Privacy Policy
Effective September 30, 2026.
This Privacy Policy covers the Veto iOS and Android apps and foodveto.com, offered by Venture Deals, Co. ("Veto", "we", "us"). It states what Veto collects, why, who it's shared with, how long it's kept, and how to have it deleted.
What we collect
- Account. Signing in uses Sign in with Apple or Sign in with Google. We store the identifier that provider assigns you (never a password) and your email address when the provider shares one — Apple's own private-relay address if you choose to hide your real one. We do not receive or store your name from either provider. Your Personal Rules (the allergens and diets you set) and any additional household profiles are stored on our server, tied to that account, so they follow you to a new phone.
- Scans. Every scan and its result stay on your device — Veto does not upload your scan history. When a scan checks a barcode against our server, we add one to two anonymous, aggregate counters: how many times that barcode has been checked, and how many times each of its ingredients has appeared in a check. Neither counter is linked to your account or your device.
- Label Capture. When a barcode isn't in our records yet and you photograph its ingredient list — on a food or a personal-care product — the photo and the ingredient text, including any correction you make before submitting, are uploaded to our server. That submission carries only an anonymous, device-generated identifier, never your account or name. Because of that, it is not connected to your account: deleting your account does not delete it (see Retention and Your rights, below, for how to have one removed).
- Shop and location (Veto Plus). Choosing a Shop sends only that Shop's chain name with the requests it powers — Alternatives and Shopping lists. How a Shop is found near you depends on your version of the app.
- Veto 1.2 and later. If you use "Use my location" — in the Shop picker or in the in-shop Alternatives prompt — your device asks for your location and sends your coordinates once, in the body of a single request. Our server uses them only to look up shops within about 2 km in its own shop data, and it does not store them or write them to any log. For the shops it finds, our server saves Shop records that hold only each shop's own name, address and position — never yours.
- Earlier versions. If you use the nearby-Shop picker, your device asks for your location to search nearby; picking one of the results sends the coordinates and place identifier of the place you picked to our server once, to find or create that specific Shop.
- Subscriptions. Veto Plus purchases run entirely through the Apple App Store or Google Play — we never see your card or payment details. We store the purchase's transaction identifier, plan, renewal date, and status (active, expired, and so on) to unlock Plus features.
- Diagnostics. Our server keeps a standard request log for every request it receives — method, path, status, timing, and the request's IP address — the way any web server does, with no cookie. We also use the IP address briefly to apply rate limits that protect the service from abuse; it isn't tied to your account or any other profile we keep, and it isn't sold or shared beyond what's described in Sharing, below. All traffic between the apps, this website, and our server is encrypted in transit (HTTPS/TLS).
We run no advertising network, no third-party analytics library, and no crash-reporting service in either app, so nothing above ever reaches a party this policy doesn't name.
How we use it
To compute a Verdict; to keep your Personal Rules and profiles attached to your account instead of one device; to run Veto Plus (Shop selection, nearby-Shop lookup, Alternatives, Shopping lists, subscription status); to add a Label Capture to the product record it helps complete — for a food product, the public Open Food Facts record too; and to operate, secure, and troubleshoot the service.
Sharing
- Open Food Facts. A Label Capture used to complete a Product's record is published to Open Food Facts under Veto's own contributor account, not your name or account. Once published, that contribution is subject to Open Food Facts' own licences — the ingredient text under the Open Database Licence (ODbL) 1.0, and any photo under Creative Commons Attribution-ShareAlike 3.0. Both make the contribution part of a public database anyone can reuse under those terms, and Veto cannot withdraw it once it's live there. A Label Capture is published this way unless it was sent as a personal-care or other non-food product; one of those stays in Veto's own records, is not sent to Open Beauty Facts, Open Products Facts or any other database today, and only answers for that product's barcode. A capture that doesn't say what kind of product it is — including every capture sent from a version of the app before 1.2 — is treated as food and may be published.
- Apple and Google. Sign-in and Veto Plus purchases are handled directly by Apple or Google under their own privacy terms; Veto receives only what's described above.
- Our hosting provider. Veto's server runs on a single DigitalOcean droplet. DigitalOcean processes data on our behalf as infrastructure, not for its own purposes.
We do not sell data, and we carry no advertising relationship for it to be shared with.
Retention
Account data (your profile, Personal Rules, Shops, and Shopping lists) is kept while your account exists and erased when you delete it (see Your rights, below). Anonymous scan counts and Label Captures are not deleted along with an account, since neither was ever tied to you: scan counts are kept as anonymous totals, and a Label Capture (photo and text) is kept in Veto's own records for as long as it helps answer for that barcode, until you ask us to remove it (see Your rights, below). A capture already published to Open Food Facts stays there either way. Server request logs and database backups are each kept for 14 days, then deleted on a rolling basis.
Your rights
Delete your account and the data tied to it at any time, two ways:
- In the app: open Profile, choose "Delete my account and all data," then confirm with "Delete everything." This erases your account, profiles, and Personal Rules, and clears your scan history from that device. It does not remove anonymous scan counts (never linked to you) or any Label Capture you sent (tied only to an anonymous device identifier, not your account); one already published to Open Food Facts stays there, credited to Veto's contributor account, under Open Food Facts' own licence. See Delete your account for the exact steps on each platform.
- By email: write to support@foodveto.com and ask for your account to be deleted. We handle a request like this within 30 days.
To have a Label Capture you sent removed from Veto's own records, write to the same address with the barcode and roughly when you sent it. We handle a request like this within 30 days. We can remove what Veto holds; we cannot withdraw a capture already published to Open Food Facts, which is governed by that database's own licence.
To see, correct, or ask a question about anything above, write to the same address.
Children
Veto is not directed at children under 13, and we do not knowingly collect data from anyone under 13.
Contact
Questions about this policy: support@foodveto.com.
Changes
If this policy changes, the new version is posted at this address with an updated effective date above.