Privacy policy
In short
- Alba runs on your phone: your food diary, weight, water, recipes and goals stay in a local database.
- There is no account and no Alba server: the person who writes the app cannot see your data.
- No advertising, no tracking, no profiling, no selling or sharing of data.
- Online product search starts switched off: it runs only if you choose to turn it on, and you can turn it off at any time.
- You can export everything to a readable file and erase everything from inside the app, whenever you want, without asking anyone.
Who handles your data
The data controller is Giovan Battista Lo Buglio (independent developer, also known as gioviwankenobi), 90011 Bagheria (PA), Italy.
For any question about this policy, or to exercise your rights, write to info@gioviwankenobi.com.
Alba is a personal project rather than a business: it is free, carries no advertising and has no in-app purchases. No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR do not apply.
How Alba works, in one sentence
Alba saves everything you record in a database on your own device (SQLite, inside the app’s private storage). There is no Alba server for the data to be sent to, no backup managed by us, and no account to recover it from.
What data the app handles, and where it stays
| Category | Data | Where it is handled | For how long |
|---|---|---|---|
| Profile and preferences | Optional name, language, nutrition goals, app preferences, whether onboarding was completed | On the device only | Until you erase it |
| Food diary | Date, meal, food, brand, quantity and the nutrition values recorded | On the device only | Until you erase it |
| Weight and hydration | Weight, unit, date of the measurement, water logged | On the device only | Until you erase it |
| Recipes and planning | Names, ingredients, quantities, servings, planned meals | On the device only | Until you erase it |
| Favourites and usage | Favourite foods, how often they are used, the last quantity entered | On the device only | Until you erase it |
| Online search (only if you enable it) | The text you type from the third character onwards, the language of the request, and ordinary network metadata including your IP address | Sent to Open Food Facts | Technical logs kept by Open Food Facts for 3 years |
| Barcode scanning (only if you enable it) | The barcode read by the camera | Sent to Open Food Facts | Technical logs kept by Open Food Facts for 3 years |
| Camera | The frames needed to recognise a barcode | Processed on the device, at the moment of the scan | Never saved, never sent |
| Network status and system language | Whether there is a connection, the language set on the phone | On the device only | While you use the app |
Weight, food and hydration can say a great deal about your physical condition and your habits. That is precisely why they stay on your phone and are never transmitted anywhere.
What Alba does not do
- It does not ask you to create an account and collects no e-mail addresses, phone numbers or credentials.
- It contains no advertising and no advertising identifier (IDFA, Android Advertising ID).
- It contains no analytics, usage statistics, heat maps or automatic crash reporting.
- It does not track your activity across apps or websites, and never asks for iOS tracking permission.
- It does not access your location, contacts, calendar, files, microphone or photo library.
- It does not sell, rent or share your data with anyone, for any purpose, and does not use it to profile you.
- It makes no automated decisions producing legal effects concerning you.
Why it handles this data, and on what legal basis
| Processing | Purpose | Legal basis |
|---|---|---|
| Diary, weight, water, recipes, goals and preferences on the device | Giving you the feature you expect from the app: recording what you eat and reading it back | Performance of the contract for the use of the app (Art. 6(1)(b) GDPR). To the extent that this data reveals your physical condition, it is processed entirely under your own control, on your own device, on the basis of the explicit consent you give by choosing to enter it (Art. 9(2)(a) GDPR) |
| Online product search and barcode scanning | Finding the nutrition values of a packaged product that is not already on your phone | Freely given, specific and revocable consent (Art. 6(1)(a) GDPR). The feature stays off until you turn it on |
| Camera access | Reading a product barcode | Consent, given through the operating system permission and revocable from your phone settings |
| Exporting and erasing data | Letting you exercise your rights yourself, without writing to anyone | Legal obligation of the controller (Art. 6(1)(c) GDPR, in relation to Arts. 15-20) |
Online search: how consent works
Alba can look up packaged products in the collaborative Open Food Facts database. It is the only moment when anything leaves your phone, and it is an optional feature.
- On a fresh install, online search is off. The app only searches the foods already on your phone.
- Before the first request is ever sent, Alba shows you who will receive the data and what will be sent.
- Only if you accept does online search switch on. A request is sent once you have typed at least three characters.
- You can switch it off whenever you like in Settings → Privacy and data. From that moment no request is sent and the temporary result cache is cleared.
Requests never carry your name, your goals, your weight or the contents of your diary. What is sent is the text you typed, or the barcode, and nothing else. Every request travels over HTTPS.
If you pick a product found online, its nutrition values are saved into the local database on your phone, so next time you will find them again even without a connection.
The camera
The camera serves exactly one purpose: recognising a product barcode. Permission is requested only when you open the scanner, never at launch, and only after you have enabled online search.
No image is saved, stored or sent. Frames are processed on the device for the duration of the scan. Alba never requests microphone permission and records no audio.
Who receives the data
There is a single external recipient, and only if you enable online search.
| Recipient | Data received | Role | Details |
|---|---|---|---|
| Open Food Facts | Search text or barcode, the language of the request, IP address and technical connection metadata | Independent controller for its own technical logs | A French non-profit association, 21 rue des Iles, 94100 Saint-Maur-des-Fossés, France. It keeps IP addresses and server logs for 3 years for security, technical analysis and popularity measurement. Contact: privacy@openfoodfacts.org — privacy notice |
Open Food Facts processes data in France, inside the European Union: there is no transfer of your data to third countries. Its supervisory authority is the French CNIL.
There are no other recipients: no analytics provider, no ad network, no cloud service, no other developer.
How long it is kept, and how to erase it
What you record stays on your phone until you erase it. There is no automatic expiry, because the point of a food diary is being able to read it back months later.
You can erase everything at any time
- In Settings → Privacy and data → Erase all data: one confirmation removes your profile, diary, plans, recipes, favourites, water, goals, weight, temporary cache and preferences. The app returns to its first screen, online search is switched off, and only your interface language is kept.
- By uninstalling the app: the operating system removes the database along with it.
For the technical data Open Food Facts keeps on its own account (IP address and logs, 3 years), you can contact them directly at the address above.
Backups and moving to another phone
Alba is configured so that your data does not end up in the operating system’s automatic backups: on Android automatic app backup is disabled, and on iOS the database is excluded from iCloud backup.
Security
- The database lives in the app’s private storage, protected by the operating system and inaccessible to other apps.
- Every network request uses HTTPS.
- Since there is no Alba server, there is no central store that could be breached.
- The app adds no encryption of its own beyond the device’s: protecting your data means protecting your phone.
Your rights
The GDPR gives you the right to access your data, have it corrected, erase it, restrict or object to its processing, receive it in a readable format, and withdraw consent at any time.
In Alba you exercise these rights directly in the app, without asking anyone and without waiting:
| Right | How to exercise it |
|---|---|
| Access and portability (Arts. 15 and 20) | Settings → Privacy and data → Export my data: you get a readable JSON file with everything you have recorded |
| Rectification (Art. 16) | Edit or delete the individual entry directly in the diary, in recipes, or in weight |
| Erasure (Art. 17) | Settings → Privacy and data → Erase all data, or uninstall the app |
| Withdrawal of consent (Art. 7(3)) | Settings → Privacy and data: switch off online search; camera permission is revoked in your phone settings |
| Objection and restriction (Arts. 18 and 21) | Switching off online search stops the app communicating with the outside world entirely |
If you would still rather write to a person, the address is info@gioviwankenobi.com. We will reply within one month, as Article 12 GDPR requires — bearing in mind that, having no access to your data, the help we can give concerns the instructions rather than the execution.
If you believe the processing infringes the GDPR you have the right to lodge a complaint with the Italian supervisory authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it, or with the authority of the country where you live.
Children
Alba contains nothing unsuitable for any age, but it is designed for an adult audience and is not directed at children. It does not knowingly collect children’s data — it collects no one’s data on a server at all.
Counting calories and tracking weight is not a neutral activity for a growing person. If a minor uses Alba, they should do so with the awareness of a parent or guardian, and with the advice of a doctor or dietitian.
This website
The pages you are reading are hosted on GitHub Pages. They use no cookies, contain no analytics and do not profile visitors.
Like any website, the hosting provider (GitHub, Inc., a US company in the Microsoft group) records technical connection data, including your IP address, in order to deliver and protect the service. GitHub is the controller of that processing, described in its privacy statement and its data protection page. The typeface is served by Google Fonts, which likewise receives the IP address of the request.
The full text of these documents is also available inside the app, where the Privacy and data screen needs no connection at all.
Changes to this policy
If the way the app handles data changes, this page is updated and the version at the top changes with it. Substantial changes are also announced inside the app.
Version 1.0 — 1 September 2026.
Contact
Giovan Battista Lo Buglio
90011 Bagheria (PA), Italy
info@gioviwankenobi.com