Privacy Policy

1 Data Controller

The data controller for the ReBip application is:

• Email: info@rebip.app
• Website: https://rebip.app

For any privacy-related inquiry, request, or complaint, please contact us at info@rebip.app.

2 Data We Collect

We do not collect: precise location, contacts, microphone audio, health data, or financial information. The advertising identifier (IDFA) is accessed only if you explicitly allow it through the iOS tracking prompt (see Section 8) — if you decline, ads are served in non-personalised mode.

3 How We Use Your Data

• Provide and synchronise your shopping lists across your devices.
• Identify products via barcode through our BipAI pipeline, which queries public data sources (see Sections 6 and 7).
• Maintain a private, stable product database for each user. Products linked from BipCore Aura, saved from BipAI or added manually remain under the user's control and are not overwritten automatically by later catalogue updates.
• Verify or identify a product from photos and/or a text description you choose to provide (Photo Check, opt-in and off by default, or Deep Search). Photos and text are processed through our backend by an AI provider (Google Gemini API) solely for that analysis and are not stored, not used to train models by us, and not linked to advertising.
• Suggest products based on your past purchases — entirely processed on your device and in your private cloud account.
• Improve the shared product catalogue (BipCore Aura) with anonymised scan data, only when you explicitly submit a product.
• Send one-time authentication codes and essential service communications.

We do not use your shopping data for advertising, profiling for third parties, or automated decision-making with legal effects. Ads shown in the app (see Section 8) are independent of your lists and scan history.

4 Data Retention

• Account data — retained as long as your account is active.
• Shopping lists & personal product database — retained until you delete them or delete your account.
• Local cache — stored on your device and manageable from Settings → My Database.
• Temporary AI photos — processed for the requested analysis and discarded immediately after processing.
• Crash reports — retained for 90 days by Firebase Crashlytics, then automatically deleted.
• Operational backups — encrypted internal backups are created automatically on a daily and weekly basis for disaster recovery. They are accessible only to the ReBip team and are not user-facing.

When you delete your account from within the app, all your personal data is permanently deleted from our servers within 24 hours. Some data may remain for a limited time in encrypted backup copies created for disaster recovery and mass restore purposes, and those backups are overwritten according to the backup schedule.

5 Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following limited cases:

• With other list members — if you share a list with someone, they can see the items in that list. You control who you share with.
• With infrastructure providers — Google Firebase (authentication, database, storage, crash reporting), acting as a data processor under our instructions. See Section 6.
• Legal obligations — if required by law, court order, or to protect the rights and safety of users.

6 Third-Party Services

When performing a barcode lookup, only the barcode number is sent to external databases — no personal information is transmitted. If you enable Photo Check or use Deep Search, the photos and text you provide are relayed through our backend to the AI provider for that single analysis and are deleted immediately afterwards. Google Firebase infrastructure is located in the European Union and/or the United States. For transfers outside the EEA, Google relies on Standard Contractual Clauses approved by the European Commission.

7 Product Data, BipAI & Open Data Licensing

Product information in ReBip comes from two sources:

• BipCore Aura — ReBip's official product database, curated and verified by our team.
• BipAI — our artificial-intelligence pipeline, which searches, aggregates and cross-checks publicly available product information from the open data sources listed below. AI-generated product data may contain errors; always double-check important details (such as allergens or ingredients) on the physical product.

When a product is saved in your personal database, ReBip stores it as one of three user-controlled records: a link to a BipCore Aura product, a private override of an Aura product, or a personal snapshot created from BipAI/manual input. Later Aura or BipAI updates may be shown as suggestions, but they do not automatically replace the name, brand, size, description or image you have saved.

BipAI relies on the following open data sources. We gratefully acknowledge these projects and comply with their licensing terms:

Data derived from Open Food Facts is available under the Open Database License (ODbL); photos from Open Food Facts are licensed under CC BY-SA 3.0. Within the ReBip app, all product pages link exclusively to rebip.app — this page serves as the complete attribution notice for the sources above.

8 Advertising

ReBip may show two kinds of advertising, both clearly labelled as "Sponsored":

• ReBip sponsored products — native product cards managed directly by ReBip. These are served from our own infrastructure and do not involve any third-party tracking.
• Google AdMob banners — standard ad banners served by Google. On iOS, AdMob can access the advertising identifier (IDFA) only if you allow it through the App Tracking Transparency prompt. If you decline, ads are served in non-personalised mode. Your shopping lists and scan history are never shared with advertisers.

You can change your tracking preference at any time in iOS Settings → Privacy & Security → Tracking. For details on how Google processes ad data, see policies.google.com/technologies/ads.

9 Security

• All data in transit is encrypted using TLS 1.2 or higher.
• Access is passwordless: ReBip stores no account password and uses short-lived, single-use email codes.
• Access to Firestore is restricted by security rules: each user can only read and write their own data.
• Administrative tools are restricted to the ReBip admin account and protected by Firebase security rules and server-side checks.
• Automatic internal backups run daily and weekly for disaster recovery. The restore process is performed only by the ReBip team.
• Product deletions are protected by a trash flow, so removed product records are retained for a limited grace period before permanent deletion.
• The app can operate offline using a local cache kept inside the iOS app sandbox.

10 Children's Privacy

ReBip is not directed at children under the age of 13 (or 16 where applicable under local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@rebip.app and we will delete it promptly.

11 Your Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

To exercise any of these rights, contact us at info@rebip.app. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g. the Garante per la protezione dei dati personali in Italy).

12 Account Deletion

You can permanently delete your account and all associated data at any time, directly from the app:

1. Open the app and tap Settings.
2. Tap your account name at the top.
3. Scroll down and tap Delete account.
4. Enter the one-time confirmation code sent to your email (email accounts); guest accounts use the in-app double confirmation.

Deletion is immediate and irreversible. All your lists, purchase history, personal products, and account data are permanently removed from our servers. Local data stored on your device is also cleared automatically.

13 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via the app or by email. Continued use of ReBip after a policy update constitutes acceptance of the revised policy.

14 Contact Us