Privacy Policy

Last updated: 4 November 2026

Hysa Tech (HYSA TECH SH.P.K., "we", "our", or "us") publishes Amberjar (the "App"), an app for iPhone and Android that keeps track of when your food, medicines and household things expire. This Privacy Policy explains what the App keeps, what leaves your phone and why, which providers are involved, and the rights you have. Where the iPhone and Android versions differ, this policy says so. It applies to the App and to this website's Amberjar pages. By installing or using the App, you acknowledge the practices described here. If you do not agree with them, please do not use the App.

1. The Short Version

• There is no account. We never ask for your name, email address, phone number or a password.
• Your shelf stays on your phone. The things you add, their dates, notes and photos, your places and your reminders are stored on the device. We do not have a server copy, and we cannot see them. On Android, if backup is on, Android also backs up your shelf, without its photos, to your Google account (section 3).
• Label photos are read on your phone first. On iPhone, a downsized copy of a photo is sent to Google's Gemini model only when the iPhone cannot read the label itself. On Android, codes and printed text are read on the phone, and a downsized copy is sent to Gemini to tell what the product is. Neither we nor the App keep it. Things you type in or add by their code never send a photo.
• Nothing on your shelf is used for advertising, and medicine information is never shared with advertisers, RevenueCat, Meta or our analytics tools.
• We use Google Analytics for Firebase and Firebase Crashlytics to see which parts of the App are used and to fix crashes. They receive counts and fixed labels, never what is on your shelf, and you can turn them off in the App's Settings (section 5.4).
• We do receive subscription and advertising attribution data through Apple or Google Play, RevenueCat and Meta, described in section 5. On iPhone, the advertising identifier (IDFA) is only shared if you allow tracking. On Android, the App does not collect the advertising ID at all.
• We do not sell your personal information.

2. Who We Are

The controller responsible for personal data processed through the App is HYSA TECH SH.P.K., trading as Hysa Tech, based in Tirana, Albania. You can reach us about anything in this policy at [email protected].

3. What Stays On Your Phone

The App creates and keeps the following on your device so that it can do its job. None of it is sent to us.

• Your shelf: each thing you add, with its name, brand, category, dates (such as "use by" or "best before"), whether it has been opened or frozen, lot number, notes, the place you keep it, and what happened to it (used, tossed or disposed of). For a medicine, also what you record about it: what it is for, its form and strength, who it is for, how to take it and whether it is a prescription.
• Photos you take in the App of labels, products and shelves, and any photo you choose from your library to be read. Photos are stored inside the App's own storage, not in your photo library.
• Your settings and reminders, including your digest time and which reminders are on. Reminders are scheduled on the device as local notifications; they are not sent from a server.
• Widgets and shortcuts read a summary of your shelf on the same device: on iPhone from storage shared between the App and its widgets, on Android from the App's own storage, which the Quick Settings tile reads too.

A small amount is kept apart from your shelf. On iPhone it is in the iOS Keychain, which iOS preserves even if you delete the App. On Android it is in the App's settings file, which Android's backup includes (see below):

• a flag recording that you have finished onboarding, so a reinstall skips it;
• the times of your recent cloud reads, used for a fair daily limit on cloud reading (section 4.1);
• a random identifier used for your subscription (section 5.1). It is not derived from you, your Apple or Google account, or your hardware.

None of these contain anything about what is on your shelf. If you export your shelf as a CSV file, the file goes wherever you choose to send it, and that transfer is yours rather than ours.

On Android, when backup is on, Android includes your shelf and the App's settings file in its automatic backup to your Google account, which it encrypts with your screen lock on supported devices. Your item photos are not in that backup. A device-to-device transfer to a new phone carries the shelf and settings too, and also the photos. A reinstall or a new phone restored from a backup gets your shelf back and, as the Keychain does on iPhone, keeps your subscription and skips onboarding. The backup is held by Google in your account, and we do not receive it. You can turn backup off in Android's settings, and delete the backup in the backup settings of your Google account (Google One).

4. How Labels Are Read

On iPhone, barcodes and 2D codes on packs are decoded on the device. Where your iPhone supports Apple Intelligence, label photos are also read on the device by Apple's on-device model, and nothing leaves the iPhone. On Android, barcodes, 2D codes and printed text are read on the phone by Google ML Kit, with models built into the App, and nothing is sent for that. Amberjar has no on-device language model on Android, so to tell what a product is, it uses the cloud reader below.

4.1 The Cloud Reader (Google Gemini)

When an iPhone cannot read a label itself, and on Android whenever the App reads what a product is, the App sends to Google, through Firebase AI Logic:

• a downsized copy of the photo you just took or chose;
• text already recognised on the device from that photo;
• today's date and your language, so dates are read correctly.

Google's model returns the product name, the date and similar details, which the App shows you to confirm. The request carries no name, account or identifier of yours. We do not receive, store or view these photos, and the App does not keep the copy it sent. We use the paid Gemini API; under Google's terms for paid use, Google does not use these requests or its answers to improve its products, and may keep them for a limited period to detect abuse and meet legal obligations. See the Gemini API terms and Google's privacy policy.

To protect the service from misuse, each request is verified with Firebase App Check, which uses Apple's App Attest on iPhone and Google Play Integrity on Android to confirm that it comes from a genuine copy of the App. Firebase also receives technical information that any internet request carries, such as your IP address and an app instance identifier. A photo of a medicine label is read only to tell you what it is and when it expires.

A quiet daily limit applies to cloud reads so that the service stays affordable and cannot be abused. It is counted on your phone (section 3), not on a server. Offline, or past the limit, the App sends no photo.

4.2 Product Names (Open Food Facts)

When the App reads a barcode, it may look up the product's name in Open Food Facts, an open product database. Only the barcode number is sent, with your IP address as part of the connection. Nothing else about you or your shelf is included.

5. Subscriptions, Measurement and Crash Reports

5.1 Purchases and Subscriptions

Payments are handled by Apple on iPhone and by Google Play on Android. We never see your card details, your Apple Account email or your Google account email. We use RevenueCat to know whether you have Amberjar Plus. RevenueCat receives:

• the random identifier described in section 3;
• your purchase and subscription status: the plan, when it started, whether it renewed, lapsed or was refunded, and Apple's or Google Play's transaction records for it;
• device and app information: on iPhone, such as device model, iOS version, App version, storefront country, language and IP address; on Android, such as device model, Android version, App version and IP address;
• the attribution identifiers described in section 5.2.

Because the identifier is kept in the Keychain on iPhone, and in the App's backed-up settings on Android, reinstalling the App on the same iPhone, or from an Android backup, brings your subscription back without you doing anything. RevenueCat processes this data on our behalf. See the RevenueCat privacy policy.

5.2 Advertising Attribution (Meta and Apple Ads)

We advertise Amberjar and need to know which adverts work. The App includes the Meta (Facebook) SDK, and RevenueCat sends subscription events to Meta from its servers. Between them, Meta receives:

• App events: that the App was installed and opened, and that a subscription started, renewed, was cancelled or refunded, with its price and currency. What is on your shelf is never part of an event.
• Identifiers: an anonymous Meta identifier, your IP address and basic device information; on iPhone, the identifier for vendors (IDFV) and, only if you allow tracking, the advertising identifier (IDFA); on Android, the Android ID, a device identifier scoped to the App (Android's counterpart of the IDFV).
• Install referrer (Android): the Meta SDK reads the Google Play install referrer, which tells Meta whether the install came from one of its adverts.

On iPhone, because this is tracking as Apple defines it, the App asks for your permission once, through Apple's App Tracking Transparency prompt, after you have started using your shelf. If you decline, the advertising identifier is not collected and events are marked as not permitted for tracking. Declining changes nothing else: every feature works exactly the same. You can change your answer at any time in iOS Settings, under Privacy & Security, then Tracking.

Android has no such prompt. On Android, the App does not collect the advertising ID at all: the permission to read it is removed from the App, and Meta's collection of it is switched off. The App does not use Android's Privacy Sandbox advertising APIs either. Meta's own automatic purchase logging is switched off in the App. See Meta's privacy policy; you can also review and disconnect activity that businesses share with Meta in Meta's "Your activity off Meta technologies" settings.

On iPhone only, we also use Apple Ads attribution: the App passes RevenueCat a token from Apple that tells us whether an install came from an Apple Ads campaign. Apple provides this without identifying you, and it needs no permission.

5.3 No Adverts Inside the App

Amberjar shows no advertising and contains no advertising network. We do not sell, rent or trade your personal information, and we never use your shelf, your photos or anything about your health to target advertising.

5.4 Usage Analytics and Crash Reports (Google Firebase)

To learn which parts of the App are used and to fix what breaks, the App uses Google Analytics for Firebase and Firebase Crashlytics, both provided by Google. They are on unless you turn them off in the App under Settings, then Your data, then "Share usage and crash reports". With the switch off, nothing is sent, and crash reports still waiting on your phone are deleted.

Google Analytics for Firebase receives:

• the screens you open, and events such as something being added, used or tossed, a Sweep being finished, the Plus screen being shown and whether a purchase went through. Each event carries only counts and fixed labels, for example how a label was read, how many days it had left, or whether it was food;
• an app instance identifier created by Firebase, session times, your device model, iOS or Android version, App version, language and country, and an approximate location that Google derives from your IP address.

When the App crashes, or runs into an error it recovers from, Firebase Crashlytics receives the technical trace of what the App was doing, the type of error and its code (never its message), your device model, iOS or Android version, free memory and storage, App version, an installation identifier, and the analytics events that led up to it. Firebase also records when the App starts and how long it runs, to measure its stability.

Neither receives the name, brand, barcode, lot, date, notes or photo of anything on your shelf, anything you type, or anything that tells a medicine apart from the other things you keep. On iPhone, the App uses the version of Google Analytics that does not collect the advertising identifier (IDFA), and does not give it the identifier for vendors (IDFV). On Android, Analytics runs with its collection of the advertising ID and of the Android ID (SSAID) switched off. Analytics is not linked to any advertising product, its advertising and personalisation features are off, and it is not shared with Google for benchmarking or support. Google processes this data on our behalf; see Privacy and Security in Firebase.

6. Medicines and Health Information

The medicines you track can say something about your health, so we treat them with extra care:

• They are stored on your phone, like the rest of your shelf, together with what you record about them, such as what each is for, who it is for and how to take it. We never receive them. On Android, they are part of the shelf that Android's backup copies to your Google account when backup is on (section 3).
• A medicine label photo leaves your phone only in the cases described in section 4.1, and only to be read. To keep it on your phone, type the medicine in or add it by its code instead.
• Medicine information is never sent to RevenueCat or Meta, never used for advertising, and never sold or licensed to anyone. Usage analytics and crash reports (section 5.4) cannot tell a medicine apart from anything else on your shelf.
• Amberjar shows dates and general storage guidance. It is not medical advice; ask a pharmacist or doctor about your medicines.

Residents of Washington, Nevada and other US states with consumer health data laws can read our Consumer Health Data Privacy Policy.

7. Permissions and Why They Are Asked

• Camera: to photograph labels, codes and shelves. Without it you can still choose a photo or type things in. On Android, it is asked the first time the camera opens.
• Notifications: for the daily digest and medicine and safety reminders. Decline it and the App works the same, without reminders. On Android, it is asked on Android 13 and later, in the reminders sheet.
• Tracking (iPhone only): only for advertising attribution, as described in section 5.2.

The App does not ask for your location, contacts, microphone, calendar or health records. On Android, a photo you choose is picked through Android's Photo Picker, so the App asks for no storage permission. Every permission can be refused or revoked in iOS Settings or Android's settings, and refusing one never changes what you have paid for.

8. Legal Bases (EEA, UK and Switzerland)

• Performance of our contract with you: providing the App, reading labels you ask it to read, and providing and restoring your subscription.
• Consent: advertising attribution that involves tracking (on iPhone only; you give or refuse it through the App Tracking Transparency prompt), and notifications. Withdrawing consent does not affect processing that happened before.
• Label photos that could reveal something about your health: you take and submit such a photo yourself, for the single purpose of having it read. It is processed only for that, is not linked to you, and is not kept. You can avoid it at any time by typing the thing in or adding it by its code instead.
• Legitimate interests: measuring which of our adverts work at the level that needs no tracking, understanding how the App is used and fixing crashes (section 5.4, which you can object to at any time with the switch in Settings), protecting the cloud reader from abuse, keeping the service secure, and answering support requests.
• Legal obligations: keeping transaction records for accounting and tax purposes.

9. Your Rights and Choices

9.1 What You Can Do Yourself

• Delete any thing on your shelf, with its photo, from the App.
• Export your whole shelf as a CSV file from Settings.
• Keep every photo on your phone by typing things in or adding them by their code.
• Allow or refuse notifications, and on iPhone tracking, in your phone's settings.
• Turn usage analytics and crash reports off in the App's Settings (section 5.4).
• Delete the App, which deletes your shelf and its photos from the device. On Android, you can also clear the App's storage in Android's settings, and delete its backup in your Google account so that a reinstall or a new phone does not bring your shelf back (section 3).
• Manage or cancel your subscription in your Apple Account on iPhone, or in Google Play on Android. Cancelling stops future renewals and your access continues until the end of the period you have paid for. Refunds are handled by Apple or Google Play.

9.2 Requests to Us

Depending on where you live, including under the GDPR in the EEA, the UK GDPR, Swiss law, Albania's law on personal data protection, and California and other US state privacy laws, you may have the right to access, correct, delete or receive a copy of personal data about you, to object to or restrict certain processing, to withdraw consent, to opt out of the sale or sharing of personal information, to appeal a decision we make about your request, and not to be treated differently for exercising any of these rights.

Almost everything lives on your phone, and on Android in its backup to your Google account, where you control it directly. For the subscription and attribution records held by our providers, write to [email protected] or follow the steps on our Data Deletion page. Because we hold no name or email for you, please include the Order ID from Apple's purchase receipt email, the order number from Google Play's, or the approximate date of purchase, so we can find the record. We may ask for information to confirm that a request is yours before acting on it. We respond within 30 days, or sooner where the law requires, and tell you if we need more time and why.

If you are not satisfied with our answer, you can appeal by replying to it, and you have the right to complain to a data protection authority, such as the one where you live or work. In Albania this is the Information and Data Protection Commissioner.

9.3 California and Other US States

In the last 12 months, through the App, we have collected these categories of personal information, from you and your device, for the purposes described in this policy: identifiers (the random subscription identifier; on iPhone the IDFV, and the IDFA if you allow it; on Android the Android ID; the anonymous Meta identifier; the Firebase app instance and installation identifiers; and IP address); commercial information (your subscription and purchase history); internet or other electronic activity (App installs and opens, how the App is used, and crash reports); approximate location derived from your IP address; and, only transiently for reading a label, photos that may include health-related information. We disclose them only to the providers named in sections 4 and 5, for the business purposes described there.

We do not sell personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Sending identifiers and App events to Meta to measure our adverts may be considered "sharing" for cross-context behavioural advertising under California law. You can opt out at any time by writing to [email protected] with the subject "Do Not Sell or Share", after which we will remove the attribution identifiers RevenueCat holds for you, and on iPhone also by refusing or turning off tracking for Amberjar in iOS Settings. We use sensitive personal information only to provide the App, not to infer characteristics about you.

10. How Long Data Is Kept

• On your phone: until you delete it or delete the App. On iPhone, the Keychain values in section 3 remain after deletion; they hold nothing about your shelf. On Android, deleting the App removes everything from the phone, but Android's backup can bring your shelf and settings back on a reinstall or a new phone, unless backup is off or you delete the backup in your Google account.
• Cloud reader requests: not kept by us or by the App; kept by Google only as its terms for paid API use allow (section 4.1).
• Subscription records: kept by RevenueCat and by Apple or Google Play while you have a subscription and afterwards as long as needed for accounting, tax and dispute purposes.
• Attribution events: kept by Meta under its own retention schedule, which we do not control.
• Usage analytics: event data is kept in Google Analytics for up to 14 months.
• Crash reports: kept by Firebase Crashlytics for 90 days.
• Support emails: kept as long as needed to resolve your request and keep a record of it.

11. International Transfers

Hysa Tech is based in Albania. Our providers, including Apple, Google, RevenueCat and Meta, process data on infrastructure that may be located outside your country, including in the United States. Where such transfers occur, they rely on appropriate safeguards such as adequacy decisions, the EU-US Data Privacy Framework where the provider is certified, or Standard Contractual Clauses approved by the European Commission, and their UK and Swiss equivalents. Your shelf does not cross any border unless you carry your phone there or, on Android, it is in Android's backup to your Google account.

12. Children

Amberjar is not directed at children and is not intended for anyone under 13, or under the age of digital consent where you live without a parent's permission. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Security

On iPhone, data is protected by the iOS sandbox and device encryption, and the values in section 3 are held in the iOS Keychain. On Android, it is kept in the App's private storage, and Android's backup of it is encrypted with your screen lock on supported devices. Every connection the App makes uses encrypted HTTPS. Cloud reader requests are checked with Firebase App Check so that only the genuine App can use it. No method of storage or transmission is perfectly secure, but the strongest protection here is structural: your shelf is never sent to us, so there is no database of it for anyone to breach.

14. Changes to This Policy

We may update this Privacy Policy, for example when the App gains a feature or a provider changes. We will update the "Last updated" date above and, for material changes that affect how your data is handled, tell you in the App before the change applies. Where the law requires your consent to a change, we will ask for it.

15. Contact Us

• Email: [email protected]
• Company: HYSA TECH SH.P.K. (Hysa Tech), Tirana, Albania
• Website: hysa-tech.com
• Data deletion: hysa-tech.com/amberjar/account-and-data-deletion-request