Privacy Policy — POSHYA:  Food Label Scan

Effective date: 04 10 2026.
Developer: DAP Mobile Applications ("we", "us")
Contact email: developerdap@gmail.com
Application: POSHYA — Android app ("the App"), package com.dap.poshya

POSHYA is provided free of charge and is intended for use as is. This policy explains what personal and sensitive information the App collects, why, who receives it, and what you can do about it.

POSHYA is not a medical device and does not diagnose, treat, cure, or prevent any medical condition. It provides information only and does not replace advice from your doctor or a registered dietitian.

1. Who is responsible

DAP Mobile Applications, reachable at developerdap@gmail.com, operates the POSHYA Android application.

2. What we collect

2.1 Profile information you enter — stored on your device

• Age group (required) — used to personalize results

• Gender, weight, height (optional)

• Health flags (optional) — for example diabetes, high blood pressure, kidney disease, pregnancy or breastfeeding

This information is stored in the app's private storage on your device. It is not included in your Android device backup. Age group and health flags are transmitted to our servers only at the moment you scan a label, to personalise that one analysis (see 3.1). If you never scan a label, nothing is transmitted.

2.2 Information collected when you scan a food label

• The photo you capture (compressed JPEG)

• Your profile fields listed in 2.1

• The result produced from that photo (product name, nutrition values, ingredients, concern level, reasons) and, if you request it, an AI-written explanation

The label photo and profile fields are sent to our server for analysis. The resulting scan is stored in your device's scan history.

2.3 Account information — only if you sign in with Google

• Your Google user ID, display name and email address

Sign-in is optional; the full App works in guest mode. We never see or store your Google password. Signing in is the only way we associate data with an identity, and it enables optional cloud backup.

2.4 Diagnostics and usage analytics

• Crash reports (Firebase Crashlytics): app version, device information, stack traces and error messages when the App fails

• Usage events (Firebase Analytics): scan completed, concern level produced (Low / Moderate / High only), product comparison used, AI insight viewed, and scan errors

We do not send your health flags, weight, height, email address or label photos to analytics.

2.5 What we never collect Contacts, your photo library, location, microphone, SMS or call logs, advertising identifiers, and no data from children under 13.

3. Why we use it

1. Label analysis (core function). To read the label we send the photo and your profile fields to our server, which forwards them to our AI inference provider (section 4) to extract nutrition information and produce a concern level. Scanning cannot work without this, which is why scanning needs a network connection. We do not analyse labels offline.

2. Personalisation. Age group and health flags adjust thresholds and explanations to you.

3. Scan history and comparison. So you can revisit past scans and compare two products.

4. Optional cloud backup. If you are signed in, your scans are copied to our cloud database under your user ID.

5. Diagnostics. To find and fix crashes and failed scans.

6. Support. To answer your requests.

4. Who receives your information

Recipient: Google — Firebase Authentication, Cloud Firestore, Cloud Functions, Crashlytics, Analytics, Google Sign-In

What they receive: Account ID, name, email, your scans, diagnostics

Why: Sign-in, cloud backup, hosting, crash diagnostics

Recipient: Groq — AI inference provider

What they receive: The label photo, plus age group, gender, weight, height and health flags

Why: Reading the label and generating the concern level and AI explanation

We may also use service providers for hosting and support email, solely to operate the service.

We do not sell your personal information. We do not share it for advertising. We do not combine it with advertising identifiers.

5. Where data is processed

Firebase data is stored on Google infrastructure; AI processing is performed by Groq, which may process data outside India, including in the United States. By using the App you accept that your information is processed in the regions where these providers operate.

6. How long we keep it

• Profile and scans on your device — until you delete them (delete a scan or Clear All in History, reset your profile, or uninstall the App)

• Label photos — held in temporary app cache only and removed by the operating system; they are not part of your history

• Cloud copies (Firestore) — until you request deletion (section 7)

• Crash reports and analytics — retained by Google according to Firebase policies; we cannot set individual retention periods

• Cloud Function processing — not stored by us beyond transient request handling

7. Your rights and controls

• View or change your profile — in the App's Profile screen

• Delete a scan or all scans — in the App's History screen (swipe a scan, or Clear All)

• Delete your cloud backup and account — [use one: (a) in the App: Profile → "Delete my data & sign out", or (b) ] by writing to developerdap@gmail.com with the subject "Delete my account". We delete your cloud scans and your authentication account within 30 days and confirm by email.

• Withdraw consent — you may stop using the App at any time; uninstalling removes all App data from your device

• Analytics — analytics events contain no personal identifiers

• Complaints or grievances — write to developerdap@gmail.com. In line with India's Digital Personal Data Protection Act, 2023, you may also write to our Grievance Officer at developerdap@gmail.com.

8. Security

All data in transit is encrypted with TLS. Cloud scans are stored per-user and accessible only to your signed-in account. Profile and scan data are excluded from Android's automatic device backup. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

9. Children's privacy

POSHYA is not directed at children under 13, and we do not knowingly collect personal information from them. Guest mode is intended for adults. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

10. Third-party services

Service: Firebase, Google Sign-In, Google Play Services (Google LLC)

Policy: https://policies.google.com/privacy

Service: Groq (AI inference)

Policy: https://groq.com/privacy

ML Kit text and barcode recognition runs entirely on your device and does not transmit your images.

11. Changes to this policy

We may update this policy. Material changes will be announced in the App or on the Play Store listing. Continued use after an update means you accept the revised policy.

12. Contact

DAP Mobile Applications, Email: developerdap@gmail.com