Nixo Privacy Policy

Introduction

This Privacy Policy explains how Nixo, a food label scanner developed by Idion, collects, uses, and protects your information. It applies specifically to the Nixo app on iOS and Android, not to other Idion products.

By using Nixo, you agree to the practices described in this policy.

What we collect

An anonymous session identifier. Nixo creates one on first launch, alongside the camera and never in front of it, before you are asked for anything at all. It is what your scan history belongs to while you have no account, and it reaches nothing outside Nixo.

Your scan history. Each scan holds the product name as the open food catalogue names it or as the printed panel was read, the verdict, the ingredient that was flagged and the rule family it broke, which of the four rule families were applied at the time, the text that was read from a photographed ingredient panel, the alternative product held with the card, and the date and time of the scan.

The photograph of an ingredient panel, for as long as it takes to read it. When a barcode is not in the catalogue you photograph the printed ingredient list yourself. That photograph is sent to be turned into text, it is used to produce that one verdict, and it is dropped afterwards. It is not stored, not attached to your history and not kept in any form. The permission dialog on your device says this, which is where you read it first.

Which of the four rule families you have switched off. The rulebook ships with the app; the switches are the only part of it that is yours.

The put back marks you make on flagged cards, and the weekly count derived from them.

Your email address, only if you choose to keep your history across devices. That is one row in Settings and nothing in the app ever asks for it anywhere else. Signing in is a six digit code sent to that address. There is no password anywhere in Nixo, no name field, no username, and no sign-in through Apple, Google or any other provider.

Your subscription status, through our subscription management provider, and the answer you give to the four option reason survey if you start to cancel a subscription and do not skip it.

Usage events in our own database. Which screens you reach and which actions you take, whether a scan resolved on the barcode path or the panel path, how long it took, whether a verdict landed, which rule families are switched off, whether the offer or the paywall was reached and what happened there. These events are anonymous and are not tied to your email address.

Data kept on your own device, so the app works with no connection: your session, your theme choice, your scan history with its held verdicts, and your rule family switches.

This is the complete list of what Nixo collects today. If that changes as the app grows, this policy will be updated first, and the last updated date above will reflect it.

What we do not collect

To be specific rather than leave this to inference, Nixo does not collect:

The photograph of an ingredient panel, once the verdict it produced is on screen. It is used and dropped. Nothing in your history holds an image, and a scan resolved by barcode never produces one at all.

Your location, precise or approximate. No location permission is requested, the alternative product on a card is never shop aware, and there is no way for this app to know which shop you are standing in.

Your photo library. Nothing is read from it and nothing is written to it. The share card goes to the system share sheet and never to your camera roll.

Audio or video. Nixo requests no microphone access, records nothing and transcribes nothing. The camera takes stills only.

Any health, dietary or allergy information about you. There is no personal restriction list in Nixo. Nixo says that a named ingredient is present in a food and that this breaks one of its own published rules. It says nothing about you, and it is not a tool for managing an allergy or an intolerance.

Your name, username, postal address, phone number or date of birth. An account is an email address and a six digit code, and there is no profile.

Your payment card, bank or other financial account details. Payment is handled entirely by the Apple App Store or Google Play.

An advertising identifier. There is no advertising software and no third-party analytics software in Nixo, at any tier, ever, so there is no tracking prompt and nothing to opt out of.

A notification token. Nixo sends no push notifications and asks for no notification permission.

Your contacts, your calendar, biometric data or government-issued identification.

Anything belonging to another user. No surface in Nixo shows one person anything another person made, so there is nothing here to moderate, report or block.

We also do not use your email address for marketing. Exactly one kind of email is ever sent from Nixo, and it is the six digit code you asked for.

If any of this changes in a future version of the app, we will update this policy before that change ships, not after.

Accounts and identifiers

Nixo can be used without an account, forever. When you start without signing in, the only identifier we hold is an anonymous session id that lets your scan history persist on this device. Everything the app does is reachable that way: the camera, both scan paths, every verdict, the rulebook and its four switches, history, the weekly put back count, the share card, the ten free scans, the subscription and restoring a purchase.

If you later create an account, we collect your email address and nothing else. There is no password, no name field and no sign-in through Apple, Google or any other provider, so no private relay address or third-party identifier is involved. Creating an account upgrades your existing anonymous session rather than replacing it, and signing in on a device that already holds scans merges them into the account after a confirmation naming how many. Your email address is used to find your history and to send you the sign-in code. It is not used for marketing, it is never shown to anybody else, and it is never used as an analytics identifier.

An account is never a gate. No screen, verdict or feature in Nixo is reachable only by an account holder, and the account is offered in exactly one place, a single row in Settings. It never carries a badge, a warning or a count of what a reinstall would cost. Without an account your history lives on one phone and a reinstall loses it, which is the cost of not asking you for anything at the door.

Camera permission

Nixo requests access to your device's camera so it can read the barcode and the printed ingredient list on the packet you point it at. The camera is the only permission Nixo ever requests. There is no notification prompt, no location prompt, no photo library prompt and no tracking prompt, and you can complete everything the app does, including paying, having answered exactly one system dialog.

The camera is never activated automatically or in the background. It is live only while the app is open on the scan screen, which is where you pointed it. A barcode is read from the frame and no photograph is taken or kept. An ingredient panel is photographed only when you tap the shutter yourself, and that photograph is sent to be turned into text, used to produce that one verdict, and dropped afterwards.

If you decline this permission, Nixo says what the camera is for and offers one control that opens your device settings. There is no second route to a new verdict, because without a camera there is nothing to read: the app does not offer search by product name and never has. Everything you have already scanned stays fully readable without the camera and without a connection, and the denied screen carries a control into your history if you have any.

How we use information

We use the information described above to read the packet you pointed the camera at, to check what it holds against the four published rule families, to keep your scan history and show it back to you, to run your subscription, and to see where the app is confusing so we can fix it. We do not use your information for purposes beyond operating and improving Nixo, and we do not use it to build advertising profiles.

Usage analytics

We record which screens you reach and which actions you take, so we can see where the app is confusing and fix it. That includes whether a scan resolved on the barcode path or on the panel path and how long it took, which rule families get switched off, whether the offer or the paywall was reached and what happened there, and the reason you pick if you start to cancel a subscription and do not skip the survey. These events are stored in our own database and are not tied to your email address. We do not use any third-party analytics service and we do not use any advertising service, so this information is not shared with anyone and is not combined with data from other apps.

AI processing

When a barcode is not in the open food catalogue, Nixo sends the photograph you took of the printed ingredient panel to Google Gemini so it can be turned into text. This happens on our servers, not on your device, and our access key is never included in the app.

The photograph is sent for the sole purpose of reading that one ingredient list and is not used to train the model provider's systems. We do not send your email address or account identifiers with it, and the photograph is dropped once the verdict it produced is on screen. A scan that resolves on the barcode path sends no image anywhere.

What the model produces

The model's only job in Nixo is to report the ingredient list printed on the packet you photographed. The verdict itself is not a model judgement: the rulebook is a closed list of named ingredients that ships inside the app, and a verdict is that list compared against the ingredients that were read. This is why every card names the rule it came from and why you can read every rule in full on one screen.

Model output reaches you in one other place. On a scan resolved by reading a printed panel, the product's category is inferred from that reading, and the category is what decides which product the better in this aisle row names. See our AI Policy for how this works and what its limits are.

Automated decision making

A Nixo verdict is about a food, not about you. It is designed to inform your own decision in the aisle, it does not produce legal effects or similarly significantly affect you, and it is not used for any form of automated profiling. Nothing in the app scores you, ranks you or categorises you, and no verdict about a product is ever a statement about the person holding it.

Subscriptions and payments

If you subscribe, we collect your subscription status through our subscription management provider. Payment itself is handled entirely by the Apple App Store or Google Play. We never see or store your payment card details.

Your subscription lives against your store account and your history lives against your Nixo account, and the two are never joined. That is why deleting your Nixo account does not cancel your subscription, and why restoring a purchase on a new phone returns the subscription and not the history.

Third-party services

We rely on a limited number of infrastructure providers to operate Nixo: Google Gemini, which turns a photographed ingredient panel into text; our own database and server hosting; our subscription management provider; and the provider that delivers your sign-in code by email. These process information on our behalf, under confidentiality and data protection commitments, and only to the extent needed to provide their service to us.

Barcode lookups are answered from Open Food Facts, a public open-data food database published under the Open Database Licence. It is a source we read, and it is credited at the foot of the rulebook screen inside the app. We send it no personal information about you.

We do not sell your information to third parties, and we do not share it with third parties for their own independent marketing purposes. No brand pays for any position anywhere in Nixo, at any tier, ever.

Security

We apply reasonable technical and organizational measures to protect your information from unauthorized access, loss, or misuse, including encrypting data in transit and restricting access so that your records are readable only by your own account. No system is perfectly secure, but security is a priority in how we build Nixo, not an afterthought.

If we become aware of a security incident that affects your information, we will notify you and take appropriate action as required by applicable law.

Data retention

We retain your information for as long as your account is active and as needed to provide Nixo's features. The photograph of an ingredient panel is an exception in the other direction: it is held only for as long as it takes to read, and it is dropped once the verdict is on screen. If you delete your account, we delete or anonymize your information as described on our Data Deletion page, except where retention is required by law or for the limited purposes described there.

International transfers

Your information may be processed in countries other than your own. Where this happens, we take steps to ensure it receives an appropriate level of protection, consistent with applicable data protection law.

Your rights

Depending on where you live, you may have rights to access the information we hold about you, correct it, delete it, export it in a portable format, restrict or object to certain processing, or withdraw consent where processing is based on consent.

If you are located in the European Economic Area, the United Kingdom, California, or another jurisdiction with its own data protection law, you may have additional or more specific rights under that law. These are not reduced by anything in this policy.

See our Data Deletion page to request deletion, or contact us using the details on our Contact page for any other request. We will respond within the timeframe required by applicable law, and in any case within a reasonable time.

Children's privacy

Nixo is not directed at children, and we do not knowingly collect information from children under the age required by applicable law to consent to data processing on their own behalf. If you believe a child has provided us with information, please contact us so we can remove it.

Changes to this policy

We may update this policy as Nixo evolves. We will update the last updated date above when we do, and for material changes we will make a reasonable effort to notify you.

Contact

Questions about this policy can be sent to our privacy team. See our Contact page for details.