Privacy Policy

1. Scope

This policy covers two separate surfaces: the byta mobile app (iOS/Android, built with Expo/React Native) and the byta waitlist website at our marketing domain. They collect different things, noted separately below. It does not cover third-party services we link to or source data from, such as Open Food Facts, which have their own privacy practices.

2. Information we collect

Account information

byta requires an account to use the core app. Depending on how you sign in, we (or our authentication provider, Supabase Auth) hold your email address and, for Apple or Google sign-in, the identifier and name/email those providers share with us. We never see or store your password — Apple and Google handle that themselves for their sign-in methods.

Scan activity

The barcodes and products you scan, and when you scanned them, are saved against your account so your History tab works. This information is private to your account — we never publish it, and per our own product rules it is never used for analytics tied to your identity or to specific products. Any product analytics we look at internally is aggregate only (e.g. total scan counts, score-tier distribution, how often people tap a swap) and cannot be traced back to you.

Avoid-list & allergen preferences

Allergens or ingredients you choose to flag in Settings are stored against your account so byta can surface a heads-up on products that contain them. This never changes a product's score — it's purely informational to you.

Health context you choose to share

byta lets you optionally write a short free-text note about what you're managing or working toward (e.g. "watching my blood pressure"). If you use this feature, that text — and a summary derived from it — is stored against your account so byta can highlight relevant facts when you scan. This is never used to change a score and is not medical advice. You can clear it at any time from Settings; see Your choices below.

Camera

byta requests camera access to read barcodes. If you choose to contribute missing product information, the camera is also used to capture photos of a product's front, ingredients, and nutrition label, which are uploaded to help fill in our product database. Photos are only captured and uploaded when you take that action — byta does not access your camera roll or upload anything in the background.

Waitlist email (website only)

If you join the free waitlist on our marketing site, we collect the email address you enter so we can notify you at launch. This is handled separately from the app and is not linked to any in-app scan data.

Standard technical data

Like any networked app, our backend infrastructure (Supabase) may log basic request metadata (timestamps, error rates, coarse device/OS info) for reliability and abuse prevention. This is operational logging, not profiling.

3. Payment & pre-order information

If you pre-order byta's Lifetime Membership on our website, payment is processed entirely by Stripe — we never see or store your card number. We receive from Stripe: the email address you paid with, the amount charged, and a payment confirmation reference. We use this only to match your pre-order to your byta account once you sign in and to handle refund requests. See our Pre-order & Refund Policy for full details on how this works.

Once byta launches, ongoing subscriptions are billed and managed by Apple through the App Store. Entitlement status (whether your account has a paid subscription or a Lifetime Membership) is managed through RevenueCat, our subscription infrastructure provider, which receives your account identifier and subscription status — never your payment details.

4. What we don't collect

• No precise or coarse location data.
• No contacts, photo library, or microphone access.
• No advertising identifiers, and byta shows no ads.
• No third-party analytics, tracking, or crash-reporting SDKs are bundled in the app.
• No sale of personal information, ever, to anyone, for any reason.

5. How we use information

• To run the core scan → score → swap experience on your device.
• To personalize allergen and health-context flags — informational only, never a change to the underlying score (the score is never for sale or for personalization).
• To improve product data coverage using photos and details you choose to contribute.
• To respond to support requests you send us.
• To keep the service reliable and secure (error monitoring, abuse prevention).

6. How we share information

We do not sell your information. We share it only in these limited ways:

• Open Food Facts — product lookups are matched against this open database; contributed product data may, in aggregate and de-identified form, help fill gaps in a shared product catalog.
• Supabase — our backend, database, and authentication provider, which stores and processes app data on our behalf under its own security commitments. It does not use your data for its own purposes.
• Stripe — processes pre-order payments; we receive your email, charge amount, and a payment reference, never your card details.
• RevenueCat — manages subscription and entitlement status once byta launches on the App Store; receives your account identifier and subscription state, never payment details.
• Apple / Google — if you sign in with Apple or Google, they authenticate you and share the identifier/email you authorize; if you subscribe on the App Store, Apple processes that payment directly and we never see your card details.
• Legal & safety — if required to comply with law, or to protect the rights, safety, and security of DevAura, our users, or the public.
• Business transfers — if DevAura is ever involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction, subject to this policy's commitments.

7. Data retention

Data tied to your account is kept for as long as you use byta. If you delete byta from your device, locally cached data is removed with it, but your account and its server-side data (history, avoid-list, health note, entitlement status) persist until you request account deletion — see Delete your data — or until it is removed as part of routine data hygiene.

8. Your choices & rights

• Clear your avoid-list or health note anytime from Settings inside the app.
• Delete your data — see our dedicated account & data deletion page for the current process.
• Uninstall the app to remove everything stored locally on that device.
• Unsubscribe from waitlist emails using the link in any email we send.
• Access, correction, or export — contact us (below) and we'll help, referencing the email your account uses.

Depending on where you live, you may have additional rights under laws such as the CCPA or GDPR. Contact us and we'll do our best to honor them even where not strictly required.

9. Security

We use reasonable technical and organizational measures — encrypted transport, access controls on our backend — to protect the information we hold. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

10. Children's privacy

byta is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we'll delete it.

11. International users

byta's backend infrastructure may process and store data outside your country of residence, including in the United States. By using byta, you understand your information may be transferred to and processed in such locations.

12. Changes to this policy

We may update this policy as byta evolves — for example, when an optional account-sync feature ships. We'll update the "last updated" date above, and for material changes we'll provide more prominent notice in the app.

13. Contact us

Questions about this policy or your data? Reach us any time.