Who is responsible

Checkly is made by Nave, trading as Checkly, Jan Nautahof 46, Amsterdam, the Netherlands. KVK 80502474, VAT NL003447574B73. The one address for everything — support, privacy requests, legal notices — is info@get-checkly.com.

What you give Checkly

During the introduction you tell Checkly what you want to check, how you would describe your skin and which ingredients you would rather avoid. Those answers, every scan you make and every product you put on your shelf — with the date you opened it — are written to this device's storage and are never transmitted.

Checkly does not ask for your name, your email address, your date of birth or your location, and it has no login.

Barcode lookups

When you scan a product, the barcode number is sent to Open Beauty Facts. If the product is filed in one of its sister databases — Open Food Facts, which holds many makeup products, Open Pet Food Facts or Open Products Facts — Open Beauty Facts passes the request on. Product photographs are loaded from the same databases. These databases are run by a French non-profit and are independent controllers of the requests they receive: https://world.openbeautyfacts.org/privacy

When a database knows the product's name but has no ingredient list for it, Checkly also searches Open Beauty Facts and Open Food Facts for the brand and one word of the name (for example "nyx butter"), to find the same product in another shade. Nothing else is sent with it. Checkly's own checked ingredient lists are part of the app: using one sends nothing.

Search

The text you type is sent to world.openbeautyfacts.org and world.openfoodfacts.org to find matching products. It is not sent anywhere else, it is not stored by us, and it is not linked to you or your device. Both are run by the same French non-profit, an independent controller of the requests it receives: https://world.openbeautyfacts.org/privacy

Products you add

When a product is in no database, you can add it: Checkly reads its ingredient list with the camera, and you give it a name. It is kept on this device only and is never sent anywhere — the Android app has no shared product database.

Asking for a product to be scored

When Checkly can't score a product — it is in no database, or its record has no ingredient list — you can ask for it to be scored, and you can report a problem with any product. The request holds the barcode, the product's name and brand where known, and for a report the reason and any note you write. It is kept on this device, waiting for Checkly's product database: the Android app does not send requests anywhere yet, and this policy will say so before it does. Profile › Your data removes them with everything else.

Finding the ingredient list

Google's ML Kit reads the text in a photo on the phone. Checkly then works out which part of that text is the ingredient list: the recognised text — never the photo — is sent to Checkly's server at get-checkly.com, hosted for us by Vercel Inc., which asks Anthropic's Claude model to find the list and sends the answer straight back. The text is not linked to you, your device or an account, and Checkly does not store it.

Anthropic processes the text for us. Under its commercial terms it does not use it to train its models and deletes it within 30 days, or keeps it for up to two years if it is flagged under Anthropic's usage policy. We rely on our legitimate interest in reading the list you asked Checkly to read (GDPR art. 6(1)(f)). A photo of a pack rarely holds anything personal; a screenshot can, so choose one that shows the ingredient list. If the server can't be reached, Checkly finds the list on the phone with its own rules.

Where the server work happens

Checkly's server code runs in Vercel's Frankfurt region, in the EU. Vercel Inc. is a US company whose main processing facilities are in the United States, and Claude is provided to us by Anthropic Ireland Limited, which works with Anthropic, PBC: Anthropic stores data in the United States and may route a request to servers in the United States, Europe, Asia or Australia. So the words read from an ingredient list can be processed outside the European Economic Area. Vercel's and Anthropic's data processing agreements cover those transfers with the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914). Write to info@get-checkly.com for a copy of the clauses that apply.

Camera and text recognition

The camera is used to read barcodes and to read ingredient lists. Every frame is processed on this device by Google's ML Kit — the barcode scanner and the text recogniser run on the phone, and no image or recognised text is sent to Google. No image is sent to us either; the text recognised in a still of an ingredient list goes to Checkly's server to find the list in it (see Finding the ingredient list). A still taken of an ingredient list is held in memory while it is read and then discarded: it is never uploaded, and never added to the scan record. What is kept is the recognised text, on this device, as part of the result.

ML Kit sends Google technical data for diagnostics and usage analytics: the device model, manufacturer and Android version, the app's package name and version, how the recogniser performed, and a per-installation identifier that is not intended to identify you or your device. Google does not share it with third parties. Google's privacy policy applies to it: https://policies.google.com/privacy

Checkly asks to use the camera the first time you scan, and for nothing else.

Photos

Reading an ingredient list from a photo or a screenshot uses the system photo picker, which hands Checkly only the one image you choose; Checkly never asks for access to your photo library and cannot see anything you did not pick. The picked image is read on the device by the same text recogniser and is not stored or uploaded. A photo of a product's front that you add is stored on this device only, re-encoded so that no location or other metadata stays with it, and is never uploaded.

Reminders

Expiry reminders are local notifications, scheduled on this device by the app and delivered by Android. They involve no server and no push service. On Android 13 and later, Checkly asks for permission to show notifications the first time a reminder is needed, and you can turn them off in Profile or in your phone's settings at any time.

On-device cache

Products you look up are cached in the app's cache folder for 7 days so re-scans are instant. Android may clear it at any time; uninstalling the app removes it.

Share card

Sharing a result creates an image on your device and hands it to whichever app you choose. Nothing is uploaded by Checkly.

Purchases

Subscriptions are sold and billed by Google Play. Checkly never sees your payment details or your Google account. Google's privacy policy applies to the payment itself: https://policies.google.com/privacy

To know whether your subscription is active, Checkly uses RevenueCat, Inc. as our processor. The app gives this installation a random number and sends RevenueCat that number, your Google Play purchases (which plan, its price and currency, its dates and the purchase token Google Play issues), and technical details: the app and Android version, the country of your Google Play account and your language. RevenueCat's servers also see your IP address. RevenueCat checks the purchase with Google Play and answers whether Checkly Premium is active; that answer is kept on this device so the app still opens when you have no signal. The random number is not linked to your name, your email address or your Google account, and nothing about your scans, answers or shelf is sent.

We process this to provide the subscription you bought (GDPR art. 6(1)(b)), and look at the purchase figures only in total, to run the business (art. 6(1)(f)). RevenueCat stores the data in the United States under its data-processing agreement with us, which includes the EU's standard contractual clauses for the transfer. It is kept while the subscription history is needed for billing and accounting.

Partner offers (from the next Android update)

Added 8 October 2026. The Android app on Google Play today does not do this yet; this section applies once an update that offers partner vouchers is installed.

Checkly downloads the current partner offer from get-checkly.com: a plain request with no identifiers, which our host sees like any web request. Which offer applies is worked out on your phone from the country of your Google Play account. Nothing about you goes to the partner, and a voucher code is shared by everyone in a country, so it can't identify anyone. Opening the partner's shop is your choice, and the partner's own privacy policy applies there.

If you email us

If you write to info@get-checkly.com, we use your email address and what you wrote to answer you, which is our legitimate interest in replying (Article 6(1)(f) GDPR). We keep that correspondence no longer than 24 months after the matter is closed, and we do not use it for anything else.

This website

get-checkly.com sets no cookies and runs no analytics or advertising scripts. It is a set of static pages hosted by Vercel, which, like any web host, processes the technical data needed to deliver a page to you, such as your IP address, under its own privacy policy. The App Store badge is loaded from Apple and the Google Play badge from Google.

Your rights

Under the GDPR you may ask for access to your personal data, and for its correction, deletion or restriction, and you may object to its processing. In practice Checkly holds almost nothing about you that we can reach: your answers, your history and your shelf are on your device, and Profile › Your data removes them at any time. What reaches us is your purchase history at RevenueCat, linked only to a random app number; to have it deleted, write to us with the order number from Google Play's receipt email (it starts with GPA.). Deleting that history does not cancel a subscription: that is done in Google Play › Payments & subscriptions.

Requests and questions go to info@get-checkly.com. If you are not satisfied, you may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Children

You must be at least 16 to use Checkly. Checkly is not directed at children, and it holds no date of birth, because collecting one would create personal data the app otherwise does not hold.

Changes

If this policy changes, the date at the top of this page changes with it and the new version ships in an app update.