Privacy Policy

Effective date: 2026-10-11

Bunny Search helps you check whether cosmetics brands test on animals and what's inside a product. It's run by Darja Orlova ("we", "us"), based in Latvia, in the EU. We decide how your personal data is used, which makes us its controller under data protection laws such as the EU's General Data Protection Regulation (GDPR). On Google Play, Bunny Search is published by BBapps SIA, Riga, Latvia.

This policy explains what the Bunny Search app for iPhone and Android, and this website, collect, why, on what legal basis, who else gets it, where it's processed, how long we keep it, and how to have it deleted. If you have questions, email support@bunnysearch.app.

The short version

• You don't need an account. The app signs you in with a random user ID, not your name or email address.
• When you photograph an ingredient list or a logo, the photo goes to our server and to Google's Gemini AI, a third-party AI service, which reads the text. The app asks before your first photo is sent (version 2.8 and later; older versions work differently, see below).
• We don't keep your photos. From a label photo we keep only the ingredient list read from it.
• Ingredient lists read from your photos, and brand names you type, can be shown to other users. Nothing that identifies you is shown with them.
• There are no ads. We don't sell your data, and we don't track you across other companies' apps or websites.
• To have your data deleted, copy your user ID in Settings and email it to support@bunnysearch.app (see Deleting your data and your rights).

Your user ID

When you first open the app, it signs in anonymously with Firebase Authentication, a Google service. This creates a random user ID for your installation of the app. We don't ask for your name, email address or phone number.

The data we keep on our server is linked to this ID. RevenueCat, which handles subscriptions for us, uses the same ID. You can see and copy it in the app under Settings > Your user ID.

If you delete the app and install it again, you may get a new ID, and your old data stays linked to the old one. If you want your data deleted, copy your ID before you delete the app.

Brand search

When you search for a brand, the text you type goes to our server, which looks it up in our brand database. We don't save your searches with your user ID (our server logs keep the search text for 30 days, see "Server logs"). The app also sends the search text to app analytics (see "Analytics, crash reports and app services"), so we can see which brands people look for.

Barcodes

The app reads barcodes on your phone, and only the barcode number goes to our server. We look it up in our own data and in our copies of Open Beauty Facts and openFDA, two public product databases. If we don't have the product, our server asks the Open Food Facts / Open Beauty Facts database about that barcode number. It sends only the number, nothing about you. We don't send barcodes to any other database. Product photos from these databases load on your phone directly from their sites (see "Who else gets data").

On Android, the barcode reader is Google's ML Kit, part of Google Play services. It sends Google technical usage data, such as the device model, app version and how well the reader performs, but not the barcode or the camera image.

Ingredient checks

When you check an ingredient list, our server compares it with ingredient databases using fixed rules. AI isn't used for this step. We record which lists you've checked, so opening them again doesn't use another check.

Photos of ingredient lists

You can photograph a product's ingredient list (1 to 3 photos), for example when we don't have it. Before your photos are sent for the first time, the app tells you where they go and asks whether to continue. If you choose "Not now", nothing is sent and your photos stay on the screen. The app remembers your answer on this phone. You can withdraw it at any time in Settings > "Photos to AI", and the app asks again before the next photo. To have the reads we already keep deleted, email us your user ID (see "Deleting your data and your rights").

This describes version 2.8 and later of the app. For older versions, see "Older versions of the app".

• Where the photos go. The app sends them to our server (Google Cloud Functions in the EU). Our server removes hidden photo data, such as location and camera details, and sends the photos to Google's Gemini AI (on Google Cloud Vertex AI), a third-party AI service, which reads the text. Google may process the photos in any of its data centres, including outside the EU.
• What Google does with them. It processes the photos for us as a service provider, under terms that don't let it use them to train its AI models. It may hold them briefly to answer faster, and may keep a request for a limited time if its safety systems flag it as possible abuse; its authorised staff may then look at it.
• What we keep. We keep the ingredient list read from your photos, linked to your user ID. We don't use your photos to train AI.
• What we don't keep. Your photos: our server doesn't store them, and they're gone once the list has been read. For photos we couldn't read as an ingredient list, we keep only a short record linked to your user ID: what the photos seemed to show, how readable they were, and when you sent them.

Photos of logos

If a product has no barcode, you can photograph its logo to find the brand. Before your first logo photo is sent, the app asks whether to continue. The photo goes to our server and to Google's Gemini AI in the same way, and we get back the brand name printed on it. We don't keep logo photos. We only count that you used one.

Older versions of the app

In Bunny Search 2.7 and earlier, photo search works differently. The photo goes straight from your phone to Google's Gemini AI (through Firebase) in the US, not through our server, and the app gets back only the brand name. These versions don't ask first and don't remove hidden photo data, such as location. We don't receive or keep these photos. Update the app to get the new photo features and the "Your user ID" setting.

What other users can see

• Ingredient lists. When you photograph the list of a product with a barcode, the list read from your photos is saved. Once photos from at least two different people agree, everyone who scans that product sees that list. Other users never see your photos, your user ID or anything else about you.
• Brand names. If we have no brand for a barcode and you type one, we save it. If it matches a brand name in our database, we may suggest it to other people who scan that barcode, again without anything about you. Other text you type there isn't shown to anyone else.
• Reports. When you report a wrong list or product, we save the report with your user ID, so each person's report counts once. A list with enough reports is hidden.
• A list you photograph without a barcode is only shown to you.

Bunny Search Pro and purchases

You buy Pro through the App Store or Google Play. Apple or Google takes the payment, and we never see your card or payment details. RevenueCat, a US company, manages subscriptions for us. When you open the app, even if you never buy, it receives your user ID, the app's analytics ID and basic device and app details, so the app can show prices and check whether you have Pro. If you buy, it also receives your purchase records from Apple or Google (such as the plan, price, dates and store transaction IDs) and which version of the Pro screen you saw. RevenueCat may pass your purchases and renewals on to our app analytics under the app's analytics ID, so we can count them. Our server stores whether your Pro subscription is active and until when.

What we keep on our server

Our server and database run on Google Cloud (Firebase) in the EU. The app can't read this database directly; only our server can. Linked to your user ID, we keep:

• your label reads: the ingredient list read from your photos, the barcode if there was one, how readable the photos were, and when you sent them; for photos we couldn't read, a short record of why;
• which ingredient lists you've checked;
• usage counters: how many free checks and logo photos you've used, and daily counts for fair use and abuse limits;
• your reports and the brand names you typed;
• whether you have Pro;
• your user ID in the shared lists you photographed or reported, so that each person counts once.

Server logs. Our server also writes technical logs to find errors and stop abuse, for example your IP address and device type, the user ID and barcode of a scan, or the text of a brand search, and whether it worked. They never contain photos. Google Cloud keeps them for 30 days.

How long we keep data.

• Label reads, checked lists, usage counters, reports, typed brand names and Pro status: as long as we need them to provide the service, for example to keep your free check count and the shared lists working, or until you ask us to delete them.
• Shared ingredient lists and brand names: as long as they're useful to other users. If you ask us to delete your data, we remove your user ID from them.
• Server logs: 30 days.
• Crash reports and error logs: 90 days. Analytics: the detailed data is deleted automatically after at most 14 months, in Google Analytics and in our own copy.
• RevenueCat's subscription record: until you ask us to delete your data. Apple and Google keep their own purchase records under their own policies.
• Emails to us: only as long as we need them to answer you.
• Data on your phone: until you delete it in the app or delete the app.
• Our website: Cloudflare's security cookies expire after a short time (__cf_bm after 30 minutes without activity). Technical logs of requests to brand pages: 30 days. Visit statistics are kept by Cloudflare only as overall numbers that don't identify you.

Analytics, crash reports and app services

The app uses these Google Firebase services:

• Google Analytics for Firebase records how the app is used: the screens you see, the buttons you tap, your brand searches, scan results (for example, whether a product was found), your answer to "What do you want to look out for?" in onboarding, your answer to the AI photo question, when you see the Pro screen and whether you buy. It also collects your device model, system version, app version, approximate location (country or city, worked out from your IP address) and a random app instance ID. On Android it can also read your device's advertising ID. Analytics doesn't receive your user ID, but RevenueCat stores the app instance ID together with it (see "Bunny Search Pro and purchases"). We use it to see which features help people and to improve the app. We may also keep a copy of this data in our own Google Cloud project (BigQuery) to analyse it. Google deletes the detailed data after at most 14 months, and our copy is deleted automatically after at most 14 months too.
• Firebase Crashlytics receives crash reports and error logs: your device model, system version and app version, when app sessions start, and what the app was doing when something went wrong. An error log can include, for example, the text of a brand search that failed or a product's barcode. We don't give Crashlytics your user ID, and it never receives your photos. Google keeps these reports for 90 days.
• Firebase App Check checks that requests come from the real app on a real device, using Apple App Attest or DeviceCheck, or Google Play Integrity.
• Firebase Remote Config lets us switch features on or off and change settings, such as the number of free checks. It receives a random installation ID, the app version, and your device's country, language, time zone and system version.
• Firebase In-App Messaging can show messages inside the app, and records whether you saw or tapped one.

You can object to analytics and crash reports at any time. The app has no setting to turn them off yet, so for now the way to stop them is to delete the app. If you also want the analytics data we can find for you deleted, email us your user ID (see "Deleting your data and your rights").

Kept only on your phone

The app's History and Recent checks lists and your app settings stay on your phone. Your onboarding answers and your answer to the AI photo question are saved on your phone and also go to analytics, as described above. Deleting the app deletes what's on the phone, but copies in your phone's iCloud or Google backup stay until those backups are replaced.

Emails to us

If you email us, for example from Settings > Contact Support, we get your email address and your message. We use them only to answer you, and keep them only as long as we need to for that.

What we don't collect

The app doesn't ask for your name, email address, phone number, Apple ID, Google account or a password. It doesn't read your contacts, your precise location, data from Apple Health or Google Fit, or the rest of your photo library: when you pick a photo, your phone's photo picker gives the app only that photo. The camera is used only while you scan or take a photo, and camera images used to read a barcode stay on your phone. On iPhone, the app doesn't collect the advertising identifier.

Ads, selling and tracking

Bunny Search has no ads. We don't sell your data, share it for advertising, or combine it with other companies' data to track you across apps or websites. The app doesn't ask your iPhone for permission to track you. On Android, Google Analytics can read the advertising ID, as described above; we don't use it for ads, and you can reset or delete it in your Android settings.

Who else gets data

• Google (Firebase, Google Cloud, and Gemini on Vertex AI for photos), RevenueCat and, for our website, Cloudflare process data for us as service providers. They may use it only to provide their service to us, and each is bound by data processing terms to keep it secure. We only use service providers that protect your data at least as well as this policy does.
• Like most online services, they see technical information when the app or your browser talks to them, such as your IP address, device model, system version, app version and the time of the request. They use it to deliver and protect their services.
• Apple and Google run the App Store and Google Play and handle your purchases as independent companies, under their own privacy policies.
• Open Food Facts and Open Beauty Facts get barcode numbers from our server, and nothing about you. When the app shows a product photo from Open Food Facts or Open Beauty Facts (on a result, in History, on Home or on the Pro screen), your phone loads the picture directly from their site. Like any website, it sees your IP address and which picture was loaded, which shows the product's barcode.
• We may share data if the law requires it, for example to answer a valid request from a court or authority.

Google, RevenueCat and Cloudflare may process data outside your country, including in the United States and other countries outside the EU and the UK. Those transfers are covered by the European Commission's Standard Contractual Clauses in their data processing terms, and by the EU–US Data Privacy Framework where a company is certified under it.

Privacy policies of these services:

• Firebase
• Google Cloud
• Google
• RevenueCat
• Cloudflare
• Apple

Our website

Our website, bunnysearch.app, runs behind Cloudflare, Inc., a US company, which delivers the pages and protects the site from abuse. Cloudflare processes your IP address and browser details for this. On each page it runs a short automated security check in your browser, and it may set cookies needed for security, such as __cf_bm (it expires after 30 minutes without activity) and cf_clearance, for example to remember that your browser passed the check. These cookies aren't used for analytics or ads.

For visitors outside the EU, we count visits and see how people find us with Cloudflare Web Analytics. It shows us only overall statistics, such as page views, the sites visitors came from, countries, browsers and how fast pages load. It doesn't use cookies, doesn't store anything on your device and doesn't track you across sites. Visits from the EU aren't counted.

Google hosts our pages: Firebase Hosting delivers them, and brand pages are built by Google Cloud Functions in the EU. Google processes your IP address to deliver the pages and keeps technical logs of the requests for 30 days. The fonts on our pages are served from bunnysearch.app itself.

Until October 2026, the home page also used Google Analytics for Firebase. We've removed it; the data it collected is deleted automatically after at most 14 months.

Children

Bunny Search isn't meant for children under 13, and we don't knowingly collect data from them. If you think a child has sent us photos or other data, email us their user ID and we'll delete it.

Why we're allowed to use your data

Data protection laws, such as the EU's GDPR, ask us to say on what basis we use your data:

• To provide what you ask for (our contract with you, GDPR Article 6(1)(b)): your user ID; brand searches, barcode lookups and ingredient checks; reading the label and logo photos you send; Pro and your purchases; free-use counters.
• Our legitimate interests (Article 6(1)(f)), weighed against your privacy: showing shared ingredient lists and brand names to other users (accurate product information for everyone); reports, fair-use and abuse limits, server logs and App Check (keeping the service working and safe); Crashlytics (fixing crashes); Analytics, Remote Config and In-App Messaging (seeing which features help people and improving the app); on our website, delivering the pages, protecting the site from abuse and counting visits without cookies (Cloudflare, Google); answering your emails. You can object to any of these, see below.
• The law (Article 6(1)(c)), where it requires us to keep or share data.

You don't have to give us any data. Brand search works without photos, and you choose whether to send photos, type a brand name or report something. The app can't work without the anonymous user ID, though, because that's how it keeps your free checks and Pro. We don't make decisions about you based only on automated processing that have legal or similarly significant effects: the AI only reads text from photos, and fair-use limits are simple daily counts.

Your choices

• Photos and AI. Nothing is sent to Google's Gemini AI unless you take or pick a photo and send it, and the app asks before the first one. You can withdraw at any time in Settings > "Photos to AI" (the app then asks again before the next photo), or simply not send photos. We don't keep your photos; to have the reads we already keep deleted, email us your user ID.
• Analytics and crash reports. You can object by email. The app has no setting to turn them off yet, so the way to stop them now is to delete the app.
• Advertising ID on Android. You can reset or delete it in your Android settings.
• Our website. Website visits aren't linked to the app or your user ID. You can block the Cloudflare Web Analytics script (static.cloudflareinsights.com) in your browser or with a content blocker; the site still works. The security check and its cookies protect the site and can't be turned off.
• Everything else. See "Deleting your data and your rights" below.

Deleting your data and your rights

To have your data deleted:

• in the app, open Settings and tap "Your user ID" to copy it (if you don't see "Your user ID" in Settings, update the app first);
• email it to support@bunnysearch.app and ask us to delete your data.

If you can't open the app any more and you bought Pro on Google Play, you can send the order number from your Google Play receipt instead (it starts with GPA.); we use it to find your user ID. The app never asks for your name or email address, so without your user ID or an order number we can't tell which data is yours.

We delete the data linked to that ID on our server (label reads, checks, usage counters, reports and Pro status) and the anonymous account for the ID itself. We ask Google to delete the analytics data for the app's analytics ID that RevenueCat holds for you, and delete our own copy of it, and we ask RevenueCat to delete its record for that ID. Shared ingredient lists and brand names stay, without your ID. We do this within 30 days and write back when it's done.

If the app is still on your phone, it gets a new user ID afterwards. If you have Pro, tap Restore purchases in Settings to get it back.

Some things stay: server logs that contain the ID, which are deleted automatically after 30 days. Crash reports aren't linked to your user ID; Google deletes them, and the rest of the analytics data, automatically, as described above. Apple and Google keep their own purchase records.

Deleting your data or the app doesn't cancel a subscription. Cancel it with the store you paid through: on iPhone, in Settings > your name > Subscriptions; on Android, in Google Play > Profile > Payments & subscriptions > Subscriptions. Pro users can also tap Manage subscription in the app's Settings.

You can also email us to get a copy of your data, correct it, delete it, limit how we use it, receive it in a portable format, or object to how we use it (including analytics). Send your user ID with your request so we can find your data. We reply within a month. If you live in the EU, the UK or another place with similar laws, these are your legal rights, and you can complain to the data protection authority where you live or work, or to ours: Latvia's Data State Inspectorate, dvi.gov.lv.

Security

Data is encrypted on its way between the app, our server and the services we use, and Google Cloud encrypts it where it's stored. Only our server can read and write the data we keep about you. No method is 100% secure, but we work to protect your data.

Changes to this policy

We may update this policy. We'll post the new version on this page and change the effective date at the top.

The app and this website link to other sites, such as the App Store, Google Play, Open Beauty Facts and the organisations whose brand lists we show. We don't run them and aren't responsible for their content or privacy practices.

Contact

Bunny Search is run by Darja Orlova, Latvia. If you have questions about this policy or your data, email support@bunnysearch.app.