Privacy Policy

Citrus is operated by Levi Rodrigues dos Santos as a commercial service. We are responsible for the operation of the Citrus mobile application and the handling of personal data in accordance with this Privacy Policy. If you have any questions or concerns regarding your personal data, you may contact us at contato@levirodrigues.com.

We collect only the information necessary to operate Citrus and provide its core features. When you sign in using Apple Sign-In or Google Sign-In, we receive basic account information such as your email address and name for authentication and account management purposes. We may also collect profile information you provide, including age range, allergies, dietary goal, and language preference.

The App stores content you submit — food photos, food descriptions, and chat messages — so your scan history and experience can be maintained across sessions. This information is used solely to support App functionality.

We also collect limited technical and diagnostic information automatically, such as device type, operating system version, app version, IP address, and anonymised usage or crash data. This helps us monitor performance, improve stability, and prevent misuse.

If you subscribe to Citrus paid features, payments are processed entirely by Apple through StoreKit. We do not collect or store payment card details and receive only subscription status information required to manage access.

We use your information to operate and maintain Citrus, manage user accounts, save app preferences, and ensure the App functions properly. Food photos, descriptions, and chat content are processed by our AI features to generate food scoring and guidance. Technical and diagnostic data is used to improve performance, fix issues, and protect the App from misuse. We may send service-related communications such as important updates. We do not sell personal data or use it for third-party advertising.

Citrus uses trusted third-party services to support essential functions such as authentication, data storage, analytics, AI processing, and subscription handling. These include Supabase, RevenueCat, PostHog, Apple, and Google (including Google AI / Gemini). Data is shared only as necessary to provide the App and is handled according to each provider’s privacy policy.

User data is stored using Supabase, with infrastructure hosted in the United States. By using the App, you consent to the transfer and processing of your data outside your country of residence. We take reasonable steps to ensure data is protected in accordance with this Privacy Policy and applicable laws, including GDPR, UK GDPR, and LGPD where relevant.

We retain personal data only for as long as necessary to operate Citrus and provide its features. Data is kept while your account is active and is deleted within 30 days after an account deletion request, unless retention is required by law or for legitimate business purposes such as subscription records. You can request account deletion in-app.

You have the right to request access to, correction of, or deletion of your personal data, as well as information about how it is processed. Depending on your location, you may also have rights to portability, restriction of processing, objection, and to withdraw consent where processing is consent-based. Requests can be made by contacting us at contato@levirodrigues.com, and we will respond in accordance with applicable data protection laws.

Citrus does not require users to provide their age, and we do not knowingly collect personal data specifically from children under 13. The App is intended for general audiences. If you are a parent or guardian and believe that a child has provided personal data to us, please contact us at contato@levirodrigues.com and we will take appropriate steps to review and delete the information if necessary.

We implement reasonable administrative, technical, and organizational safeguards to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We do not use IDFA for advertising tracking, and we do not perform cross-app tracking for advertising purposes. We may collect product interaction and diagnostics/usage information to operate and improve the App.

We may update this Privacy Policy from time to time. Changes take effect when posted. Continued use of the App constitutes acceptance of the updated Privacy Policy.