Privacy Policy

Last updated: 26 October 2026

SCADO ("SCADO", "we", "us") is an offline-first mobile app that helps you track the expiry dates of food in your home. This policy (Articles 13 and 14 of Regulation (EU) 2016/679, the "GDPR") explains what data the app handles, what data the scado.app website handles, what leaves your device, and your rights. You do not need an account to use the app, and your inventory stays on your device.

Data controller

The data controller is 255bit.it di Matteo Pelladoni, Via Gerole 25/B, 46010 Redondesco (MN), VAT no. 02719740207, info@255bit.it. For any privacy request, contact info@255bit.it.

App: data that stays on your device

The following is stored in a database on your device and is never transmitted to us:

Your food inventory: product names, quantities, categories, and the dates you enter.
Photos used for scanning: camera frames are processed on the device to recognise barcodes and dates, are not uploaded, and temporary copies are deleted after use.
App settings, language, notification preferences, and your local activity history.

Uninstalling the app, or using Settings > Privacy and data > Reset local data, removes this data from your device. You can export it at any time from the same screen. If you have turned on your phone backup (iCloud or Google), the operating system may include it in your personal backup, managed by Apple or Google under their own terms.

App: subscription (RevenueCat, Apple, Google)

To manage the free trial and the Premium subscription we use RevenueCat, Inc. (United States) as a processor. RevenueCat receives your store purchase history, a pseudonymous identifier generated by RevenueCat (not your name or email), and the technical data of each connection, such as IP address, device model, operating system and app version. This data is used only to verify your Premium entitlement and manage your subscription; it is not used for advertising or cross-app tracking.

Payment is handled by Apple (App Store) or Google (Google Play), which process your data as independent controllers under their own privacy policies. We never receive your card details, nor your name or email from the store.

Legal basis: performance of the subscription contract (Art. 6(1)(b) GDPR).

App: product look-up (Open Food Facts)

When you scan a barcode while your phone is online, SCADO sends the barcode (EAN/UPC) to Open Food Facts to get the product name, brand and image. The result is saved on the device, so the same barcode is not requested again. The look-up is automatic: if you do not want it, add the product by hand or scan while offline.

The request contains no identifier of you or your device, but, like any internet connection, it reaches Open Food Facts' servers with your phone's IP address. The same applies to the product image, which the app downloads from Open Food Facts' servers. Open Food Facts (an association based in France) processes this technical data as an independent controller, under its own privacy policy.

Legal basis: providing the feature you use by scanning the product (Art. 6(1)(b) GDPR).

App: on-device text recognition

Reading printed dates and barcodes happens on the device: on iPhone with Apple's Vision services, on Android with Google's ML Kit, provided through Google Play Services. Images and the recognised text never leave your phone. On Android, according to Google's documentation, ML Kit may send Google technical metrics about how the feature performs (for example device model, system and app version, processing times) to maintain and improve it; Google processes this data under its own terms.

The scado.app website

Hosting: the website is hosted by Vercel Inc. (United States), acting as a processor. Like any web server, it records IP address, browser, requested page, date and time in technical logs. This data is used to deliver the site and protect it from abuse and attacks, and is kept for the short period set by the hosting service. Legal basis: our legitimate interest in the security and operation of the site (Art. 6(1)(f) GDPR).

Statistics: only if you accept in the cookie banner, we use Google Analytics to measure aggregate traffic. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from "Cookie preferences" at the bottom of every page. Cookies, durations and retention are described in the Cookie Policy.

Email: if you write to info@255bit.it, we process your address and the content of your message to reply and follow up on your request. Legal basis: your request (Art. 6(1)(b) GDPR) and our legitimate interest in handling support (Art. 6(1)(f) GDPR).

What we do not do

In the app: no analytics SDKs, no usage tracking, no crash reporting.
No advertising, no advertising identifiers, no data brokers; we do not sell your data.
No cross-app or cross-site tracking, so SCADO does not ask for tracking permission.
No profiling and no automated decision-making about you (Art. 22 GDPR).

Permissions

Camera - to scan barcodes and read printed expiry dates; frames are processed on the device. The app remains usable with manual entry if you decline.
Notifications - to send local reminders before food expires. The app remains fully usable if you decline.

Recipients

The following process data on our behalf, as processors: RevenueCat (subscription), Vercel (website hosting), Google (website statistics, only with consent) and our email provider. Apple and Google (stores and Play Services) and Open Food Facts act as independent controllers. We do not disclose data to anyone else, except where required by law.

Transfers outside the European Economic Area

RevenueCat, Vercel and Google may process data in the United States. Vercel and Google participate in the EU-U.S. Data Privacy Framework, found adequate by the European Commission in its decision of 10 July 2023. For RevenueCat, and in any case as an additional safeguard, transfers are covered by the Standard Contractual Clauses approved by the European Commission.

Retention

On-device data: until you delete it (uninstall or "Reset local data").
Subscription data at RevenueCat: for the duration of your subscription and, after it ends, for as long as needed to handle any disputes or refunds. You can ask for earlier deletion by emailing info@255bit.it.
Website technical logs: for the short period set by the hosting service.
Website statistics: at most 14 months in Google Analytics.
Email: for as long as needed to handle your request and any follow-up.

Children

SCADO is a general-audience utility and is not directed to children. We do not knowingly collect personal data from children.

Your rights

Under Articles 15-22 GDPR you have the right to access, rectify, erase, restrict and port your personal data, and you can withdraw any consent at any time, without affecting the lawfulness of earlier processing. Because your inventory is on your device, you exercise most of these rights directly in the app (export and delete). For data held by RevenueCat and for any other processing, write to info@255bit.it: we reply within one month (Art. 12(3) GDPR).

Right to object (Art. 21 GDPR): you can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (website technical logs, handling correspondence), by writing to info@255bit.it.

You may also lodge a complaint with the supervisory authority of the country where you live or work; in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Changes to this policy

We may update this policy; the "Last updated" date above will change accordingly. Material changes will be clearly flagged on this website.

Contact

255bit.it di Matteo Pelladoni, Via Gerole 25/B, 46010 Redondesco (MN), VAT no. 02719740207, info@255bit.it