Privacy Policy

What2Know is operated by CHASM AI Inc. ("we", "us"), North Vancouver, BC, Canada. Questions: privacy@what2know.app.

• Product photos you scan. When you scan, the photo is sent to our AI provider to read the label. See "AI analysis" below.
• Account data (optional). If you create an account, your email and the household profiles you set up (names and the allergy/diet/additive preferences you enter). Scanning works without an account.
• Scan history. Stored on your device, and synced to your account only if you sign in.
• Purchase status. Your subscription entitlement, via the app store and RevenueCat. We never see your card number.
• Prices you choose to submit (where that feature is available).
• An Instacart shopping list (optional, only if you ask for one). If you tap "Build my Instacart list" on your Family Shelf, the product names and quantities of the items you selected (and, for some items, their barcodes) are sent through our server to Instacart to create the list. We do not send your household profile names, allergies, diets, verdicts, prices, email or any account identifier. See "Instacart" below.

We do not run ads, we do not sell or share your personal information (including for cross-context behavioral advertising under the CCPA/CPRA), and we do not track you across other apps or websites.

To generate your result, your photo is sent to Anthropic (Claude), a third-party AI provider, and is used only to produce your result. Anthropic does not use it to train its models, and Anthropic automatically deletes uploaded images (typically within 30 days; up to two years only if a copy is retained for a policy or safety review). Our own servers do not store your photo. It is held in memory only for the moment needed to call the AI and is then discarded. You consent to this transfer before your first scan, and you can revoke that consent at any time in Settings.

Where this feature is available, you can send items from your Family Shelf to Instacart as a shopping list. This happens only when you tap the button. We send Instacart the product names and quantities of the items you selected (and, for some items, their barcodes), and nothing about who you shop for: no household profile names, allergies, diets, verdicts or prices. Instacart returns a link to the list, valid for seven days, which anyone who has the link can open. Once you open it you are on Instacart, where you choose a store and check out; prices, fees, substitutions and your account are between you and Instacart, and Instacart's own privacy policy applies. What2Know does not score the items Instacart matches or substitutes.

We share the minimum data needed with: Anthropic (AI analysis), Supabase (account and data storage), RevenueCat and the Apple App Store / Google Play (subscriptions), Vercel (hosting), for the price feature where available, Kroger and SerpApi(product price lookups), and, only if you build a shopping list, Instacart (list creation and the checkout you complete there). Each acts on our instructions under its own data-processing terms, except that Instacart is an independent service once you open your list.

We are based in Canada; some providers (including Anthropic and Vercel) process data in the United States. Where required (including under Quebec Law 25 and the GDPR), we assess that recipients provide adequate protection through their contractual data-processing terms before transferring.

Where the GDPR or UK GDPR applies, we rely on: your consent (to send your photo to our AI provider, which you can withdraw anytime in Settings); the performance of our contract with you (to run your account and subscription); and our legitimate interests in operating, securing, and improving the app. You can object to processing based on legitimate interests.

What2Know is not directed to children under 13 (or under 16 in the EEA and UK) and is intended for adults managing a household. We do not knowingly collect personal information from children under those ages; if you believe a child has provided us data, email us and we will delete it. If you record a family member who is a minor, please use a first name or label only. Do not enter a child's full identity.

You can access, correct, export, or delete your data. Delete your account and all associated data in Settings then Delete account, or email privacy@what2know.app. Residents of the EU, the UK, California, and Canada (including Quebec) have additional statutory rights, including the right to lodge a complaint with a supervisory authority.

We will post any changes here and update the date above. Material changes will be surfaced in the app.