What happens when you scan an ingredient label?
Ingredio needs enough information to turn visible package text into a structured result. This page explains the path in everyday language; the full Privacy Policy remains the controlling disclosure.
OCR starts locally
Your iPhone first attempts to recognize the text in the label photo.
Recognized text is sent
The recognized text and selected display language are sent to Ingredio’s service to structure the result and provide references.
A compressed image may be sent
This happens only when on-device OCR confidence is very low and image-assisted processing is needed.
Your Watchlist is matched locally
Personal Watchlist keywords are not included in the ingredient-processing request.
Does Ingredio upload every label photo?
No. OCR begins on your device. A compressed label image may be sent for image-assisted processing only when on-device OCR confidence is very low.
What may be sent for a barcode scan?
If a barcode is detected, the app may query Open Food Facts and send the returned product name, ingredient list, nutrition, and reference fields to Ingredio’s processing service as context.
Where is scan history stored?
Scan history, saved product labels, scan images, Watchlist choices, and results are stored locally on your device. The application database does not persist OCR text, barcode context, or a label image after the processing request completes.
Does Ingredio use advertising tracking?
No. Ingredio does not use advertising SDKs, cross-app tracking, or third-party product-analytics SDKs, and does not sell personal information or share scan content for advertising.
What account and service data is retained?
Ingredio retains the account identifier, optional email address, authentication and device/session information, subscription state where applicable, and per-account usage counters needed for app functionality, service security, and abuse prevention.
Can I delete my account?
Yes. Use Settings → Delete Account. You are signed out and the account is marked for deletion. A grace period of up to 30 days is used to prevent quota abuse and allow restoration if you sign in again; after that period, associated server database records are deleted as described in the Privacy Policy.