic link. We never ask for a password.
• Child's first name or nickname — optional, used only to personalise the in-app experience (e.g. "Welcome back, Zoe!").

Information Collected Automatically

• Food scan data — barcodes scanned during shopping sessions, the product name, and whether it was identified as a REAL or ultra-processed food. This data is used to calculate game points and achievements.
• Game state — points, level, streak, badges earned, and weekly leaderboard score.
• Device session token — a secure, expiring token stored on-device by Supabase Auth to keep you signed in.

What We Do NOT Collect

• Passwords (we use magic-link authentication only)
• Precise location data
• Payment or financial information
• Device identifiers for advertising purposes
• Photos or camera roll content (the camera is used only to read barcodes)

🎯 3. How We Use Your Data

We use the data we collect exclusively to:

• Authenticate your account and keep your session secure.
• Display your child's personalised name and chosen avatar in the app.
• Track and display game progress (points, level, streak, badges).
• Generate the family leaderboard — shared only with members of the same family group.
• Resolve barcode scans against our food database to produce a REAL / ultra-processed classification.
• Improve the app's food database and classification accuracy in aggregate, anonymised form.

👧🏾 4. Children's Privacy (COPPA)

Find The REAL Food is designed to be used by children under the supervision of a parent or guardian. We comply with the Children's Online Privacy Protection Act (COPPA).

• All accounts are created and managed by a parent or guardian using their own email address.
• We do not collect personal information directly from children.
• Children's names entered in the app are optional nicknames provided by the parent and are not associated with any independently identifiable child record.
• We do not knowingly create accounts where the registering adult is under 13.

If you believe we have inadvertently collected information from a child without parental consent, please contact us immediately at hello@findtherealfood.com and we will delete it promptly.

🤝 5. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly as needed to operate the app:

• Supabase — authentication and database hosting (servers in the US). Supabase Privacy Policy.
• Neon — managed PostgreSQL database (servers in the US). Neon Privacy Policy.
• Render — backend API hosting (servers in the US). Render Privacy Policy.
• Open Food Facts — open food database queried for barcode lookups. No personal data is sent; only the barcode number.
• USDA FoodData Central — open government food database. No personal data is sent.

We may disclose data if required by law, court order, or to protect the safety of users or the public.

🔐 6. Security

• All data in transit is encrypted with TLS 1.2+.
• Authentication uses Supabase's passwordless magic-link flow — no passwords are ever stored.
• Session tokens are stored in the device's secure AsyncStorage and expire automatically.
• API endpoints require a valid Supabase JWT; unauthenticated requests are rejected.
• We rate-limit all API routes to reduce abuse risk.

No system is 100% secure. If you discover a security vulnerability, please report it responsibly to hello@findtherealfood.com.

⚖️ 7. Your Rights

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate data.
• Deletion — request deletion of your account and all associated data. Send a request to hello@findtherealfood.com with the subject line "Delete My Account." We will process it within 30 days.
• Portability — request your game data in a machine-readable format.
• Opt-out — stop using the app at any time. Uninstalling the app stops all data collection.

California residents may have additional rights under the CCPA. Contact us for details.

🗓 8. Data Retention

We retain your account data for as long as your account is active. If you request deletion, we remove all personal data within 30 days, except where retention is required by law.

Anonymised, aggregated usage statistics (e.g., "3,200 barcodes were scanned this week") may be retained indefinitely as they cannot be linked to any individual.

📝 9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective" date at the top of this page. If the changes are material, we will notify you by email (at the address used to sign in) at least 14 days before the change takes effect.

Continued use of the app after the effective date constitutes acceptance of the updated policy.