Privacy Policy

Last updated: October 2026

Overview

Cull is operated by Homespect Ltd, a company registered in England and Wales, trading as Cull ("we", "our", or "the app"). We are committed to protecting your privacy. This policy explains how we handle your data when you use our grocery health scanning app and our website, getcull.com.

The short version: we collect minimal data, we don't show ads in the app, and we never sell your personal data.

What We Collect

Device Identifier When you start using Cull, the app creates a random identifier for your device. It also keeps a copy of Apple's "identifier for vendor" (an ID Apple gives each app maker for your phone, not an advertising identifier) in your phone's keychain, and uses it to keep your product contributions together. These identifiers authenticate requests to our servers, let us apply fair-use limits and associate your data across sessions. They are not your name or email. If you sign in with Apple, the app uses the opaque Apple identifier below in their place, and we link your device to it so your data can sync across your devices. Your Device ID is shown in Settings → About.

Camera & Photos Camera access is used to scan barcodes and read labels, which happens on your phone. When the scanner recognises a product by how it looks, your phone turns the picture into a set of numbers and sends only those numbers to our servers, not the photo.

When you use AI Vision, the photo is sent to our servers. OpenAI's moderation service checks it for abuse, then Google Gemini reads it to identify the product; if Gemini can't answer, OpenAI reads it instead. We don't keep these photos.

When you add a product to the community database, your photos are uploaded as you take them, so we can read the label for you. That happens before you tap Submit, and the photos stay on our servers even if you don't finish. Google Gemini reads them to fill in and check the product's details (OpenAI steps in if Gemini is unavailable). OpenAI's moderation service and our own image-processing server check them for inappropriate content, and for approved products our image-processing server removes the background. Photos taken with Cull's camera are uploaded as full-size originals, which include the details your camera records (such as the phone model, lens and time taken) but not your location; photos you pick from your library are re-saved without them. If you allow it, photos taken with Cull's camera are also saved to your photo library as a backup.

Photos in approved submissions are stored permanently as part of the shared product catalogue, where anyone using Cull or visiting getcull.com can see them. They sit at web addresses that are hard to guess but not password-protected, so please keep people, addresses and anything else personal out of the shot.

Country Code If you allow location access while using the app, your phone takes a rough fix (we ask for about 3 km accuracy) and asks Apple's location service which country that is; Apple's service receives the location to answer. Only the two-letter country code (for example "GB") is kept, on your phone. We never receive your coordinates, city or address. The app refreshes the country when you open it, if the last check is more than six hours old, and forgets it if you turn location access off.

The app sends a country code with your requests so we can show products and alternatives sold where you shop: the shopping country you chose in Settings → Region if you set one, otherwise the country from your location, otherwise your phone's region setting. It is also recorded in analytics as your market. When you add a product, the country from your last location check (if it is less than 24 hours old) is stored with the submission and may be added to the list of countries where that product is sold. Without it, our server works out the country from your internet connection (IP address).

Search Queries When you search, your search words go to our servers and may be passed on, with nothing that identifies you, to Open Food Facts' search service to find results. We don't keep a list of your searches. We do count how often each search term is used, with no link to you or your device, to improve search: we keep the 1,000 most-used terms and drop the rest every night. Result pages are cached for 24 hours under the search words and your country. Your last five searches are kept on your phone so you can repeat them.

Scan History & Favourites Products you scan and favourite are stored on your device. Looking up a product sends its barcode to our servers with your device identifier; our servers count lookups but don't keep a list of the products you looked up. When you sign in with Apple, your history and favourites also sync to our servers so they are available on your other devices. Analytics also records the barcodes you scan (see Analytics & Crash Reports).

Dietary Profile & Allergens Your dietary preferences, goals, and allergens are used to personalise your health scores, to show allergen alerts and, when you use an AI feature, to tailor the answer to you. Your personalised scores and allergen alerts are worked out on your phone; your profile isn't sent with ordinary product lookups or searches. It is stored on your device, and — if you sign in with Apple — it is also synced to our servers (associated with your Apple identifier), with a record of when you gave consent, so your profile follows you across devices. We treat this as sensitive information: we ask for your explicit consent before storing it, we use it only to personalise your experience, we never sell it or use it for advertising, and it goes to our AI providers only when you use an AI feature, for that request alone. You can delete it at any time (see Data Storage & Deletion).

AI Chat Messages Messages you send to the AI Nutritionist go to our servers and then to an AI provider to write the reply: OpenAI, or Google Gemini if OpenAI is unavailable. (Anthropic is set up as a reserve but isn't in use.) Each request carries your new message and up to 19 earlier messages from the same conversation, so the reply follows the thread.

So that the answer applies to you, we also send the parts of your dietary profile that make it relevant: your allergens, dietary restrictions and nutrition goals. They go with the product you are asking about (its details, its score and the score adjusted for your profile) and the language your app uses. In current versions of the app, we also send the names and Cull scores of up to five products you scanned most recently. We never send your name, your email address, or any identifier of you or your device.

Your newest message is also checked by OpenAI's moderation service before we reply, to block abusive use.

We do not keep your conversations on our servers — they are stored on your device. The one exception is a message our abuse filter flags: we keep that message, shortened to 200 characters, together with the IP address it came from, for 7 days, so we can block repeat abuse.

AI Ingredient Analysis When you ask for an AI ingredient analysis or a "right for me?" verdict, we send the product's name and ingredients to Google Gemini. If you have set a dietary profile, we also send the product's nutrition, your allergens, restrictions and goals, and how the product matches them. We keep the result for up to 180 days so the next person who views the same product with the same dietary settings gets it straight away. It is stored against the product and a one-way code made from those settings, not against you or your device.

Apple Sign-In If you sign in with Apple, we receive an opaque identifier used to sync your data across devices and to secure your account. The first time you sign in, Apple may also give the app your name and email address (or a private relay address). The app keeps them on your phone only, to show them in Settings, and doesn't send them to us. The sign-in token our server checks includes your email address, but we read only your Apple identifier and don't store the email.

Subscriptions Payments are handled entirely by Apple, and we never see your card details. When you subscribe or restore a purchase, the app sends Apple's signed record of the purchase (the plan, its dates and transaction numbers) to our server to confirm your Pro access. We keep that confirmation, linked to your device, for up to 30 days, and a link between the purchase and your device for one year so that refunds and cancellations reach the right device. Whether you have Pro, and the steps of a purchase, are also recorded in analytics (see below).

Analytics & Crash Reports We use PostHog (hosted in the EU) and Google's Firebase Analytics to understand how the app is used, and Google's Firebase Crashlytics for crash reports. In plain words, analytics records which screens you open, what you tap and the barcodes you scan, so we can find what's broken and improve the app. Along with each action it can record:

• the barcode of the product involved and, in PostHog, the barcode of the product on screen at the time;
• where you tapped on a product page, and repeated taps on the same spot;
• whether you have Pro, and the steps of a purchase: the plan, the price and currency shown, and whether it went through;
• the month you installed Cull, your app version, and your country (the shopping country you chose, or the one from your location or phone settings);
• how many allergens, diets and goals you've set, whether a product fits them, and the result of an AI verdict (good, caution or avoid) — never which allergens, diets or goals they are;
• your device model, iOS version, language, time zone, screen size, whether you're on Wi-Fi or mobile data, and how the app is performing (for example launch time, freezes and memory use);
• an identifier created on your phone or, once you sign in with Apple, your opaque Apple identifier, so your activity is linked across your devices.

Analytics never receives your name or email address, your chat messages or the AI's replies, what you type into search (only how long it is), which allergens, diets or goals you've chosen, or your photos. Like any online service, PostHog and Google see your IP address when the app sends them data, and may use it to estimate an approximate location.

Analytics is on unless you switch it off in Settings → Data & Privacy → "Share anonymous usage analytics". Switching it off stops PostHog and Firebase Analytics on your phone, and stops the Apple Ads check described below. It doesn't delete what has already been sent, and our own servers still keep the basic usage counts listed under Data Storage & Deletion.

Crash reports are separate and stay on. When the app crashes or freezes, Crashlytics receives technical details (device model, iOS and app version, memory and network state), your device identifier (or your Apple identifier if you're signed in), and a short log of your recent actions in the app. That log can include the names and barcodes of products you scanned or viewed. It never includes your searches, your chat messages or your dietary profile.

Firebase is run by Google, which may process this data outside the UK, including in the United States. We don't use analytics or crash data for advertising, and we don't sell it.

Where you found us (Apple Ads) The first time you open a copy of Cull downloaded from the App Store, the app asks Apple whether the install came from one of our own Apple Ads. Apple's answer tells us which of our campaigns, ad groups, keywords and ads led to it, whether you tapped or only saw the ad, whether it was a first download or a re-download, the App Store country and, when Apple includes it, the date of the tap. This uses Apple's AdServices framework — not an advertising identifier — so there is no tracking prompt. Apple's answer doesn't name you, but we record it against your device like the rest of our analytics. We use it only to learn which of our ads work; it is never used to target ads at you. It goes to PostHog (EU) only, never to Firebase. Our server keeps Apple's answer for 30 days under a one-way hash of your device identifier, and deletes it if you delete your account. If you switch off "Share anonymous usage analytics" in Settings → Data & Privacy, the app doesn't make this check.

Community Submissions When you add a product, the photos and details you send go to our servers, are checked and processed, and, once approved, join the shared product catalogue (for photos, see Camera & Photos). With each submission we also store:

• your device or Apple identifier, and when you sent it;
• the app version and build, and whether your copy of the app came from the App Store or is a test version;
• your phone model and iOS version;
• whether each photo was taken in the app or picked from your photo library;
• the country where you were, when location is on (otherwise, the country your IP address points to — see Country Code);
• the IP address it came from;
• the results of our automatic checks for spam and inappropriate images.

Older versions of the app also sent your language and time-zone settings. A submission that is still waiting for review, or has been rejected, is deleted after 90 days. Once a submission is approved, its record, including the details above, is kept permanently, and the product, its photos and the country join the shared catalogue. Your identifier, IP address and device details are never shown to other users; they see the product, its photos and the countries where it is sold. How product data you add can be shared is set out in our Terms.

Corrections, Product Reports & Bug Reports If you suggest a correction to a product, we store what you send, including any note and photo, with your device or Apple identifier. Corrections waiting for review are deleted after 90 days; reviewed ones are kept, and correction photos are stored like submission photos. If you report a product, we keep the reason and any details you add, with your device identifier, for 180 days.

Bug reports aren't stored in our database. They go to the Telegram chat our team uses for alerts, together with:

• your device model, iOS and app version and language;
• whether you have Pro;
• your device identifier;
• a list of your last 20 actions in the app (such as screens opened, barcodes scanned and products viewed).

Short alerts about new submissions, corrections and reports go to the same chat: product names, barcodes and the first part of any note. So does the identifier of any device our checks suspend.

Keeping Cull Safe To stop spam, fake submissions and misuse of the AI features, our servers use your device identifier and the IP address of each request:

• Fair-use limits. We count requests per device and per IP address; the counts last between a minute and 24 hours.
• Submission checks. When you submit a product, we check whether many accounts are coming from one device, one IP address or one network-and-phone profile, and whether many people are submitting the same barcode. The profile is a short one-way code made from part of your IP address and the technical details your phone sends with each request, such as the app and iOS version and your language. These checks last 24 hours; their results, including the IP address, are kept with the submission.
• Blocked content. If our filters block a chat message or a photo, we keep the reason, up to 200 characters of the message (never the photo) and the IP address, for 7 days after the last block.
• Flags and suspensions. Repeated blocks can flag a device for review or suspend it, and we can also suspend an IP address or an account. Flags stay until we clear them. Suspensions last until we lift them, or for a period we set.

Our hosting provider also keeps request logs for a limited time, for troubleshooting; they include IP addresses and device identifiers.

What We Don't Collect

• Your precise location — the app asks Apple's location service which country you're in and keeps only the country code (see Country Code)
• Your name or email address — if Apple shares them when you sign in, they stay on your phone; we only have your email address if you write to us
• Payment information (subscriptions are handled entirely by Apple)
• Advertising identifiers, and we do not track you across other apps or websites
• Data from Apple Health / HealthKit, your contacts, or your browsing history

Sensitive Information & Your Consent

Your dietary and allergen information can reveal health-related details about you, so we treat it as sensitive. We only collect and store it after you choose to set up a dietary profile and give explicit consent, and only to personalise your scores, warn you about allergens and tailor AI answers when you use the AI features. You can change or delete it at any time, and you can withdraw consent by resetting your dietary profile in Settings; if you're signed in, that also clears the copy on our servers. We keep a record of when you gave consent (not the profile itself) for the periods listed under Data Storage & Deletion.

Allergen alerts are an aid, not a guarantee. Product data can be incomplete or out of date. Cull never tells you a product is "safe" — always check the actual product packaging before consuming, especially if you have a food allergy or intolerance.

Third-Party Services

• Cull API and website — our own backend and website, hosted by Vercel. Vercel also stores the photos you submit (Vercel Blob, in London) and counts website visits without cookies.
• Upstash — our database: products, submissions, and the data you sync when signed in. The main copy is in London; a read-only copy in Tokyo, Japan, keeps the app fast for people in Asia. Also a product-picture index, hosted in the EU, that holds nothing about you.
• Our own image-processing server (in the UK) — removes backgrounds from submitted product photos and checks them for inappropriate content. It receives the photos and the identifier of the person who submitted them, so we can act on abuse.
• Open Food Facts — the open product database. Our servers ask it for products by barcode and for search results, sending nothing about you. If our servers can't reach it, the app asks Open Food Facts for the product directly, and some product pictures load straight from its servers. Open Food Facts then sees your phone's IP address, as any website would, but none of our identifiers.
• Amazon Web Services and Turso — host our copy of the Open Food Facts database (in London and Ireland). Product data only.
• USDA FoodData Central — the US government's food database, which we may ask about some US and Canadian barcodes. We send only the barcode.
• Apple — authentication (Sign in with Apple), subscription and payment management, the location service that turns your rough location into a country, and, for copies of Cull downloaded from the App Store, install attribution for our own Apple Ads (see "Where you found us")
• Firebase (Google) — product analytics and crash reporting (no advertising; see Analytics & Crash Reports)
• PostHog (EU) — product analytics and Apple Ads attribution, hosted in the European Union (no advertising)
• OpenAI — writes AI Nutritionist replies. It checks chat messages, AI Vision photos and photos you submit for abuse, and reads photos when Google Gemini is unavailable. It receives the chat details described above, and never your name, email or any identifier of you or your device.
• Google Gemini — identifies products from AI Vision photos and reads and checks the photos and details you submit. It may look a product up on the web with Google Search using its barcode, name and brand. It also analyses ingredients, and writes AI Nutritionist replies when OpenAI is unavailable. When you have set a dietary profile, your allergens, restrictions and goals are sent so the answer applies to you; your name, email and identifiers never are.
• Anthropic (Claude) — a reserve provider for AI Nutritionist replies, not in use at the moment. If we switch it on, it will receive the same chat details as OpenAI.

Our AI providers are US companies and process requests outside the UK, including in the United States.

Where Your Data Is Stored

Our main database (Upstash) and the photos you submit (Vercel Blob) are in London, and most of our servers run there too. A read-only copy of the database — including the data you sync when you sign in — is kept in Tokyo, Japan, so the app responds quickly for people in Asia. Some parts of the service that need to answer quickly, including AI chat, profile sync and search, run on Vercel's network at the data centre nearest to you. So a request may be handled outside the UK before it reaches our London database. Photos you submit are also processed on our own image-processing server in the UK.

Some services we use are based elsewhere:

• PostHog analytics is hosted in the EU.
• Firebase (Google) and our AI providers process data outside the UK, including in the United States.
• Telegram, which carries our team's alerts, may store them outside the UK.
• Pages of our website may be served from Vercel data centres in other countries, including the United States.

Where your data leaves the UK, we rely on appropriate safeguards for these transfers.

Data Storage & Deletion

Your scan history, favourites and dietary profile are stored on your device, and on our servers only when you sign in with Apple. Products, corrections and reports you send are always stored on our servers — that's how the shared catalogue works.

You can clear your local history, favourites, and dietary profile anytime in Settings. Signing out also clears your history, favourites, dietary profile and AI chats from that phone.

If you're signed in with Apple, you can delete your account in Settings or by contacting privacy@getcull.com. If you haven't signed in, email privacy@getcull.com with the Device ID shown in Settings → About and we'll delete your data in the same way. When you delete your account:

• your synced history, favourites, dietary profile and settings, and the lists of your submissions, corrections and reports, move to a locked archive for 30 days so we can restore an account deleted by mistake, and are then erased;
• your Apple Ads record is erased straight away;
• we keep a record that you consented to us storing your dietary profile, and when, for 7 years — never the profile itself;
• products you added stay in the shared catalogue with their photos. Those records keep the identifier and details they were sent with, which are never shown to other users. To have a particular photo or submission removed, email privacy@getcull.com;
• your device's registration with our servers, and its link to your Apple identifier, are kept.

Deleting your account doesn't automatically remove analytics and crash data already sent to PostHog and Firebase. Email privacy@getcull.com if you'd like that removed too.

How long we keep data

On your phone, until you clear it, sign out or delete the app (unless noted):

• Scan history (free accounts show the last 30 days, but earlier scans stay on the phone)
• Favourites and your dietary profile
• Your last five searches; search results are cached for 1 hour
• AI Nutritionist chats, until you clear them (older versions of the app keep only the last 50 messages of the current chat)
• Unfinished product submissions: 7 days
• Product details cached for speed: up to 7 days
• Your country code: until you turn off location access

On our servers:

• Scan history (only if you sign in): 90 days after your last sync
• Favourites (only if you sign in): 1 year after your last sync
• Dietary profile and settings (only if you sign in): 1 year after your last change
• Record of your dietary consent: 1 year after your last consent change; after you delete your account, 7 years (no health data)
• Deleted-account archive: 30 days, then erased
• Approved submissions, with their photos and details: permanently, as part of the catalogue
• Submissions waiting for review, or rejected: 90 days (a rejected submission's photos are deleted when we reject it)
• Photos from a submission you didn't finish, or one that expired while waiting: not deleted automatically
• Corrections: 90 days while waiting for review; kept once reviewed, with any photo
• Product reports: 180 days
• Your "I can confirm these ingredients" taps: kept with the product, with your device identifier
• Blocked chat messages and photos (the reason, up to 200 characters of a message, and the IP address): 7 days after the last block
• Anti-abuse checks: 24 hours (their results stay with the submission)
• Fair-use counters: up to 24 hours
• Flags and suspensions: until we clear or lift them
• Daily records of which devices and accounts used Cull: 90 days
• Counts of your activity (for example how many products you've scanned or submitted): until you delete your account
• Your device's registration, and its link to your Apple identifier if you signed in: kept, including after you delete your account
• Apple Ads answer: 30 days
• Subscription confirmation: up to 30 days; the link between a purchase and your device: 1 year
• AI ingredient analyses: 180 days, not linked to you
• Search terms: counts of the 1,000 most-used terms, with no link to you and no time limit
• Bug reports: not in our database; they stay in our team's Telegram chat

Our Website

getcull.com has no accounts, sets no cookies and has no forms that collect personal details. Our website counts visits, and taps on its App Store buttons, with Vercel Web Analytics, which sets no cookies and stores nothing in your browser. Our App Store links carry a campaign tag: the part of the site you tapped and, if you arrived through a campaign link, that campaign's name, which is also added to the tap we count. This lets us see downloads per campaign in Apple's aggregated App Analytics. So that Back and Forward return you to the same place on a page, the site remembers how far you had scrolled, in that browser tab only, until you close it; this never leaves your device. Fonts are served from our own site. Pages are served by Vercel, whose servers may be outside the UK, including in the United States. When you open this policy in the app, it is loaded from our website. If you email us, we use your email address only to deal with your message.

Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, contact privacy@getcull.com. If you're unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ico.org.uk), the UK's data protection regulator, or to the data protection authority where you live.

Children's Privacy

Cull does not knowingly collect information from children under 13. The app is intended for general audiences making grocery shopping decisions.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted within the app and at getcull.com/legal/privacy with an updated date.

Contact Us

If you have questions about this privacy policy, contact us at:

Homespect Ltd (trading as Cull) Email: privacy@getcull.com

© 2026 Homespect Ltd. All rights reserved.