Honto Privacy Policy

Last updated: 21 October 2026

Honto scans food and cosmetic products and shows you a transparent health score. Your health profile is deeply personal, and this policy explains exactly what stays on your device, what reaches our servers, and what becomes public. Where we say something is not stored, we mean it literally.

1. Information Stored on Your Device

The following is stored only in your device's local storage and is never saved on our servers. Where part of it travels with a request, this says so:

• Your body profile (weight, height, age, sex). When you ask for a product comparison, the daily nutrition targets calculated from it are sent with that request (see section 3); the measurements themselves are not.
• Your dietary preferences, cosmetic sensitivities, allergens, and skin or life-stage profile (for example, pregnancy). Allergens, diet, and cosmetic sensitivities are sent with an AI note request (see section 3); your skin and life-stage profile never is.
• Your scan history (Journal) and favorited products.
• Your personal Google Gemini API key, if you choose to provide one.

Cookies: Honto does not use tracking or advertising cookies. The app uses your device's local storage only for the items above and to keep you signed in to your session. No third-party trackers are embedded.

2. Your Account

Honto creates an anonymous account for your device the first time you open the app. It has no name, email address, or any other identifying detail — it exists so that we can apply fair usage limits to AI features and attribute contributions to the shared catalog. You do not sign up for it and you cannot be identified by it.

You may optionally upgrade to a permanent account with an email address and password, or with Sign in with Apple or Google. If you do:

• We store your email address (with Sign in with Apple, this may be an Apple private relay address). With Google, our sign-in provider also keeps the name and profile picture Google shares with it; Honto does not use or show them. We never see your password in readable form.
• Your existing anonymous account is upgraded in place, so activity already linked to your device remains linked to you.
• Your on-device health profile stays on your device. Creating an account does not upload it.

3. How We Process External Data

• Public databases: When you scan a barcode, the barcode number is sent to our server, which looks it up in our catalog and in Open Food Facts, Open Beauty Facts, or USDA to retrieve ingredients and nutrition data.
• AI insights: When you request an AI "Wise Note" or a product comparison, the product's ingredients and relevant parts of your profile (allergies, diet, and cosmetic sensitivities for a note; daily nutrition targets for a comparison) are sent to Google's Gemini API to generate the answer. Your profile is used for that one request and not stored. Notes generated without any profile information are cached per product and shown to every user who scans it; they contain nothing about you. Google processes this as our service provider and does not use it to train its models.
• Label reading: When you photograph an ingredients label for the AI to read, the image is sent to Google's Gemini API (or, if Gemini cannot answer, to OpenAI's API) for text extraction and then discarded — it is never saved. Only the extracted text is kept.
• Crash reporting: If the app crashes or hits an error, a report is sent to Sentry containing the error, where in the code it happened, and the device model and OS version. It carries no account identifier, no health profile, and nothing you scanned.
• Push notifications: If you allow notifications, your device's push token is stored with your account so we can send them. Turning notifications off or erasing your data removes it.
• Subscriptions: If you subscribe to Honto Plus, Apple processes the payment and RevenueCat manages the subscription. They tell us only which plan is active and when it renews or expires, tied to your account identifier. We never see your payment details.

4. Contributions to the Public Catalog

This section describes the only data you can make public, so please read it before contributing.

If you add a product that is missing from our sources, or improve an existing entry, the product details you confirm — name, brand, ingredients, and nutrition values — are saved to a shared catalog visible to all Honto users, keyed to the product's barcode.

If you also take a separate front-of-pack product photo, that photo is uploaded to public storage (Cloudflare R2) and becomes the catalog image for that product. It is publicly accessible to anyone with the link. This is deliberate and distinct from the label photo described above, which is never stored. Please photograph only the product packaging — never yourself, other people, or your surroundings.

Contributions are published without your name or email attached, though they remain linked to your account internally so we can review and correct submissions.

5. Analytics and Usage Data

We record basic product usage events — app opened, product scanned, favorited or reported, a screen viewed (including the Honto Plus screen), products compared, an AI note viewed or failed, a subscription started or restored — to understand what works and what breaks. Scan events include the barcode and product name. These events, together with your device model, operating-system version, app version, and a country derived from your time zone (not your location), are linked to your account identifier. You can turn analytics off in Settings. They do not contain your health profile or your body measurements, and we do not use them to build a profile of you or share them with advertisers.

We also record a count of your AI requests in order to apply usage limits and monitor costs.

6. Legal Basis and Retention

Where the GDPR applies, we process account and usage data on the basis of our legitimate interest in operating and improving the app, and process contributions on the basis of your consent, given by submitting them. Account and usage data are kept until you ask us to delete them. Catalog contributions may be retained after account deletion, since other users rely on them, but they are not identifiable as yours.

7. Your Rights and Deleting Your Data

You can delete your data yourself, from inside the app, at any time:

• "Clear scan journal" in Settings removes your journal from the device.
• "Erase all my data" in Settings deletes everything: your on-device data and your server-side account with all rows linked to it (usage events, AI usage counters, profile). This works for anonymous sessions too.
• "Delete account" in Settings (shown when you are signed in) permanently deletes your account — including your email address and sign-in identity — and all server-side data linked to it. This is immediate and cannot be undone.

Catalog contributions may be retained after account deletion, since other users rely on them, but the link to your account is destroyed and they are not identifiable as yours.

You may also request a copy of your data, or ask us to delete it, by contacting us at the address below. We will respond within 30 days. If you are in the EU or UK, you also have the right to object to processing and to complain to your national data protection authority.

8. Children

Honto is not directed at children under 13, and we do not knowingly collect their data.

9. Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify you within the app.

Contact

For any privacy question or request, email [email protected].