Privacy policy

Effective 23 October 2026 · 中文版

In short

• Your health profile stays on your phone. Personal (“For you”) scores are worked out on the phone, and our servers never receive your profile.
• No sign-up needed. You only sign in with Apple or Google to claim rewards for contributions and invitations.
• Photos are uploaded only when you choose to add a product and agree in the app.
• No ads, no selling of personal information, no tracking across other apps or websites.

1. Who we are and what this covers

Gotcha (查明白 in Chinese) is an iPhone app that helps you understand products sold in New Zealand and Australian supermarkets. It is run by Limeng Wang, an independent developer, at 48A Seaview Road, Glenfield, Auckland, New Zealand. “We” in this policy means that developer, who collects and holds the information this policy describes.

This policy explains how we collect, use, store and share personal information in the Gotcha app and on chamingbai.com. We handle your information in line with the New Zealand Privacy Act 2020 and its information privacy principles. If you use Gotcha in Australia, we also handle your information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.

Privacy Officer: support@chamingbai.com

2. Information we handle

2.1 Health profile: on your phone only

In the app you can record allergens, intolerances, special situations (such as pregnancy, breastfeeding, or shopping for a child or an older adult), health goals and a reference standard. This information:

• is stored in this iPhone's keychain, set to “this device only”, so it isn't included in iCloud backups and doesn't move to a new phone with a backup;
• is used only to work out personal scores and alerts on the phone;
• is never sent to our servers, and we can't see it.

If we ever offer syncing between devices, we will update this policy first and ask for your consent before you turn syncing on.

2.2 Scan history and saved products: on your phone

Products you scan and save are kept on your phone; the free plan keeps your latest 20 scans. To look up a product, the app sends its barcode to our server to get the product information. We don't keep a record of what each person scans.

When you scan, the camera image is used on the phone to read the barcode and is not uploaded.

2.3 Product region (New Zealand or Australia)

When the app first opens, it works out on the phone, from the time zone and region settings, whether to show New Zealand or Australian supermarket products; you can also choose under Me. That happens on the phone only. After that, lookups, searches, contributions and feedback include the country you chose, so we can answer with that country's products. We don't collect your location.

2.4 Device ID

The app creates a random ID on your phone and sends it with lookups and contributions. It isn't your phone's serial number or its advertising identifier (IDFA). We use it to keep track of contributions and rewards from guests, to apply the free plan's limit of 10 contributions a day, to stop the same device claiming an invitation reward twice, and to fix problems.

2.5 Account (optional)

You can scan, view products and add products without signing up. When it's needed (for example before you buy Premium), the app creates an anonymous guest account that holds no name or email address.

If you choose to sign in with Apple or Google (you need to when claiming rewards for contributions and invitations), we receive and store:

• the name, email address and profile picture link (if any) that Apple or Google provides. If you use Apple's Hide My Email, we receive Apple's relay address instead;
• the account ID and sign-in credentials needed to sign you in;
• session records, including IP address and device type, to keep you signed in and prevent abuse.

We never receive your Apple or Google password. If you sign in with Apple and with Google using the same email address, the two become one account.

2.6 Purchases and Premium

Subscriptions and lifetime Premium are paid to Apple. We, and RevenueCat, which manages subscriptions for us, receive purchase records (which plan, when it was bought and when it ends, whether it's in a free trial, whether it comes through Family Sharing) and your user ID, to confirm whether you have Premium. We never receive your card or other payment details.

2.7 Product photos: only when you choose to add a product

When a scan finds nothing, or a product is missing information, you can photograph the front of the pack, the ingredient list and the nutrition panel to add it. Before your first contribution, the app explains who the photos go to and why, and uploads them only after you agree.

• Photos are kept in our private storage on Cloudflare R2 and are not public.
• Photos are sent to third-party AI services to read the text on the pack: normally Anthropic's Claude (inference in the United States only); when it is unavailable, Alibaba Cloud Model Studio (data stored in its Singapore region). Both say they don't train models on your photos and delete them within 30 days (content their safety systems flag may be kept up to 2 years). They are outside New Zealand and Australia and may not be required to protect the information with safeguards comparable to the New Zealand Privacy Act 2020 or the Australian Privacy Act 1988.
• You check what was read, and then it's reviewed: by us, or automatically when two people's submissions for the same product match.
• Approved product information (name, brand, size, ingredients, allergen statement and nutrition) is published for all users. The front-of-pack photo is cut out automatically by Cloudflare (background, hands and people removed) and checked by Cloudflare's AI model for any person or hand left in it; only images that pass are published as the product image. The original photos are never published.
• For each contribution we record the barcode, the country you chose, when it was sent, the device ID, the account (if any), the version of the explanation you agreed to, the review result and the reward status.

Please photograph only the pack: no faces, other people or personal information. You can ask us to delete the photos you have sent at any time.

2.8 Invitations and rewards

If you join through an invitation link, we record the invitation code, your account and the inviter's account, and your device ID, to give both of you Premium days and to make sure each device claims only once. Reward records (days, where they came from, status and validity) are kept with your account or device ID.

2.9 Feedback and email

When you report a problem or send feedback in the app, or email us, we keep what you wrote, the barcode it's about, and your account, device ID or email address, so we can deal with it and reply. Please don't include health information we don't need.

2.10 Crash reports

When the app hits an error, it sends the device model, iOS version, app version and technical details of the error to Sentry so we can fix it. Crash reports don't include your health profile.

2.11 Anonymous usage statistics

To understand how people use the app and what to improve, the app sends some actions to our server as anonymous events. For example: opening the app; whether a scan found the product (for products we don't have, the barcode is included so we can add their data first); which kind of product you viewed; how many results a search returned (not the words you searched for); whether you saw the Premium page and how a purchase went; whether sign-in worked; and how far you got with a contribution. Each event carries the app version, the app language, the country you chose, the iOS version and a randomly generated install ID.

The install ID is used only for these statistics. It is not linked to your account, your device ID (2.4), your contributions or your feedback, and a new one is made if you reinstall the app. Usage statistics never include your health profile, the “For you” verdict, allergens, the words you search for, account details or your location.

2.12 Search

When you search for products, the words you type are sent to our server to get results, and appear in our short-lived server logs (see 2.13).

2.13 Server logs

Like most online services, our servers (hosted by Cloudflare) briefly log IP addresses, times and the addresses requested, for security and troubleshooting.

2.14 What we don't collect

• Your location, your contacts, or any photos in your library other than those you pick for a contribution.
• Your advertising identifier (IDFA). We don't track you across other apps or websites.
• Card and payment details (Apple handles payment).
• Your health profile (it stays on your phone).

3. How we use it

• To provide the app: looking up and translating products, contributions, Premium and rewards.
• To prevent abuse, such as enforcing the free contribution limit and stopping reward farming.
• To keep the service secure and fix problems.
• To learn from anonymous usage statistics how the app is used, so we can improve it and add missing products.
• To reply to your feedback and requests.
• To meet legal obligations.

We don't use personal information for advertising, we don't sell or rent it, and we don't use it for anything beyond the purposes above.

4. Service providers and overseas storage

We give the providers below only what they need for their part of the service. All of them are outside New Zealand and Australia, where privacy laws may differ. We take reasonable steps to require them to protect your information to the same standard as this policy, or an equivalent one.

Otherwise, we give information to government agencies only when the law requires it (for example, a court order). If we move Gotcha into a company we set up, your information moves with it and stays covered by this policy.

5. How long we keep it

We keep personal information only for as long as we need it:

6. Security

• All connections between the app, the website and our servers use HTTPS.
• Your health profile is stored in the iPhone keychain and can only be read while the phone is unlocked.
• Contribution photos are kept in private storage that only reviewers can see.
• Server logs never contain health profiles or photo content.
• The admin console is limited to authorised administrators.

No system is perfectly secure. If a privacy breach happens that is likely to cause serious harm, we will notify the people affected and the New Zealand Office of the Privacy Commissioner as soon as practicable, as the Privacy Act 2020 requires. Where Australian users are affected and the Australian Notifiable Data Breaches scheme applies, we will also notify them and the Office of the Australian Information Commissioner (OAIC).

7. Your rights and choices

• Access: you can ask to see the personal information we hold about you.
• Correction: you can ask us to correct information that is wrong.
• Delete your account: on the Me page in the app. We then delete your account details, sign-in records, Premium records, reward records and invitation code, and your contributions are no longer linked to you; published product information stays. To prevent double claims, invitation records are kept without your account details.
• Delete contribution photos: email us and we will delete the photos you sent.
• Withdraw consent: turn off camera access in your iPhone's Settings at any time. If you stop contributing, no more photos are uploaded.
• Information on your phone: your health profile, scan history and saved products are in your hands; change or delete them at any time.

For access, correction or other requests, email support@chamingbai.com. We may need to confirm your identity first, and we will respond within the time the law allows (no later than 20 working days).

8. Family members and children

Premium members can create profiles for family members, such as children or parents. Like your own profile, family profiles stay on your phone. Before you record a family member's health information, please tell them, and explain that it stays on your phone and is used to check whether products suit them.

Gotcha isn't designed for children to use on their own. We don't knowingly collect personal information from children; if you think a child has given us personal information, contact us and we will delete it.

9. This website

chamingbai.com uses no cookies and loads no third-party analytics, ads or fonts. Like the app's servers, the website is hosted by Cloudflare, which briefly processes visitors' IP addresses for security and delivery.

10. Changes to this policy

We may update this policy. We will give notice of significant changes in the app or on this website before they take effect; the date at the top shows the current version.

11. Contact and complaints

For questions about this policy or your information, contact our Privacy Officer: support@chamingbai.com.

If you're not satisfied with our response, you can complain to:

• in New Zealand, the Office of the Privacy Commissioner: privacy.org.nz;
• in Australia, if we haven't resolved your complaint within 30 days, the Office of the Australian Information Commissioner (OAIC): oaic.gov.au.