Clear Cart
Home

Privacy Policy

Last updated: September 28, 2026

This Privacy Policy explains how Clear Cart ("we," "us," "our") collects, uses, and protects information when you use our service.

What We Collect

We deliberately collect as little as possible. Specifically:

Information you provide

  • Email address — used solely for passwordless ("magic link") authentication
  • Optional profile information — display name and U.S. state, if you choose to provide them in Settings
  • Ingredients you choose to track — the list of ingredient names you personally add to your preferences

Information generated through use

  • Scan history metadata — date, product names detected, recall counts, calorie estimates. We do not store the source images.
  • Account activity — login timestamps, basic usage counters for rate limiting

Information collected automatically

  • A one-way hash of your IP address, used for rate limiting and abuse prevention. Raw IP addresses are not stored in our database.
  • Cookies — strictly necessary cookies for authentication. No advertising or tracking cookies.

What We Do NOT Collect or Store

  • We do not store photos. Photos submitted for scanning are processed by a third-party vision API and discarded immediately. They are never written to our database or any persistent storage we control.
  • We do not collect names beyond an optional display name, addresses, phone numbers, dates of birth, or government IDs.
  • We do not collect payment information. (If paid plans launch in the future, payment data will be handled exclusively by a payment processor and never touch our systems.)
  • We do not collect health information, medical history, dietary restrictions, or food sensitivity information.
  • We do not collect children's data. The Service is not directed at children under 18 and we do not knowingly collect information from minors.

How We Use Information

  • To provide and operate the Service
  • To authenticate you and maintain your session
  • To enforce usage limits and prevent abuse
  • To send recall notifications you have opted into
  • To improve the Service (in aggregate, non-identifying ways)
  • To communicate essential service updates (account, security, terms)

We do not use your information for advertising. We do not build profiles of you. We do not sell your data.

Third-Party Services

The Service is built on the following third-party providers, each of which processes some data:

  • Supabase — database and authentication. Stores your email and your account data.
  • Vercel — hosting. Processes web requests; may log basic technical data.
  • OpenAI — vision API. Receives photos you submit for scanning. Per OpenAI's policies, API inputs are not used for training. Photos are not retained by us.
  • Resend — email delivery. Handles transactional email including magic-link authentication and recall notifications.
  • Cloudflare Turnstile: bot protection on sign-in.
  • openFDA, USDA FSIS, Open Food Facts — public data sources that we query. These services do not receive your personal information.

Each provider has its own privacy policy and security practices. We have selected them for their security posture but we are not responsible for their independent actions.

How We Protect Information

  • All data is transmitted over HTTPS
  • Database access is restricted by Row Level Security; users can only see their own data
  • Authentication uses industry-standard passwordless magic links
  • API keys and secrets are stored in environment variables, never in source code
  • We minimize what we collect to reduce exposure in any incident

No system is perfectly secure. If you believe your account has been compromised, contact us immediately.

Your Rights

Depending on where you live, you may have rights including:

  • The right to access the personal data we hold about you
  • The right to request correction or deletion of your data
  • The right to withdraw consent
  • The right to lodge a complaint with a supervisory authority

To exercise any of these rights, email us at modelconscience@gmail.com.

You may delete your account at any time from the Settings page. Deletion removes your email, scan history, tracked ingredients, and account record from our database.

Data Retention

  • Account data: retained while your account is active. Deleted upon account deletion request.
  • Scan history metadata: retained for up to 90 days, then automatically deleted.
  • Photos: never retained.
  • Logs: technical logs retained for up to 30 days for debugging and security.

Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact us and we will delete it.

International Users

The Service is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. By using the Service, you consent to this transfer.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above. We encourage you to review this policy periodically.

Contact

Questions about this Privacy Policy? Contact us at: modelconscience@gmail.com