Privacy Policy

1. Who we are

Ownplate is operated by Wintermute Agency, a company registered in Denmark (CVR-registered).

Address: Niels Andersens Vej 57, 2900 Hellerup, Denmark
Email: support@wintermute.agency

Wintermute Agency is the “data controller” for the personal data described in this policy. That means we decide how and why this data is used, and we are the ones responsible for it.

2. What we collect

A random identifier. When you first open Ownplate, the app generates a random identifier (a UUID) and stores it in your device's keychain. It is not derived from your name, email, phone number, or Apple Account.

Product lookups. When you scan or type a barcode, or search for a product, the barcode or search term is sent to Open Food Facts to look the product up, and product photos are loaded from Open Food Facts.

Your scans, lists and rules. Your scan history, saved lists, and rules are stored on your device and, if you are signed in to iCloud, synced between your devices through your private iCloud database. Apple stores that data; we have no access to it.

Camera. The camera is used only to read barcodes. Ownplate does not take, store, or upload photos.

Purchases. Apple handles payment. The app checks your subscription status on your device through the App Store; we never see your card number, payment details, or receipts.

Crash reports. If the app crashes or hits an error, a technical error report is sent to PostHog's error tracking.

IP addresses. Like any internet service, the providers in section 5 see the IP address a request comes from.

What we do not collect: your name, your email address (unless you choose to email us), any account or login, your precise location, your contacts, photos, your advertising identifier, or your payment card details. Ownplate has no user accounts and no advertising or cross-app tracking.

3. Why we use this data

• To provide the service. Looking up products, scoring them against your rules (which happens on your device), syncing your history and lists through iCloud, and checking your free scans and subscription status.
• To improve the app. Understanding who uses Ownplate, which scans and searches succeed or fail, and where people stop in onboarding or purchase, so we can fix and improve it.
• To fix crashes. Error reports tell us when and why the app fails.

4. Legal bases under GDPR

If you are in the EU, UK, or a similar jurisdiction, each use of your data needs a legal basis. Ours are:

Where we rely on legitimate interest, you have the right to object (see section 8). Where we rely on consent, you can withdraw it at any time.

5. Who we share data with

We never sell your data. We share data with the service providers below, each for a specific job:

6. How long we keep data

• Usage events: Up to 12 months, then deleted.
• Crash reports: Retained by PostHog for around 14 days.
• Purchases: Kept by Apple under its own terms. We keep no payment or subscription records of our own.
• On your device: Your scan history, lists, rules, and free-scan count stay until you delete them or the app. Downloaded product data and photos are cached on the device and removed after at most 120 days.
• In iCloud: Synced history, lists, and rules stay in your iCloud account until you delete them there.
• The random identifier: Kept in your device's keychain, which iOS may keep even after the app is deleted.

7. International transfers

Ownplate is operated from Denmark, and our crash reporting and analytics are EU-hosted. Where your data leaves the EU, the transfer is protected by European Commission Standard Contractual Clauses or by the provider's certification under the EU-US Data Privacy Framework. You can ask us for details about a specific provider at any time.

8. Your rights

If you are in the EU, UK, or Switzerland, you have the right to:

• Access: ask for a copy of the data we hold that relates to your device.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data.
• Restriction: ask us to limit how we process your data.
• Portability: receive your data in a portable format, where applicable.
• Objection: object to processing based on legitimate interest, and to any automated processing that significantly affects you.
• Withdraw consent: at any time, without affecting past processing.
• Complain: lodge a complaint with your data protection authority. In Denmark this is Datatilsynet (www.datatilsynet.dk). You can also complain to the authority in your own EU country.

How to exercise these rights: email support@wintermute.agency. Because Ownplate has no accounts, the data we hold is linked only to random identifiers, not to your name or email. To find and delete your usage events we will work with you to identify your random identifier; both are linked to it. Deleting the app removes your scan history, lists, and rules from the device, but iOS may keep the random identifier in the keychain, and anything synced to iCloud stays in your iCloud account until you delete it there.

We respond to requests within one month.

9. Children

Ownplate is not directed at children under 13. If you believe a child under 13 has used Ownplate and you want the related data deleted, contact us.

10. Security

Data travels encrypted (HTTPS) between the app and our providers. Access to our analytics and storage accounts is restricted. No system is 100% secure, but the small amount of personal data we hold, with no names or emails, limits what could ever be exposed.

11. Our website

Our website shows a cookie banner. Google Analytics is loaded, and sets its cookies, only if you accept analytics cookies there; if you reject them, it is not loaded. You can change your choice at any time from the banner's cookie settings.

12. Changes to this policy

When we change this policy we will update the date at the top. If a change is significant, we will let you know in the app.

13. Contact

Questions, requests, or complaints:

Wintermute Agency
Niels Andersens Vej 57, 2900 Hellerup, Denmark
support@wintermute.agency