EkkyPrivacy policy
Effective 7 October 2026
This policy explains what the Ekky app and its servers do with your data. We collect as little as the app needs to work, and we never sell it or use it for advertising.
In short. You sign in with Google. We keep your scan history, your reviews and your subscription status. Scanning happens on your phone: no photos leave it. Product lookups send only the barcode or product name to outside services, never anything about you. There are no ads, no advertising ID and no analytics tools in the app. You can delete your account in the app at any time.
1. Who we are
Ekky is made by Velassi, who is responsible for your data under this policy (the “controller”). You can reach us at velassi.co@gmail.com.
This policy covers the Ekky Android app, the Ekky servers it talks to and this website. The website itself sets no cookies and runs no scripts.
2. What we collect and why
| Data | Why we need it | Kept |
|---|---|---|
| Google sign-in: your name, email address and a link to your Google account | To sign you in. Ekky has no passwords of its own: you sign in with Google. | Until you delete your account |
| Ekky account: a random account ID, the ID of your sign-in, the display name you choose (optional), your language and region settings, account status | To run your account and show your display name next to your reviews. If you don’t set a name, reviews show “Ekky user”. | Until you delete your account |
| Scan history: the barcode, the product, whether you used the camera or typed the number, and the time | To show your history, and to check that a review comes from someone who scanned the product. | Until you delete your account |
| Reviews: stars, optional text, whether it followed a camera scan, moderation status | To show reviews to other users and keep them honest. | Public. Kept, anonymised, after account deletion (see section 7) |
| Votes, reports and blocks: your votes on reviews, reviews you reported (with the reason and your comment), people you blocked | To rank reviews, handle complaints and hide people you don’t want to see. | Until you delete your account |
| Subscription: whether you have Ekky Plus, the plan (monthly or yearly), the store and the expiry date, plus purchase events from our subscription provider | To give you the Plus features you paid for, and for our accounting. | Status: until you delete your account. Purchase records: as long as accounting law requires |
| Server logs: IP address, time, requested address and app or browser version | To keep the service secure and fix errors. | About 14 days |
| Rate-limit counters: how many requests an account or address made recently | To stop abuse and runaway costs. | Short-lived, they expire on their own |
| Emails to us: your address and what you write | To answer you. | As long as needed to handle your request |
We don’t collect your location, contacts, photos, advertising ID or payment card details. Google Play handles payments; we never see your card.
3. Camera and scanning
Ekky uses the camera only while the scanner is open, to read barcodes. The barcode is recognised on your phone. Camera images are never saved and never sent to us or anyone else. Only the barcode number that was read goes to our server.
The barcode recognition component in the app may send its developer technical metrics about how it performs (for example, device model and processing time). It never sends camera images.
4. Product lookups
When you scan a product, our server looks it up. These lookups are made by our server, not by your phone, and they contain only the barcode or the product name. They never include your account, email, IP address or history.
- Open product databases, for product names, brands and pictures.
- Web search services, to find published lab tests on the sites of testing organisations.
- An AI service reads the product data and the text of the reports found, to pull out the findings. It receives no data about you. The score is then calculated by a fixed formula, not by the AI.
What these services learn is that someone, somewhere, asked about a product.
5. Product images
Product pictures are loaded by the app directly from where they are published, usually an open product database and sometimes another website. Like any website you visit, those sites receive your IP address and basic device information when the picture loads. We don’t store or copy these pictures.
6. Data on your phone
- Your sign-in tokens are kept in the phone’s secure storage, so you stay signed in.
- The app keeps a copy of recent screens (your history and products you opened) so they still open without a connection.
- Both are erased when you sign out or delete your account. Uninstalling the app also removes them.
The app asks for these Android permissions: internet and network state (to reach our server), camera (to scan) and billing (to buy Ekky Plus through Google Play).
7. Reviews are public
Reviews are visible to everyone who uses Ekky, together with your display name (or “Ekky user”) and whether the review followed a camera scan. Please don’t put personal information in a review.
Reviews are checked by automatic rules and, where needed, by a person on our side. If you delete your account, your reviews stay but are anonymised: they show “Deleted user” and are no longer linked to you. If you want your reviews removed as well, email us before deleting your account and we will remove them.
8. Who else receives data
We don’t sell personal data, share it for advertising, or use analytics or advertising tools. We use trusted service providers who process data for us, each only for the purpose listed and only with the data it needs:
| Who | What for | What they receive |
|---|---|---|
| Sign-in with Google; app distribution and payments through Google Play | Sign-in and purchase data, under Google’s own privacy policy | |
| Hosting providers | Running our servers, database, sign-in service and this website | The data listed in section 2, stored on servers we control |
| Subscription management provider | Keeping track of Ekky Plus subscriptions | Your Ekky account ID (not your name or email) and your purchase details from Google Play |
| Backup storage provider | Keeping our backups | Backups encrypted on our side, which the provider can’t read |
| Email provider | Our support mailbox | Your emails to us |
| Product data, web search and AI services | Product information and finding and reading lab reports (section 4) | Barcodes, product names and report text only, never data about you |
| Barcode recognition component | Reading barcodes on your phone (section 3) | Technical performance metrics, never camera images |
We may also disclose data when the law requires it, or to protect the safety of our users or our service.
9. International transfers
Some of our providers are outside the European Economic Area, including in the United States and China. Services in China receive product data only, never personal data. Where personal data goes outside the EEA, we rely on the safeguards the law allows, such as the European Commission’s standard contractual clauses offered by the provider.
10. Legal bases
- Providing the service you asked for (contract): your account, scan history, reviews and subscription.
- Our legitimate interests: security, server logs, rate limits, moderation, backups and answering you.
- Legal obligations: keeping purchase records for accounting.
11. How long we keep data
- Account data, scan history, votes, reports and blocks: until you delete your account.
- Reviews: anonymised and kept after deletion, unless you ask us to remove them.
- Purchase records: as long as accounting and tax law requires.
- Server logs: about 14 days.
- Backups: we make an encrypted backup every day. Old backups are removed on a rolling schedule, so deleted data can remain in a backup for up to about 6 months. Backups are only used to restore the service after a failure.
12. Deleting your account
In the app, open Profile → Delete account and confirm. You can also ask by email. The details, including what is kept, are on the account deletion page.
Deleting your account doesn’t cancel an Ekky Plus subscription. Cancel it in Google Play.
13. Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a machine-readable form. You can also object to processing based on our legitimate interests. Email velassi.co@gmail.com from the Google address you sign in with, and we will answer within 30 days.
You can also complain to your local data protection authority.
14. Security
All connections use HTTPS. Sign-in tokens are stored in the phone’s secure storage. Backups are encrypted before they leave our server. Access to the servers is limited to the people who run Ekky. No system is perfectly secure, but we work to keep your data safe and will tell you if a breach affects you, as the law requires.
15. Age limit
Ekky is meant for adults aged 18 and over and isn’t directed at children. If you believe a child has given us personal data, tell us and we will delete it.
16. Changes and contact
If we change this policy, we will publish the new version here with a new date, and tell you in the app if the change is significant.
Questions about privacy: velassi.co@gmail.com.