Lotly Privacy Policy

Who we are

Lotly is an iPhone app and website that show United States food recall information from official government sources. Lotly is operated personally by Willis Yang, an individual developer (“we,” “us”).

Contact: lotlysupport@gmail.com

This policy covers the Lotly iPhone app and the Lotly website at https://lotly.pages.dev/. Allergen choices are also covered by our separate Consumer Health Data Policy: https://lotly.pages.dev/consumer-health-data/.

The short version

• Lotly has no accounts. We never ask for your name, email, phone number, date of birth or location, and the app never uses location services.
• The app keeps your choices (the states you shop in, the stores you shop at, and the food allergens you want to watch) on your iPhone. It sends the states and stores to our server so recall alerts can match them. It sends your allergens only if you agree to their use for alerts; without that, the app does not send them and our server stores none. The server copy is labelled with a random installation identifier rather than your name, but it is still personal data: that identifier links the records to your installation.
• If you turn on recall alerts, we also store a push token so alerts can reach your phone.
• Subscriptions are sold by Apple. We use RevenueCat to check that your subscription is active, under a purchase identifier. If you turn on recall alerts, the app also sends that identifier to our server with your alert registration, so alerts stop when your subscription ends.
• We use no advertising, no tracking, and no analytics or crash-reporting tools in the app, and we do not sell or share personal information for advertising. Our subscription provider, RevenueCat, gives us subscription statistics (such as how many people subscribe), which Apple’s privacy label counts as analytics.
• You can see, export and delete what our server holds from inside the app. If you stop using the app, our server deletes what it holds for your installation after 12 months.

Information the app collects

Random identifiers

• Installation identifier. A random code created on your iPhone the first time it is needed. It does not contain your name, contact details or anything read from your device, but it is personal data: it links your records on our server to this installation. Our server uses it to keep your records apart from other people’s.
• Purchase identifier. Sent to RevenueCat, to check your subscription. If you turn on recall alerts, it is also sent to our server with your alert registration. While Lotly is sending recall alerts and yours are on, our server asks RevenueCat about once an hour, on a fixed schedule, whether your subscription is active, so alerts stop when it ends. It is removed from our server when you turn alerts off.
  • If you subscribed with an earlier version of Lotly, it is the installation identifier you had then, so your subscription carries over without restoring. After you reset the app, the two no longer match.
• Push token (only if you turn on alerts). The address Apple issues so notifications can reach this app on your phone.

Lotly does not use Apple’s advertising identifier, and it does not ask for permission to track.

Your choices

• States you shop in. Any number of U.S. states, DC and Puerto Rico, picked by hand.
• Food allergens you watch. Any of nine: peanuts, tree nuts, milk, egg, wheat, soy, sesame, fish and crustacean shellfish. They may be your own, or those of anyone you shop or cook for. See “Allergen choices” below.
• Stores you shop at. Chosen from a list.

These are stored on your iPhone. The states and stores are copied to our server every time you change them, including during setup, whether or not alerts are on. Once a day, when you open the app, it sends them again so the server copy stays complete; nothing changes if they have not changed. The app sends your allergens only if you agree, and our server stores them only with that consent (see “Allergen choices”). Our server also keeps a record of your allergen-alerts decision and when you made it.

Recall alerts (only if you turn them on)

• The push token, the platform (iOS), the app version, and when alerts were turned on, last refreshed and turned off.
• A counter that keeps “alerts on” and “alerts off” requests in the right order.
• Delivery records: which alert was sent to which registration, and whether the delivery service accepted it.
• For some users aged 13 to 17, a keyed hash of Apple’s identifier for their download of Lotly. See “Children and teens”.

Last-opened date

When you open the app, at most once a day, it sends the date: a calendar day in UTC, with no time and no detail of what you did. We use it only to delete inactive data (see “How long we keep data”).

Privacy request codes (only if you create one)

If you create a request code (see “Requests about your data”), our server keeps a scrambled form of the code that cannot be turned back into it, what it is for, and when it was created, expires and was used. It never keeps the code itself.

Subscription status

See “Subscriptions.”

Community shopper reports: not collected

Lotly does not collect community shopper reports. The feature is switched off, and our server accepts none.

What the app does not collect

• Your name, email, phone number, contacts, photos, date of birth, or precise or approximate location.
• What you search for. Search runs on your iPhone over recalls already downloaded.
• Which recalls you open, save, or share. Saved recalls stay on your iPhone, and sharing goes through the iPhone share sheet.
• Your payment details. Apple handles payment.
• Any data for advertising, crash reports, or usage analytics from the app. (RevenueCat’s subscription statistics are described with subscriptions.)

Information stored only on your iPhone

Your choices, your allergen-alerts decision, both random identifiers, whether alerts are on, your progress through setup, your saved recalls, the last subscription status the app confirmed (plan, when it was checked, when it renews), the date of the last daily check-in, a cache of public recall information, and Apple’s latest answer about your age range (see “Children and teens”).

Some of these live in the iPhone’s secure storage (the Keychain). That storage can survive deleting and reinstalling the app.

Allergen choices

Allergen choices can say something about someone’s health. Some laws treat them as consumer health data. Our separate Consumer Health Data Policy covers them in detail: https://lotly.pages.dev/consumer-health-data/.

• On your iPhone, your allergens show which recalls may matter to you. This works whether or not you consent to anything below.
• On our server, only with your consent. When you choose allergens, the app asks whether Lotly may use them for recall alerts (“Enable allergen alerts” or “Continue without allergen alerts”; the full explanation offers “Use for alerts” or “Keep on this iPhone only”).
  • If you agree, they are stored on our server (Supabase) and used only to decide which alerts to send you.
  • If you decline, the app does not send them, our server stores none, and alerts are not based on allergens.
• Allergens stored before this choice existed. Versions of Lotly from before this choice sent allergens with every save. Any still on our server are not used for alerts unless you consent, and they are removed the next time the app sends your choices without your consent (it does so at least once a day while you use it).
• Withdraw any time: Profile → Privacy & Data Controls → Allergens and alerts → “Stop using allergens for alerts”, or clear your allergens. The change takes effect on your iPhone at once. The server copy is removed as soon as your iPhone is online; until then the app shows that removal will finish when your iPhone is back online.
• Never used for advertising, never sold, never shared beyond the service providers listed below.
• Deleted with the rest of your data when you reset the app, and automatically after 12 months without use.

How we use information

• Showing which recalls may affect you. This matching runs on your iPhone.
• Sending the recall alerts you turned on, matched by the same rules.
• Keeping alert delivery reliable and non-duplicated (delivery records, the ordering counter).
• Confirming and restoring your subscription.
• Applying the age rules in “Children and teens”.
• Deleting inactive data (the last-opened date).
• Answering requests and messages you send us.

We do not use personal information for advertising or marketing, we do not sell it or share it for cross-context behavioral advertising, we do not give it to data brokers, and we do not track you across other companies’ apps or websites.

Notifications

Alerts are optional and off until you turn them on and allow notifications in iOS. If you turn them on, the app registers this installation for alerts on our server. When an alert is sent, Expo’s push service passes the push token and the alert text to Apple’s Push Notification service, which delivers it to your iPhone.

The alert text contains only public recall facts, such as the product and the reason for the recall. Expo states that it does not store notification content. Apple may hold an undelivered notification for a limited time while your phone is offline.

You can turn alerts off in the app (Profile → Notifications) or in iOS Settings at any time.

Subscriptions

• Apple sells the subscription and processes payment through your Apple Account. We never see your payment details.
• RevenueCat checks whether your subscription is active, using the purchase identifier, the purchase record from the App Store, and your device type and iOS version. RevenueCat says it uses the IP address of a request only to work out the country, and does not keep it.
• Our server keeps no purchase records, except, if you turn on alerts, your subscription’s status (active or not), its expiry date, the time of the most recent check, and since when it has been active, used only to decide whether to send alerts. They are cleared when you turn alerts off, and deleted with your alert registration by a reset, a deletion request or 12 months without use.
• Resetting the app keeps the purchase identifier, so an active subscription continues. If you turn alerts on again after a reset, the app sends that same identifier with the new alert registration, so it is not a fresh identifier for our server. On a new device, use Restore Purchases.
• Cancel in iOS Settings → your name → Subscriptions. Refunds are handled by Apple at reportaproblem.apple.com.
• If your subscription ends, the app shows only the subscription screen until you subscribe again or restore a purchase. From that screen you can still open Privacy & Data Controls to see, export or delete your data, get a request code, or stop using your allergens for alerts. You can also email us (see “Requests about your data”).

Who receives information

We share information only with the service providers that run Lotly for us, and only for that purpose.

Lotly is iPhone-only. Google’s Android push service is not used.

We may also disclose information if the law requires it, for example in response to a valid legal order.

Hosting logs

Like any internet service, our providers’ servers record routine details of each request they receive, such as the IP address, the time and the requested address.

• Supabase (our database host, Pro plan) keeps its request logs for 7 days. We cannot delete individual log entries. We do not copy these logs anywhere else.
• Cloudflare, which hosts the website, processes request data such as the IP address to serve the pages, as our processor under its data processing terms, and keeps it under Cloudflare’s own settings and policies. Cloudflare does not publish a fixed retention period for this data.
• Expo does not publish a retention period for push tokens.

The in-app reset cannot reach any of these logs.

The website

The website is a set of static pages. Our pages set no cookies of their own, run no analytics or advertising scripts, and load nothing from other companies; their fonts are served from our own pages. The hosting provider, Cloudflare, processes request data such as your IP address to serve the pages (see “Hosting logs”). If you email us, we receive what you choose to send.

How long we keep data

Two different things decide how long data lasts: Lotly’s own retention rules, which we control, and our providers’ logs and backups, which follow the providers’ settings and are not covered by Lotly’s rules.

Lotly’s retention rules (what we control)

We check the request record and the support mailbox by hand once a month and delete anything that would be more than 24 months old before the next check, so nothing is kept longer than 24 months.

What counts as using the app: opening it, or changing a choice in it. Receiving a notification is not use; opening the app from one is.

After 12 months without use, our server deletes that installation’s records automatically. Nothing on your iPhone is deleted. If you come back, the app sends your choices again and, if alerts are on, registers for them again. This rule starts when this policy first takes effect, so no installation’s data is deleted under it until at least 12 months after that date.

Provider logs and backups (outside Lotly’s rules)

Your choices and controls

• Change or clear your choices: Profile → Personalization. The cleared value is copied to our server.
• Turn alerts off: Profile → Notifications, or iOS Settings. In the app, this marks the registration off on our server and stops delivery. The disabled registration is kept until you reset the app or 12 months pass without use.
• Reset app and delete my data (Profile → Privacy & Data Controls):
  • Deletes everything our server holds for this installation, in one step: the copy of your choices and your allergen-alerts decision, the alert registration (including any revocation key) and its delivery records, the ordering counter, the last-opened date and any request codes.
  • Clears your choices, allergen-alerts decision, alert setting, setup progress and saved recalls from the iPhone, and creates a new installation identifier. Lotly then starts setup again from the beginning.
  • Keeps your subscription. It does not cancel it; Apple and RevenueCat keep their records.
  • If the server can’t be reached, nothing changes and you can try again.
• Deleting the app is not a deletion request. The app can’t contact our server when it is deleted. Use the reset first. If you delete the app without resetting, our server’s records are deleted automatically 12 months after you last used it.

Requests about your data

You can see, export, correct, and delete your data in the app. The request then comes from your own installation, so nothing more is needed to confirm it:

• See and export: “Show what Lotly’s server holds” (Profile → Privacy & Data Controls) lists everything our server stores for your installation and the service providers that process it. “Share as file” saves the same list as a file. Two things are left out on purpose: the installation identifier, which works like a password for this data, and all but the last four characters of the push token. The revocation key described in “Children and teens” is not listed either.
• Correct: change your choices in the app.
• Delete: “Reset app and delete my data”.
• Withdraw allergen consent: see “Allergen choices”.

By email.

• Get a code. In the app, tap “Get a request code” (Privacy & Data Controls) and choose what you want: “Email me a copy of my data” or “Delete my data”. Tap “Create code”, then email the code to lotlysupport@gmail.com.
• What the code can do. It works once, expires after 14 days, and only lets us find your installation for the request you chose. It cannot change anything by itself. At most three codes can be live at a time.
• What we never ask for. Your installation identifier. Never send it.
• Anything else. To ask for data that is not on our server, such as your emails to us, get a code for a copy of your data and say what you want in your email.
• If you no longer have the app, reinstalling Lotly on the same iPhone usually brings your installation back, because iOS keeps it in secure storage. Privacy & Data Controls is then available again, from the subscription screen if your subscription has ended.
• If that isn’t possible (for example, a new or erased phone), we cannot confirm which records are yours: Lotly has no accounts, and many people make the same choices. We will reply in writing, explain why, and tell you how to appeal. Our server’s records are still deleted automatically 12 months after the app was last used.

Timing and appeals.

• Lotly answers within 45 days of receiving your request, and deletes within 30 days of checking your code (usually the same day); a deletion is never extended. If another request needs more time, Lotly can extend it once, by up to 45 more days, and tells you why within the first 45 days.
• Supabase makes daily database backups. Its documented retention period for our plan is seven days. Deleted records may remain in those backups until the backups expire.
• If we decline a request, reply “Appeal”. We answer within 45 days and, if we deny it, tell you how to contact your state attorney general.
• We never charge for requests.

Children and teens

Lotly is intended for adults, and we market it to adults. You may use Lotly if you are 13 or older. If you are under 18, you may use it only with the permission of a parent or guardian, who should review this policy with you. Lotly is offered only in the United States.

• We never ask for your date of birth. Each time the app starts on iOS 26 or later, it asks Apple for your age range (for example “13 to 15” or “18 or older”) through Apple’s age-range feature.
  • Where state law requires it, Apple provides the range and you cannot decline. Elsewhere, sharing it is your choice.
  • The range is used only to apply these rules, and it is never sent to Lotly’s server or to anyone else. If you are under 13, the app stops with “Lotly is for ages 13 and up.” If recall alerts were turned on earlier on that iPhone, the app asks Lotly’s server to turn them off, sending only the app’s installation identifier.
  • The app keeps Apple’s latest answer (the range, how it was declared, and when) on the iPhone. If Apple cannot answer later, the app reuses only an under-13 answer, and only to stop the app; a stored answer is never used to allow anything. “Reset app and delete my data” does not clear it.
  • If Apple tells the app that you are 13 to 17 and that your state’s law requires age checks, and you turn on recall alerts, the app sends Lotly’s server Apple’s identifier for your download of Lotly. Alerts turn on only once the server has stored it; if the app cannot read that identifier, alerts stay off. The server keeps it only as a keyed hash, with your alert registration. This hash is pseudonymous personal data, not anonymous: it does not name you, but Lotly can link it to your installation. It is used for one thing: when Apple tells Lotly that a parent or guardian has withdrawn consent, Lotly turns off that alert registration. It is deleted with your alert registration, for example by “Reset app and delete my data”.
  • On iPhones running a version of iOS earlier than 26, Apple’s feature does not exist and the app does not ask. There, these rules rest on our Terms of Use, which you agree to by using Lotly.
• Children under 13. Lotly is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 is using Lotly, email lotlysupport@gmail.com. “Reset app and delete my data” deletes the server records immediately.
• Teens get the same protections as everyone. Lotly has no ads, no profiling, no sale of data, no location tracking, no social features and no way to contact other users. Allergen choices are stored on our server only with the consent described in “Allergen choices”.
• What a parent’s permission does not do. A parent’s or guardian’s permission to use Lotly is not a substitute for any consent a law requires, such as the allergen consent in this policy.

Where information is processed

Lotly is offered only in the United States.

• Our database is hosted by Supabase in Northern California, USA (AWS us-west-1).
• Our providers may process information in other countries under their own terms.

Security

• Communication between the app and our servers is encrypted in transit.
• Our database lets the app reach only its own installation’s records, through narrow functions. The app holds no server secrets.
• Identifiers and choices on the iPhone are kept in the iOS Keychain.
• Request codes and the revocation key are stored only as one-way hashes.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorization. If a breach affects your information, we will give notice as the applicable laws require. Lotly holds no email or postal address for you, so notice would generally be a notice on our website together with notice in major media, and, where a law requires it, a toll-free phone number. In-app messages may add to that notice; they do not replace it.

Changes to this policy

If we change this policy, we will post the new version on this page with a new effective date. For a material change, we will post it at least 30 days before it takes effect and also tell you in the app, in Privacy & Data Controls. We will not use allergen choices in a new way without asking for your consent first.

Contact

Willis Yang: lotlysupport@gmail.com