Privacy

Updated October 1, 2026

SYNC’D helps people understand the products they buy. We do not sell personal data, run advertising SDKs or track people across other companies’ apps.

On your device

Scan history, saved products, grocery lists, your household (who you shop for, including pet names), the stores you shop at, watch topics, and diet, values and avoid-list preferences are stored on your phone. Household members and pet names never leave the device; the household flags on a result are computed on the phone.

What goes to our server

To analyze a product we send its name, brand and barcode, or a label photo. To find better picks we send the product and the stores you chose. To suggest grocery picks we send the item, your diet, values and avoid-list, and your stores. Our server passes these to Google Gemini and to the public sources below. Label photos are read and not kept. When a barcode isn’t in the open databases, the app looks it up directly with UPCitemdb, which sees the barcode and your network address, and nothing else.

SYNC’D in ChatGPT

When you use SYNC’D inside ChatGPT, ChatGPT sends our server only what a lookup needs: a product’s name, brand or barcode, a label photo you choose to share, the kind of product you’re looking for, and any stores or product preferences you mention. We don’t receive your conversation, your ChatGPT account details or your location. Label photos are read and not kept. ChatGPT also sends an anonymous user ID; we turn it into a one-way hash and use it only to count lookups toward a daily limit. Request records (operation, model, status, duration and token counts) carry no user and are kept for up to 30 days. Products and public records are processed exactly as described on this page. OpenAI’s privacy policy covers how ChatGPT handles your conversation.

Public records we check

For each product, our server queries openFDA, the Consumer Product Safety Commission, CourtListener, Wikidata, USDA FoodData Central, Open Food Facts and a Google web search through Gemini. Results are cached by product or brand without any shopper identifier. Every product analyzed is added to our shelf watch list (product identity only, not who scanned it) so new recalls and court cases can be found. When the app checks your shelf for new findings, it sends the barcodes or product names on your shelf, without your account.

Guest sessions and sign-in

Scanning creates a random guest account so we can enforce usage limits without asking for an email. Optional email-code sign-in supports community posting. Guest credentials are stored in the device Keychain.

Operations

We keep account-linked records of each analysis request (operation, model, status, duration and token counts) for up to 30 days to run the service and control costs. They don’t include photos, preferences or your household. If you turn on usage sharing in Profile, the app sends counts of actions such as adding to your list, with a timestamp and account ID; these expire after 90 days and you can turn sharing off at any time.

Community

A post, question or answer includes the display name you choose, the product, your note, an optional store and what it replaced, and account ownership. Posts are reviewed before they’re public. Who you follow and the circles you join are stored on your phone. Reactions are unique per signed-in account; reports are private to moderation. Deleting your account removes your posts, reactions, reports and account-linked events.

Waitlist

The website collects your email, your consent to a launch email, and available campaign or referrer attribution. A daily salted hash of your IP limits abuse and expires within two days. Email us to be removed.

Historical data

Earlier versions stored device-linked scan events, including display names, and sometimes uploaded label photos to public storage. Those rows and images are private and retained for a cleanup review. Contact us for a targeted deletion.

Our providers

Supabase hosts authentication, the database and server functions. Google Gemini processes analysis and search. Open Food Facts and USDA FoodData Central provide product facts. Vercel hosts this website. Google Fonts supplies the website fonts. Each may process network metadata when serving a request.

Deletion and contact

Use Profile to delete your account or guest session, and the app’s controls to clear local history and lists. For waitlist, historical-data, access or correction requests, contact madison@syncdbymadison.com. This service is not directed at children under 13.