MyPKU Privacy Policy

1. Data We Collect

MyPKU stores all diary entries, products, child profiles, and settings locally on your device using an on-device database. No personal data leaves your device unless you opt in to the cloud-based features described below.

We do NOT collect analytics, usage statistics, advertising identifiers, or location data.

2. Cloud Features and Third-Party Services

The following optional features transmit data to external services:

a) Shared Groups

When you enable Shared Groups and sign in, your email address, display name, and shared diary entries are transmitted to our backend hosted on Microsoft Azure (West Europe region). Data is stored in Azure Table Storage and is accessible only to members of your group.

b) Nutrition Label Scanner

When you use the scanner, the photo you take is sent to our Azure AI Vision service for text extraction. Photos are processed in real-time and are not stored on our servers.

c) Premium Subscriptions

Purchase and subscription status is managed by Google Play (Android) or Apple App Store (iOS). We use RevenueCat to verify your subscription status. RevenueCat receives your anonymous app user ID and purchase receipts. We do not receive or store your payment information.

d) Authentication

Sign-in is provided by Microsoft Entra External ID. We receive your email address and display name. We do not receive or store passwords.

3. Legal Basis for Processing (GDPR)

We process your data based on the following legal grounds:

• Contract performance: To provide the app features you use (Article 6(1)(b) GDPR).
• Legitimate interest: To maintain service security and prevent abuse (Article 6(1)(f) GDPR).
• Consent: For optional cloud features that you explicitly enable (Article 6(1)(a) GDPR). You may withdraw consent at any time by disabling the feature or deleting your account.

4. Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate personal data.
• Erase your personal data ("right to be forgotten").
• Restrict or object to processing of your data.
• Data portability — receive your data in a machine-readable format (use the Backup feature in Settings).
• Withdraw consent at any time for optional features.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at contact@deployit.ovh. We will respond within 30 days.

5. Data Retention

Local data is stored on your device until you uninstall the app or manually delete it.

Cloud data (Shared Groups activity) is retained as long as the group exists. When you leave a group, your shared entries remain visible to other group members. You may request full deletion of your cloud data by contacting us.

Subscription verification data is retained by RevenueCat according to their privacy policy.

6. Data Security

All network communication uses TLS 1.2 or higher. Authentication tokens are stored in platform-secure storage (Android Keystore / iOS Keychain). Our backend enforces access control so that only group members can view shared data.

7. International Data Transfers

Our backend is hosted in Microsoft Azure (West Europe). RevenueCat may process data in the United States under Standard Contractual Clauses (SCCs) as approved by the European Commission.

8. Children

MyPKU is designed for caregivers and parents to track dietary information for children with Phenylketonuria (PKU). The app is operated by adults on behalf of children. We do not knowingly collect personal data directly from children under 16. If you believe a child has provided data directly, contact us and we will delete it promptly.

9. Tracking and Advertising

MyPKU does NOT use any tracking technologies, advertising SDKs, or analytics services. We do not share data with advertisers or data brokers. We do not participate in cross-app tracking.

10. Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top indicates when the latest changes were made. Continued use of the app after changes constitutes acceptance of the updated policy.

11. Contact