Last updated: October 26, 2026
Who we are
SnackCheck on the web (snackcheckapp.com/app) is run by BigBalli Consulting ("we"). You can reach us at [email protected].
This page is the SnackCheck web supplement to the BigBalli Consulting privacy policy, which applies to all our apps. Where the two differ, this page wins.
The web app is separate from the SnackCheck iPhone and Android apps. Purchases do not carry across platforms. The Android app has its own section below.
Who this is for
Accounts are for adults (18 and over). The web app is used by parents and caregivers. Children do not create accounts. We do not knowingly collect personal information from children under 13 directly. A parent enters information about their own child.
The SnackCheck Android app
The Android app has no accounts and no sign-in. Child profiles, allergen groups and scan history are stored only on your device. Android may include them in your own Google device backup.
Only these things leave the device:
- The barcode you scan, sent to Open Food Facts to look up the product.
- A photo you choose to analyze, sent to our server and on to OpenAI. We do not store the photo. Your child's name and profile are never sent with it.
- A product name and brand, sent to our server to check FDA recalls.
- Your referral code, and a friend's code if you redeem one.
- Crash and error reports: the app version, the Android version, the phone model and the error. They contain no device identifier, no name and no child details. They reach us by email with the IP address they came from.
Our server uses your IP address for rate limiting and keeps it for about 2 days. Purchases are handled by Google Play; we never see your payment details. The app has no ads and no analytics.
Children and kid mode
SnackCheck is made for parents, and it has a kid mode so a child can check their own snacks on a family device. Kid mode works the same way as the rest of the Android app: no account, no sign-in, nothing that identifies the child leaves the device, and no ads. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, email [email protected] and we will delete it.
Not medical advice
SnackCheck is an information tool. It is not medical advice. See our Terms of Use.
How you sign in
You sign in with an email magic link or a 6-digit code. There are no passwords. We send these emails from our own mail server. We do not send marketing email from the web app.
What we store
We keep this data in a SQLite database on our own server:
- Your email address.
- Child profiles you enter: a first name or nickname, a birth date, an emoji avatar, and the allergies and custom ingredients to avoid.
- Allergen groups: a name and a list of allergens.
- Scan history: the barcode, product name and brand, the computed score and result, and any matched FDA recalls.
- Your referral code and bonus scans.
- Subscription status: plan, status, renewal date, and your Stripe customer and subscription IDs. We never store card numbers.
Photos
When you analyze a photo, it is sent to OpenAI for analysis. We do not store the photo on our server. Only the extracted result is saved to your history: product name, ingredients, and flagged allergens and dyes.
How AI is used
OpenAI processes the ingredient list and product details to write the plain-language insight. It also checks the custom ingredients you entered against the ingredient list.
The 0 to 100 score is computed by fixed rules, not by AI.
Under OpenAI's API terms, API data is not used to train their models by default. The text and photos we send to OpenAI do not include your email address or your child's name.
Product and recall data
We look up barcodes in Open Food Facts, a public database. We send them the barcode only. Recall data comes from the U.S. FDA public recall database, which we store on our server.
Payments
Stripe processes payments. Your card details go directly to Stripe and never touch our server. Stripe has its own privacy policy.
Advertising measurement
We advertise SnackCheck on Facebook and Instagram. To see which ads lead to purchases, our server tells Meta Platforms when you start a web subscription or buy lifetime access.
We send Meta the type of purchase, the amount and currency, and the time. We also send your email address hashed with SHA-256, the _fbp and _fbc cookie values or the ad click ID described below if we have them, your IP address and your browser type. Meta compares the hashed email with the hashes it already holds, and never receives your email in plain text.
If you reach the web app from one of our ads, the link carries a Meta click ID (the fbclid parameter). We keep it on our server with your visitor session, and with your account once you sign up, and send it with a purchase within 90 days so Meta can match the purchase to the ad. It is not stored in a cookie. Opting out deletes it.
We never send Meta your children's details, your allergen groups or your scan history. Meta handles this data under its own terms and privacy policy.
Cookies
We use only strictly necessary cookies:
- A sign-in session cookie. It lasts 30 days and is renewed while you use the app.
- A temporary visitor cookie. It holds your onboarding answers and your one free scan before you sign up. It lasts 30 days.
- A short-lived cookie during sign-in. It lasts 15 minutes.
The web app sets no advertising cookies. Our home page at snackcheckapp.com uses the Meta Pixel, which can set two Meta cookies, _fbp and _fbc. When you buy, the web app reads them if they are in your browser. See "Advertising measurement" below.
Analytics
We run our own analytics, hosted by BigBalli Consulting on bigballi.com, to see which pages people use. It records the page you are on (the path, without anything after the question mark), the page you came from, your screen size, how far you scroll, how long the page stays open, your browser type and your IP address. It keeps a random visitor ID in your browser's local storage for up to 2 years and a session ID for 30 minutes.
It never receives your email address, your children's details or your scan results. It is not shared with anyone and is not used for advertising. Sign-in pages are excluded.
Error reports
When something breaks, we record technical details so we can fix it: the page, the error message, your browser type and your account number. Error reports never include your email address or your children's details.
Security and abuse prevention
We use IP addresses for rate limiting and keep them for about 2 days. Server error logs may contain IP addresses. We keep them only as long as needed to fix problems.
Hosting
The web app runs on our own server. Cloudflare delivers and protects the site.
How long we keep data, and deleting it
Your data stays until you delete it. You can:
- Delete a scan from your history.
- Edit or delete child profiles.
- Delete your whole account from the Account page.
Account deletion is immediate and cancels any web subscription.
After you delete your account, we keep only a one-way keyed hash of your email address, the number of free scans used, and whether a referral code was redeemed. This stops the free allowance from being reset by registering again. The hash cannot be turned back into your email address.
Stripe keeps payment records as the law requires.
Your rights
You can ask for access to your data, correction of it, deletion of it, or a copy of it. Email [email protected] and we will answer within 30 days.
Sale and sharing
We do not sell personal data. The only data we share for advertising is the purchase information described under "Advertising measurement," and you can stop that at any time. Turn on "Do not share my purchases with Meta" on the Account page, or email [email protected]. If your browser sends a Global Privacy Control signal, we treat it as the same request. Once you opt out, we send Meta nothing about your future purchases.
Changes to this page
When we change this page, we update the date at the top. Material changes are shown in the app.
Contact
Questions about privacy: [email protected].