The data controller is Rafał Jaworski, trading as PapaRaf Hub, a sole trader based in Shepton Mallet, England, United Kingdom. Privacy contact: support@honestscan.app.
HonestScan is designed so that image analysis happens entirely in the User's own browser. Label photos, and the text recognised from them, are never uploaded to, or stored on, any server operated by the Provider or third parties. A photo only leaves the User's device if the User chooses to share it outside the App.
The App stores the selected mode (food/pets) and pet species (dog/cat) locally in your browser. This data is not sent anywhere. If you activate the Full Version, the App also stores your licence key, the signed activation token and a random device identifier locally (see section 3).
If a User purchases the Full Version, the data needed to process the transaction (e.g. email address, payment details) is handled by the external payment provider Payhip, acting as an independent controller/processor under its own privacy policy. The Provider only receives the information needed to deliver and check the Licence Key (e.g. email address, transaction status).
Licence key activation. When you enter your licence key, the App sends the key and a random device identifier (generated by the App, not linked to your hardware) to the Provider's server (a Netlify function). The server asks Payhip whether the key is valid and stores only: a one-way hash (SHA-256) of the key, the random identifiers of up to 3 activated devices and the activation date. It does not store the key itself, your name, email address or IP address. The purpose is to apply the 3-device limit and to switch off refunded keys; the legal basis is performance of the contract (Art. 6(1)(b) GDPR / UK GDPR). Your IP address is used only briefly to limit the number of attempts (protection against guessing keys): it is kept as a salted hash that changes every hour and is deleted after a few hours. Once a week, when online, the App checks the key again in the same way.
4.1. If a User voluntarily signs up to our email list (e.g. to receive a free resource), the email address provided is processed to: a) deliver the requested resource, and b) send marketing and informational content about the App, where the User has given separate consent.
4.2. The legal basis for this processing is the User's consent (Art. 6(1)(a) GDPR / UK GDPR), obtained through a double opt-in mechanism – an address is only added to the list after the sign-up is confirmed via a verification email.
4.3. Sign-ups and email delivery are handled via the systeme.io platform, which acts as a data processor on the Provider's behalf under a data processing agreement.
4.4. Data is retained until consent is withdrawn (unsubscribing) – an unsubscribe link is included in every email.
4.5. Consent can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
We use GoatCounter, a privacy-friendly statistics service, to count visits and clicks on the unlock button. GoatCounter does not use cookies and does not store information that identifies you (such as your IP address). We do not use advertising trackers. The App never sends the contents of your scans, photos or licence keys to GoatCounter.
Data may be shared with providers supporting the App: Payhip (payments), systeme.io (email delivery), Netlify (hosting) and GoatCounter (anonymous visit statistics) – only to the extent necessary for their function, under agreements with each of them.
You have the right to access, rectify, erase, and restrict processing of your data, to data portability, to object, and to withdraw consent at any time. To exercise these rights, contact: support@honestscan.app.
You have the right to lodge a complaint with a supervisory authority – in the United Kingdom, this is the Information Commissioner's Office (ICO); EU residents may also contact their local data protection authority.
Transaction data is retained for as long as required by law (e.g. tax obligations). Marketing data is retained until consent is withdrawn. Licence activation records (key hash and device identifiers) are kept for as long as the licence exists and are deleted when the device list is reset or on request.
The Provider may update this Privacy Policy from time to time. The current version is always available in the App. Last updated: 14 October 2026.