Privacy Policy

1. No account, no identifier

Lanatag asks for no sign-up, no email address and no password. The app creates no identifier to track you and uses no advertising tools. Our service counts readings, and the app sends anonymous usage statistics; neither carries an identifier. Both are described in section 3. The lanatag.com website is covered separately, in sections 9 and 10.

2. What stays on your phone

This data never leaves your device, except in the case described in section 3:

• your profile: first name if you enter one, allergens, diet, pregnancy if you select “Mum-to-be”, spice tolerance;
• your reading history and the corresponding photos;
• your calorie cap, which is never sent to the server;
• your remaining readings, free and purchased, and the identifiers of purchases already credited, provided by the store, which ensure the same purchase is never credited twice;
• your appearance and language preferences.

Photos are excluded from automatic cloud backup. They are included in a direct device-to-device transfer.

3. What is sent for a reading

Nothing is sent without your consent. Before your first reading, the app shows a sheet that says what is sent, to whom, and what is not. Until you tap “I agree”, no reading is sent. You can withdraw that consent at any time from the Profile screen, with “Withdraw my consent”: the sheet will be shown again at your next reading.

Photo of a menu or label: the app sends the photo and your food profile (allergens, diet, pregnancy if you have indicated it, spice tolerance) to our service, which passes them to Anthropic's analysis model to produce the result.

Barcode: our service queries a public product database with the barcode alone. It then sends Anthropic the product's ingredient list and your food profile.

No identifier accompanies that request — no name, no email, no device number. We cannot link two readings together, nor attach them to a person.

Our service never keeps your profile. It does not keep the photo either, unless, from version 1.5.0, you turned on the "Help improve Lanatag" option described below and the reading is refused. Otherwise, the photo and profile are used for the duration of the analysis, then gone.

"Help improve Lanatag" option (optional, off by default, from version 1.5.0 of the app). Earlier versions do not offer this option and keep no photo. If you turn it on, on the sheet that follows the consent or in the Profile screen, and a reading is refused because the photo is neither a menu nor an ingredient list, or its text is unreadable, our service keeps a copy of that photo for 30 days, to understand why and improve reading. Only these refused photos are kept: never a successful reading, never a barcode. The copy is stored without its metadata (location, device, date taken: our service removes them), without your profile and without any identifier. It carries only the type of reading, the reason it was refused, the country, the app version and the day; we do not record the time (our host technically logs the moment of upload, which we do not use). It is stored with Cloudflare (R2), in the European Union, and deleted automatically after 30 days; it is not kept beyond that in any form. Only the Lanatag team looks at it: it is never published, sold, shared or used to train a model. Please avoid showing people in it. Legal basis: your consent (Article 6(1)(a) GDPR). Saying no changes neither reading nor your subscription. You can turn the option off at any time in the Profile screen: no further copy is made, and copies already kept are deleted at most 30 days after upload. As nothing links them to you, we cannot find them to delete them sooner.

What we count. We count readings, to know whether the service works well. For each one, the server notes its type (menu, barcode or label), whether it went through or the cause of the failure (for example "not a menu", or an outage of the analysis service), which analysis service handled it, how long the processing took, the country it comes from and the time. The country is worked out from the connection by our host, Cloudflare. Your IP address is not recorded. This count contains no photo, no profile and no identifier: nobody can tell who made a reading, or link two readings together. These lines are deleted after three months. Legal basis: our legitimate interest in running the service (Article 6(1)(f) GDPR).

Usage statistics (from version 1.5.0). To understand how the app is used and to improve its screens, especially the subscription screen, the app sends a short anonymous message when certain steps happen: first launch, end of the introduction, reading started, completed or refused (with its type and, for a refusal, the reason), last free reading used, waiter card shown, order shared, report sent (with its reason, without its content), subscription screen shown or closed (with what opened it, the plan viewed, the reading rank, a range of pack balance and a range of duration), plan selected, purchase started, completed, cancelled or failed, purchases restored. Each message carries only the name of the step, these values taken from fixed lists, the language of the app, the country set on your phone, the system (iOS or Android) and the version of the app. It never contains a photo, text that was read, a comment, anything from your profile (allergens, diet, pregnancy, calorie ceiling), or the amount or number of a purchase. No identifier: each message receives a random number used for that message only. The one exception: while the subscription screen is open, its steps share one random number, kept in memory and forgotten when the screen closes; it never links two openings together. For these statistics, the app stores only two markers on your phone ("first launch already reported", "last free reading already reported"), so that they are sent only once. We therefore cannot tell who sent a message, or rebuild your path through the app. We only read totals from them, and we do not combine them with any other data.

These messages are received by PostHog (PostHog, Inc., United States), which acts on our behalf as a processor, on its servers in Frankfurt (Germany). Your IP address, which every connection transmits, is not kept: PostHog discards it on receipt, and no location is derived from it. As PostHog, Inc. is established in the United States, its data processing agreement relies on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses. These messages are deleted no later than 25 months after they are sent. Legal basis: our legitimate interest in measuring how the app is used and how well its screens work (Article 6(1)(f) GDPR). This is audience measurement carried out for us alone, which the CNIL exempts from consent. To object: Profile › "Anonymous statistics". Once it is turned off, the app sends none of these messages. Messages already sent carry no identifier: we can neither find them nor delete them one by one.

Anthropic processes this data on our behalf, as a processor, with protection at least equal to that described here. It deletes the data it receives within 30 days and does not use it to train its models (retention, training). Anthropic is based in the United States: sending a reading is therefore a transfer of data to the United States.

Report an error (from version 1.5.0). From a result, "Report an error" lets you tell us that a reading looks wrong. Nothing is sent until you tap "Send". The report contains the reason you chose (missing or wrong allergen, diet, pregnancy, translation, other) and its detail (for example the allergen or diet concerned), the item as Lanatag displayed it, the context of the reading (type, language and country of the menu, language of the app, system, version), the barcode if there is one, your comment if you write one, and the photo of the reading only if you tick "Attach the photo" (unticked by default). It contains neither your full profile, nor a name, nor an identifier, and your IP address is not recorded. Because the detail may reveal one of your allergens, your diet or your pregnancy, sending it relies on your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR), given by tapping "Send". Do not write your name or anything that could identify you in the comment, and avoid photographing people.

Checking. When the reason concerns safety (allergen, diet, pregnancy) and a source is available (the attached photo, or the product record for a barcode), our service has the reading checked straight away by an Anthropic model. It sends the source, the displayed item, the reason, your comment and, instead of your profile, only the point you reported. Anthropic acts as a processor, in the United States, under the conditions described above (deletion within 30 days, no training). In countries where Anthropic's service is not available, the report is kept without being checked.

Retention. The report, the result of the check and the attached photo are kept for 30 days to correct the reading, then deleted automatically. They are stored with Cloudflare, in the European Union; the photo is stored without its metadata. We record the day, never the time.

Sending limit. To prevent abuse, the app draws a random token each day, kept on your phone until the next day, and attaches it to your reports. Our service keeps only a fingerprint of it and the number of reports that day (five at most per device), deleted the next day; this fingerprint is not recorded with the report. Legal basis for the token: our legitimate interest in protecting the service against abuse (Article 6(1)(f) GDPR). You can withdraw your consent for future reports by not sending any more. A report already sent carries no identifier; to have it deleted before 30 days, write to support@lanatag.com with the day, the reason and the product or dish.

Purchases. The subscription and the reading pack are bought from the App Store or Google Play. The store processes the payment and your payment data, under its own privacy policy: we receive neither your name, nor your payment details, nor your purchase history. The app reads on your phone the confirmation provided by the store, to open the subscription or credit your readings. Your reading balance and your purchase identifiers stay on the phone (section 2): none of this is sent to our service, and a reading does not tell it whether you subscribe or what it is counted against.

4. Health data

Your allergens, your diet and, if you indicate it with “Mum-to-be”, your pregnancy are sensitive data under Article 9 GDPR. Your allergens and your pregnancy are health data. You enter them yourself, and they stay on your phone. Sending them for a reading relies on your explicit consent (Article 9(2)(a)), given in the sheet described in section 3 before your first reading. You can withdraw it at any time from the Profile screen, with “Withdraw my consent”: no reading is sent again without new consent. You may also change or erase this data at any time from the Profile screen.

5. Permissions requested

• Camera: to photograph a menu or a label.
• Photo library: only if you pick an existing image. The app accesses only the one you select.

Lanatag requests no location, no contacts, no calendar and no fitness data.

6. Your rights

GDPR grants you rights of access, rectification, erasure, restriction, objection and portability. For the app these are exercised directly on the device, since we hold nothing that could identify you: the Profile screen lets you change or erase your data, and uninstalling the app removes all of it. Photos kept with the "Help improve Lanatag" option carry no identifier: we cannot link them to you, and they delete themselves after 30 days. Usage statistics and reports carry no identifier either. You can object to usage statistics at any time in Profile › "Anonymous statistics". For the waiting list, see section 9.

You may lodge a complaint with your national data protection authority — in France, the CNIL (cnil.fr).

7. Children

Lanatag is not intended for children under 13 and knowingly collects no data about them.

8. Publisher and contact

Lanatag is published by One Ace Studios.
Questions: support@lanatag.com

9. The website waiting list (closed)

The lanatag.com waiting list has been closed since 12 October 2026: Lanatag is available on the App Store and on Google Play, and the form has been removed from the site. One single exit message is sent to the people who had confirmed their sign-up (confirmation by email), and their address is then deleted. A sign-up that was never confirmed is erased after seven days. We have sent, and will send, nothing else: no newsletter, no reminder. While you were signed up, we kept the address with the site language and, if you came through a dedicated link, a word naming where it came from (for example "tiktok"). Purpose: to tell you on release day. Legal basis: your consent, Article 6(1)(a) GDPR. Retention: until the exit message is sent, then deletion, and at most twelve months from sign-up. That message carries an unsubscribe link, and a request to support@lanatag.com is enough to have it erased at once.

Waiting-list processors. The address is stored in a Cloudflare D1 database (Cloudflare, Inc., United States), placed in Western Europe, and the exit message is sent by Resend (Plus Five Five, Inc., United States). Both act on our behalf, as processors. Resend processes data in the United States, so sending is a transfer to the United States; Cloudflare, Inc. is established in the United States, so the same safeguard applies to the database. According to their data processing agreements, these transfers rely on the EU-U.S. Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses.

The app itself never asks for an email address. The two are unrelated: nothing connects a waiting-list sign-up to a reading made in the app.

10. Website analytics

lanatag.com uses Cloudflare Web Analytics, which sets no cookie, creates no identifier and follows nobody from one site to another. We read totals from it — visits, pages viewed — never an individual's behaviour. The app's statistics (the reading count and the usage statistics handled by PostHog) are described in section 3.

The page that leads to the stores. When you open lanatag.com/app, for example from an ad on Facebook or Instagram, our service counts each step on the way to the App Store or Google Play: arriving on the page, the intermediate page being shown, tapping the store button or the fallback link, the redirect. Each step adds one line to our statistics: the step, the campaign the link came from (for example “fb-halal”), the type of device (iPhone, Android or other), the app in which the page opened, if any (Facebook, Instagram, Messenger or TikTok), the version of the page and the time. This count sets no cookie and stores nothing on your device. Neither your IP address nor the full description of your browser is recorded. These lines contain no identifier: they cannot tell who went through the page, or link two visits together. We only read totals from them. They are kept by our host, Cloudflare, acting on our behalf (see section 9), and deleted after three months. Legal basis: our legitimate interest in measuring how well our ads work and whether this page works properly (Article 6(1)(f) GDPR).

One cookie only: your language. When you pick a language in the site's selector, lanatag.com saves that choice in a cookie named lang (the language code, for example fr), valid for one year. It is used only to open the site in the language you chose. It holds no identifier, is read only on the home page, and is never used for analytics or passed to a third party. It is an interface preference you asked for, so it needs no consent. Delete it in your browser settings whenever you like.