Privacy policy

Controller and purposes

ArchiusComus is the controller for Viggan. Contact and privacy requests: viggan.support@archiuscomus.com. We use data to provide the food estimates, logging, planning and account functions you request, and to operate and secure the service. We do not sell personal data or use food or health information for advertising.

Data in your browser

Without an account, your profile, goals, food log, saved meals, food stash and ingredient preferences are stored in your browser. The app uses IndexedDB, localStorage and caches to operate. Meal plans added manually to the calendar also stay on this device. Local data does not automatically move between devices. Signed-in users may also have local data on their devices. Image analysis and barcode lookups use online services even without an account.

Account and server storage

Amazon Cognito processes your email, password and user identifier for authentication. Viggan’s own backend does not store your password. Your account stores your profile (such as age, height, weight, activity and goals), settings, consent timestamp, food entries and plate photos you separately save. Redeemed campaign identifiers and benefit periods are stored to manage access. The ordinary food stash and locally saved meals are not fully synchronized to your account.

If you submit a meal suggestion using the separate sharing option, it is saved to your account for later review. Suggestions are not automatically published to other users.

Preferences, meal plan and shopping list

You can indicate ingredients you like or dislike. Signed-in preferences are synchronized to your account. Plus planning uses them with your selected dates, meals, servings and preparation time to select recipes from the app’s recipe collection. Preferences are not sent to OpenAI for this planning.

Your current plan, settings, recipes, quantities and meal locks are stored on your account, along with shopping quantities, purchased marks, declared pantry quantities and manual additions. Creating a new plan replaces the current plan according to the app’s rules. Planned meals are not automatically logged as eaten. Preferences are not an allergy record and do not guarantee food suitability. Suggestions support your choice; they do not make legally or similarly significant decisions about you.

Camera and external lookups

Barcode recognition runs in your browser. The product code is sent to Open Food Facts for product information; the direct request also exposes ordinary connection information such as your IP address. Product data is licensed under ODbL.

When you select an image for interpretation, it may be sent to AWS Textract for text recognition. Plate and menu images are resized and sent through Viggan’s server to the OpenAI API. Menu interpretation may also include your selected goal and language. Avoid unnecessary people, documents or other personal information in images. OpenAI does not use API content for model training by default. This integration does not use a separate zero-retention setting; OpenAI’s default retention includes approximately 30 days of service and abuse-monitoring data, subject to its terms and exceptions.

Providers and processing locations

AWS provides website delivery, authentication, text recognition and storage. The primary storage location for account data and saved plate photos is AWS Ireland in the EU. Connections are encrypted and user images use private storage. This does not mean that all processing occurs in the EU: global delivery, OpenAI and other external services may process connection or analysis data outside the EEA, including in the United States. Provider privacy links below explain their processing and transfer safeguards; you can ask us for details of the arrangements relevant to your data.

Technical logs and browser storage

Server and delivery logs may contain IP addresses, browser/device details, requested addresses, timestamps, response codes and errors. They support operation, abuse monitoring and weekly visitor estimates. Estimates use IP addresses and browser details; the source data is not fully anonymous. Reporting does not require food logs or health data. Short-lived request counters limit scanning usage.

Viggan does not use advertising tracking pixels. Browser storage supports the app and authentication. An optional YouTube video uses privacy-enhanced embedding, but loading or playback may transmit data to YouTube; we do not guarantee that third-party services are cookie-free.

Legal bases and retention

Managing your account and requested service functions is based on performance of the service contract. Account storage of health-related profile and food information is based on your explicit consent. Security, troubleshooting and visitor measurement rely on our legitimate interest in operating and improving the service.

Local data remains until you delete it or the browser clears it. Account data remains until you delete data or the account; the app’s history viewing limit does not delete older entries. A new plan replaces the current plan. Unconfirmed image uploads expire under a storage lifecycle rule after approximately one day. Deleted data may remain in backups for a limited period. Production technical logs currently have no automatic expiry configured and remain until removed by the operator. External services apply their own retention practices.

Your controls and rights

You can edit your profile and preferences, delete individual food entries and download account data using the export function. Account deletion removes preferences, the plan, shopping list, campaign benefits, images and authentication account from active account storage. Clearing local data alone does not delete your cloud account. Account deletion does not remotely clear other devices or downloaded exports.

You may withdraw consent for storing health information by deleting your account or contacting us; withdrawal does not affect the lawfulness of earlier processing. You may request access, correction, deletion, restriction or portability, and object to legitimate-interest processing where applicable. You may complain to the Finnish Data Protection Ombudsman or your local supervisory authority. Providing data is voluntary, but account functions, synchronization and Plus planning require relevant data to operate.