Privacy policy
Last updated 2026-08-23
Piiloperuna reads the ingredient panel on a food package with your phone camera and points to the words on your own list. All of that happens on the phone. The app has no user accounts, no server of ours to talk to and no analytics in it, so your scans and your allergen lists are not something we receive.
This policy covers the Piiloperuna app and the website at piiloperuna.app. It describes what the app actually does rather than what it reserves the right to do. The only thing the app ever contacts is Google Play, and that is about a purchase.
Who is responsible
Piiloperuna is published by PTM-Systems Oy, business ID 2249339-5, Sukulantie 375, 30100 Forssa, Finland. Questions about this policy, and any request described under “Your rights” below, go to inbox@ptmsystems.fi.
Because the app keeps everything on the device, there is very little for anyone to be the controller of. Where personal data does reach us — a message you send to the address above, and the access log of this website — PTM-Systems Oy is the controller of it under the General Data Protection Regulation.
What the app handles, and where it stays
Four kinds of thing pass through the app. None of them leaves the phone.
- The camera view
- While the scan view is open, the app looks at what the camera sees so that it can tell when a whole ingredient list is in view. That happens on the phone, and it works with the phone in flight mode. Nothing from the camera view is kept.
- The photograph of the panel
- When the app commits to a panel it takes one still photograph, reads that, and shows the findings on top of it. The photograph is deleted as soon as you dismiss the result. It is never added to your photo library and never sent anywhere.
- Profiles
- A profile is a name, an optional emoji and colour, and the list of ingredients that person avoids together with how serious each one is. Profiles are kept privately inside the app, and they go when the app is uninstalled.
- Settings
- The interface language you chose, and whether the full version has been unlocked on this phone. Kept the same way, beside the profiles.
The app contains no analytics, no crash reporting, no advertising and no tracking of any kind, and it asks for no identifier of you or of your phone. There is nothing here to switch off, because there is nothing switched on.
Your lists are health information
A list of the ingredients a named person avoids is information about their health, and often it is a child’s. The General Data Protection Regulation treats it as a special category of personal data. That is the reason this app is built the way it is, because the safest thing anyone can do with health data is not to collect it.
What protects it on the phone is the phone itself. What an app keeps privately can be read only by that app, and the whole device is encrypted once a screen lock is set. The app adds no encryption of its own and does not claim to. If a phone holds other people’s allergy lists, give it a screen lock.
Sharing a profile with someone
A profile can be handed to another phone in two ways: as a QR code shown on one screen and read by the other phone’s camera, or as a link sent through whatever messaging app you like. Both carry the same thing, which is the person’s name, their emoji and colour, and references to ingredients in the app’s own library rather than anything you have typed.
A QR code held up across a kitchen table involves no network and no third party at all.
A link is different in one way worth understanding. The list travels inside the link itself, and the part of the link that carries it is never sent on to this website. So opening a shared link on piiloperuna.app does not tell this website, or us, whose list it is or what is on it.
What that does not protect is the journey to the recipient. The message travels through the messaging service you chose, it stays in that conversation afterwards, and anyone who is given the link, or forwarded it later, can open it. Treat it as you would any other note about someone’s health, and prefer the QR code when you are in the same room.
A shared list is a copy rather than a subscription. It does not update itself, and the sender is not told when it is opened.
The full version
The full version is a one-off purchase that allows more than one profile to be checked at the same time. It is sold through Google Play, and Google handles the transaction. We never see your payment details, and a purchase does not send us your name, your address or your email.
The app asks Google Play whether the Google account already on this phone owns that product. The question carries no scan, no profile and no ingredient, and it is also how a purchase finds you again after you replace a phone.
For what it processes when you buy something, Google is an independent controller under its own privacy policy at policies.google.com/privacy. Downloading the app from the Play Store is likewise between you and Google.
Permissions the app asks for
One, the camera, which is the part that reads a panel. The app does not ask for your photo library, your location, your contacts, your files or your microphone.
You can withdraw the camera permission at any time in the phone’s own settings. The app still opens and your profiles are still there. Scanning is the part that stops working.
This website
piiloperuna.app is a handful of static pages. It sets no cookies, contains no analytics and makes no request to anybody else. Even the typefaces come from this site rather than from an outside font service, which would otherwise be told about everyone who opened a page.
The one thing the site keeps in your browser is the language you picked, so that the next page is in the same one. It is not a cookie, it is sent nowhere, and clearing your browsing data removes it.
Serving a page does mean a server receives a request, and PTM-Systems Oy, who hosts this site, records the ordinary access log entries: the address requested, the time, the IP address it came from and which browser was used. Those logs exist to keep the site running and secure. They cannot contain a shared profile, for the reason given above.
The page a shared link lands on is deliberately given no analytics of any kind, now or later.
Children
The app is meant for an adult doing the shopping, and the lists in it are frequently about children. Neither the app nor this site asks a child for anything, and no list of any kind reaches us, whoever it describes.
Your rights
The General Data Protection Regulation lets you ask a controller for a copy of the personal data it holds about you, for corrections to it, for its erasure or for a restriction on its use, and to object to it being used at all. Write to inbox@ptmsystems.fi and you will get an answer.
The honest answer will usually be that we hold nothing to give you. Your profiles, your scans and your settings are on your phone, and we can neither read them, export them nor delete them on your behalf. You delete a profile by deleting it in the app, and you delete everything by uninstalling the app.
If you believe personal data has been handled wrongly, you can complain to the Office of the Data Protection Ombudsman in Finland at tietosuoja.fi, or to the supervisory authority of the country you live in.
Changes to this policy
If what the app does with your data changes, this page changes with it and the date at the top moves. Anything that widens what is collected will be visible in the app as well, not only here.
Questions about any of this go to inbox@ptmsystems.fi.