Privacy Policy

1. Who We Are

spilled. is an application developed and operated by JFLX, a company based in the Czech Republic, European Union. We are the data controller for personal data processed through the spilled. app.

Contact: terms-privacy@jflx.io

2. What spilled. Does

spilled. lets you scan the labels of food, drink, and cosmetic products and receive a plain-language explanation of what the ingredients are and what they do. Analysis is powered by AI (Anthropic Claude) via JFLX's secure backend. The app is fully usable without creating an account.

3. Data Processed When You Scan

Anonymous scanning (no account required).When you scan a product, the photo you take is sent to JFLX's backend and then forwarded to Anthropic for AI analysis. No user ID, device ID, or any other identifier is attached to the scan. Scans are anonymous by design.

Photos are used solely to generate the ingredient analysis. They are not used to identify you and are not retained beyond what is strictly necessary to produce the result.

Product results cache. Analysis results may be stored in a shared cache keyed by product name to avoid repeat processing. This cache contains only product analysis content — it holds no personal data.

4. Optional Account (Sign-In)

Sign-in is entirely optional. If you choose to create an account (via Apple Sign-In, Google Sign-In, or email through Supabase Auth), JFLX will process your email address and authentication identifiers solely to provide cloud synchronisation of your own scan history across your devices. We do not use this information for any other purpose.

Account data is retained for as long as your account exists. You may delete your account at any time, which will remove your data from our systems.

5. In-App Purchases

spilled. offers a single one-time in-app purchase, Spilled Plus. Purchases are processed by Apple and managed through RevenueCat. Apple and RevenueCat collect and process purchase and device data in accordance with their own privacy policies. JFLX does not have access to your full payment information. Please review Apple's Privacy Policy and RevenueCat's Privacy Policy for details.

6. Third-Party Service Providers

We share data with the following third-party processors only to the extent necessary to operate the service:

• Anthropic— AI analysis of product photos (scan images are forwarded to Anthropic's API; no personal identifiers are included).
• Supabase — Backend infrastructure, authentication (for signed-in users), and storage.
• RevenueCat — In-app purchase management and entitlement tracking.
• Apple — App Store distribution, payment processing, and (if used) Apple Sign-In authentication.

All processors are required to handle data in accordance with applicable law and are prohibited from using it for their own purposes beyond the services they provide to us.

7. Advertising and Data Sales

spilled. contains no advertising. We do not sell, rent, or trade your personal data to any third party.

8. Data Retention

Scan photos are not retained beyond what is necessary to produce the analysis result. Product analysis results in the shared cache are retained to improve performance but contain no personal data. If you have an account, your personal data is retained for as long as your account remains active. You may request deletion at any time.

9. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your personal data.
• Right to restriction of processing — request that we limit how we use your data.
• Right to object — object to processing based on our legitimate interests.
• Right to data portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, contact us at terms-privacy@jflx.io. We will respond within 30 days.

10. Children's Privacy

spilled. is not directed at children under the age of 13 (or 16 in jurisdictions where that threshold applies under applicable law). We do not knowingly collect personal data from children below these ages. If we become aware that we have inadvertently done so, we will delete such data promptly. If you believe we may have collected data from a child, please contact us at terms-privacy@jflx.io.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If changes are material, we will notify you through the app or via email (if you have an account). Your continued use of spilled. after changes are posted constitutes acceptance of the revised policy.

12. Contact

Questions or concerns about this Privacy Policy? Reach us at terms-privacy@jflx.io.