Legal

Privacy Policy

Last updated: November 2026

Olaixi is a food and nutrition assistant built so that your health information stays on your phone. This policy explains what the Olaixi app and the olaixi.com website collect, why, and the choices you have. If you have a question, write to support@olaixi.com.

Information kept only on your phone

The profiles you create (names, dates of birth, body measurements, allergies, intolerances, medications, conditions, lab values, goals and food preferences, and breed for pets), your scan history and your grocery lists are stored in the app's private storage on your device. Profiles and full scan results are encrypted with AES-256-GCM, using a key kept in your device's secure storage.

• This data is excluded from cloud backups and from device-to-device transfers, and we have no access to it.
• Settings → Delete Local Data, or uninstalling the app, erases it. Because we never receive a copy, we can't restore it.

Information our server stores

To run your account, our server keeps:

• your email address and your password, stored only as a salted hash;
• your plan, this month's usage count, your billing dates and any free scans granted to you;
• for paid plans, the Google Play purchase token that confirms your subscription;
• while a password reset is in progress, a hashed one-time code that expires after 15 minutes;
• your account status, and a count of consecutive non-food photos, which temporarily blocks scanning when it gets too high, to prevent abuse.

We use this information to sign you in, apply your plan's limits, confirm subscriptions and keep the service secure. We keep it until your account is deleted. Like any web service, our hosting provider may also record technical data such as IP addresses in server logs for security.

Information sent for each scan or chat message

To analyze a food, the app sends our server the photo you took (or, for a barcode, the product's label data) together with the active profile, including its name, date of birth and health details. For a chat message it sends your question, the earlier result and the active profile. Photos are never sent with chat messages.

Our server passes this to Google's Gemini API, which generates the analysis, and returns the result to your phone. Our server does not store your photos, profiles, questions or results, apart from a product's label details, which may be added to our product catalog as described under Barcode lookups. Google processes this data under the Gemini API Additional Terms of Service.

Barcode lookups

When the app finds a barcode in a photo, or you scan one into your pantry, it looks the product up in up to three places and stops at the first one that has it:

• Your phone. Product details the app has already looked up are cached on your device for 30 days.
• Olaixi's product catalog. Next, the app sends only the barcode number, over HTTPS, to the product catalog on our server. The request is made from your signed-in account so our server can check that the account is active, but the catalog keeps no record of who looks up a product: it holds each product's label details with a count of lookups and the dates the entry was written and last read, and no account, email address or health information.
• Open Food Facts. If our catalog doesn't have the product, your phone sends only the barcode number to Open Food Facts, a public product database. No account or health information is included.

The catalog grows from scans. When neither the catalog nor Open Food Facts knows a barcode, the app sends the photo for analysis as usual, and the product details the AI reads from the package (its name, brand, ingredient list and nutrition facts) may be added to the catalog so that the next person who scans that product gets them without a new analysis. Only those label details are kept, never the photo, the profile or anything else about you. Catalog entries older than 90 days are no longer used.

Ads and purchases

• The Free plan is supported by short video ads, and the app shows one only after you agree to watch it. On Android, from version 1.0.5, these ads come from Google AdMob. When the app loads or shows an ad, Google's advertising software on your phone collects information such as your device's advertising ID, IP address, device and app details, and how you interact with the ad. Google uses it to deliver and measure ads, prevent fraud and, where the law allows, personalize ads. Google handles this information under its own policies; see How Google uses information from sites or apps that use its services.
• The app never gives the ad network your profiles, health details, photos, scan results or email address.
• You can reset or delete your advertising ID, or opt out of personalized ads, in your device's Google settings. When an ad can't be loaded, the app shows its own brief in-app screen instead. Paid plans don't show ads.
• Paid plans are bought through Google Play. Google handles the payment, and we receive only the purchase token that confirms your plan. We never see your payment details.

This website

olaixi.com uses no cookies, analytics or trackers. Its pages load fonts from Google Fonts, and some load styles from the Tailwind CSS content delivery network; both receive your IP address like any web request. The home page and the feature guide fetch their text from our server, which receives your IP address the same way; nothing else about you is sent.

Video tutorials. Feature guides with a video embed it in YouTube's privacy-enhanced mode (youtube-nocookie.com). The player loads from Google's servers, which receive your IP address, but YouTube doesn't store tracking cookies on your device unless you play the video. Once you play it, Google handles that viewing under the Google Privacy Policy.

Who we share information with

We don't sell or rent personal information, and we never use your health information or account details for advertising. We share information only as described above: with Google, to analyze scans, process purchases, check app and device integrity at sign-in and, through AdMob on the Free plan, show ads; with Open Food Facts, which receives barcode numbers only; with other Olaixi users, who may receive the label details of a product you scanned (never information about you) from our product catalog; with the provider that hosts our server; and when the law requires it.

Security

All connections between the app and our server use HTTPS, passwords are stored only as salted hashes, and app requests are signed. No system is perfectly secure, so please use a password you don't use anywhere else.

Device integrity checks. When you sign in or create an account on Android, the app uses Google's Play Integrity API for device attestation and fraud prevention. Google Play evaluates security signals about the app and the device (the app's package, version and signing certificate, whether it was installed from Google Play, and a hardware-backed attestation of the device) and returns a verdict on whether the request comes from a genuine copy of Olaixi on a genuine Android device. It does not collect your personal content: the only information about you that the app adds to the request is a one-way hash of the email address being signed in, which ties the verdict to that sign-in without revealing the address, and your profiles, health details, photos and scan results are never part of it. Our server uses the verdict only to decide whether your session is verified, keeps nothing from it but the outcome (passed or not, with the app version and the reason for a failure), recorded under your account's internal number in its security logs, and never uses it to track you or for advertising. Google states that it does not share this data with third parties and deletes it after a fixed retention period.

Children

Olaixi accounts are for adults. A parent or guardian may create profiles for children in their household; those profiles stay on the parent's phone, apart from what is sent for each scan as described above.

Your choices and rights

• View and edit profiles at any time in the app, and erase everything on your device with Settings → Delete Local Data.
• Cancel a subscription at any time in Google Play.
• Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information. Contact us to exercise these rights.

Deleting your Olaixi account

To delete your Olaixi account and its data:

• Email support@olaixi.com with the subject "Account Deletion Request" and the email address registered on your account.
• We write to that address to confirm the request is yours. Reply to confirm.
• We delete your account within 30 days of your confirmation. The moment it is deleted, an automatic email from support@olaixi.com reaches your registered address with a confirmation number for the deletion. A blind copy goes to our support mailbox and to the technical operations team at Angels Consulting LLC, the publisher of Olaixi, as our record of the deletion.

What is deleted: your account record on our server, including your email address, password hash, plan and usage, purchase token, and account status. Our server keeps only a short note that the deletion happened (your account's internal number, the confirmation number and the date), with no email address or health data. The copies of the confirmation email, which show your email address and the confirmation number, are kept with your request and our replies for up to 12 months, then deleted.

What you remove yourself: profiles, scan history and grocery lists live only on your phone, so we can't reach them. Erase them with Settings → Delete Local Data, or by uninstalling the app. Deleting your account doesn't cancel a Google Play subscription, so cancel it in Google Play first.

Our Account & Data Deletion Request page has every step, and explains what may be kept for a limited time, such as backups and security logs.

Changes to this policy

If we change this policy, we will post the new version here with a new date.

Contact

Questions or requests: support@olaixi.com.