SOKEN
Privacy Policy
Last updated: August 5, 2026
SOKEN is a food-scanning app. You photograph what you eat, SOKEN analyses the photo, and the app shows you how your eating is tracking over time.
This policy explains what happens to your information: what stays on your phone, what leaves it, who else sees it, how long it is kept, and how to get rid of it. It covers the SOKEN mobile app and this website.
SOKEN is published by FO Squad, Inc., a Nevada corporation, doing business as SOKEN. In GDPR terms, FO Squad, Inc. is the data controller. Where this policy says “we”, it means that company.
Questions, requests, or complaints: support@sokenhealth.com.
The short version
- Almost everything you tell SOKEN about yourself — your name, your body, your goals — never leaves your phone.
- What does leave it: your email address, your food photos, the results of the analysis, and whether you are subscribed. That is the whole list.
- Your food photos are sent to Anthropic, the AI company whose model performs the analysis.
- There is no crash reporting, no analytics, no advertising, and no tracking of you across other apps or websites.
- We do not sell or share your personal information. We never have.
- Deleting your account deletes your entire scan history, for good.
This summary is here to be useful, not to be the agreement. The sections below are the actual policy.
1. What stays on your device
Everything you tell SOKEN about yourself is stored only on your phone, in the app’s own storage. None of it is uploaded. There is no copy of it on any server, including ours.
That list is:
- Your name and username
- Your profile photo
- Your date of birth
- Your gender
- Your country
- Whether you prefer metric or imperial units
- Your height, your weight, and your goal weight
- The goals you picked, including any goal you typed yourself
- Your answers to the onboarding questions: what you find hardest, how confident you feel shopping for food, and how you rate your nutrition knowledge
Two consequences follow from this, and both are worth knowing. If you delete the app, this information is gone — we cannot restore it, because we never had it. And if you sign in on a new phone, your profile starts empty, unless your phone’s own backup (iCloud or Google) restores the app’s data for you. That backup is between you and Apple or Google; we are not part of it.
2. What leaves your device
Here is everything that does, item by item, with why it is needed. Nothing outside this section leaves your phone.
2.1 Your email address
When you create an account, your email address is sent to Supabase, which runs our authentication, database, and file storage. It is used for two things: sending you the sign-in link that gets you into the app, and identifying which account is yours.
That is all. We do not have a mailing list. We do not send marketing email, and we do not give your address to anyone who does.
2.2 Your food photos, stored
When you scan a meal, the photo is uploaded to a private storage bucket at Supabase. Private means exactly that: the files are not served at a public address, and there is no URL anyone can guess or share.
When the app needs to show you one of your own photos, our server creates a temporary signed link for it. Those links expire after six hours. The database stores only the file’s internal path, never a link.
2.3 Your food photos, analysed
To analyse a photo, we send it to Anthropic, an AI company in the United States. Their model looks at the image and returns the analysis that becomes your verdict. There is no way to use SOKEN’s scanning without this happening — it is how the product works, and you should know it before you photograph your dinner.
What is sent is the photo and the analysis instructions. Your email address, your account identifier, your name, and everything in section 1 are not sent. Anthropic receives a picture of food with no idea whose it is.
If you describe a meal in words instead of photographing it, that text is sent the same way, for the same reason.
Anthropic handles what it receives under its own privacy terms, at anthropic.com/legal/privacy. We do not control how long Anthropic keeps an API request.
2.4 The result of the analysis
The analysis itself is saved to our database so your history survives closing the app. Each saved scan holds: the verdict, the score, the points that made up that score, the organ signals and disqualifiers the analysis found, the processing band, the name the model gave the food, a short summary, and the time you scanned it.
Every one of those records is tagged with your account. Every query the app makes filters on it, and the database has its own rules on top that stop one account reading another’s rows. You cannot see anyone else’s scans and they cannot see yours.
2.5 Barcode lookups
If you scan a barcode, our server looks that number up in two public food databases, Open Food Facts and the USDA FoodData Central database, to get the product’s name and brand. Only the barcode number is sent. Nothing that identifies you goes with it, and the request comes from our server rather than your phone.
2.6 Your subscription status
Subscriptions are handled through RevenueCat, which tells the app whether your subscription is active. The payment itself is taken by Apple or Google through your app store account, under their terms.
SOKEN never sees your card details. We do not receive your card number, your billing address, or anything else about how you paid. We only learn whether you are subscribed.
3. What SOKEN does not collect
This section is as important as the last one, and it is unusual enough to be worth spelling out.
- No crash reporting. The app contains no crash-reporting service. The one that came with the project template was replaced with an empty stub whose every function does nothing. When SOKEN crashes, we do not find out.
- No analytics. There is no analytics SDK in the app. No Segment, no Amplitude, no Mixpanel, no Firebase, no Google Analytics, no PostHog, none of their competitors. The app keeps a short list of in-app events in memory to help during development; it is never written to disk and never transmitted, and it disappears when the app closes.
- No advertising, and no tracking. There are no advertising SDKs. We do not read your advertising identifier (IDFA on iOS, Advertising ID on Android), we do not build a profile of you, and we do not track you across other apps or websites. SOKEN has nothing to ask you for tracking permission about.
- No location. The app does not ask for your location and does not collect it.
- No contacts, and no other apps. We do not read your address book and we have no way of knowing what else is installed on your phone.
- No push tokens. Reminders are scheduled by your own phone, locally. There is no push server, and no token is registered with one.
4. Who else sees your information
The complete list of companies that receive anything, and what each one gets:
| Who | What they receive | Why |
|---|---|---|
| Supabase | Your email address, your food photos, and your saved scan results | They host the account system, the database, and the files |
| Anthropic | Your food photos, or your typed description of a meal, with no identifying information attached | Their model performs the analysis |
| RevenueCat | Whether you have an active subscription, tied to an app-specific identifier | To tell the app whether to unlock paid features |
| Apple and Google | Your payment, under their own terms | They run the app stores and take the money |
| Open Food Facts and USDA FoodData Central | A barcode number, with nothing attached | To identify a packaged product |
Nobody else receives your information. We do not sell it, rent it, trade it, or hand it to advertisers, brokers, or insurers. There is no arrangement under which anyone pays us for it.
We would disclose information if the law genuinely required it — a valid court order, for example — or if it were necessary to protect someone’s safety. If SOKEN were ever sold or transferred to someone else, your information could move with it; you would be told before that happened, and this policy would keep applying until you were given a new one.
5. How long we keep it
| What | How long |
|---|---|
| Your email address and account | Until you delete your account |
| Your food photos | Until you delete your account. There is no automatic expiry |
| Your saved scan results | Until you delete your account. The history is the product, so it is kept as long as the account exists |
| Everything in section 1 | On your phone only, for as long as the app is installed. Use Delete account in the app, or delete the app, and it is gone |
| Subscription records | Held by RevenueCat and by Apple or Google under their own retention rules |
| Anything sent to Anthropic | Governed by Anthropic’s own retention policy, which we do not control |
6. Deleting your account
Email support@sokenhealth.com from the address on your account and ask us to delete it. We will do it within 30 days and confirm when it is done. We will not ask you to justify the request.
Deleting your account removes:
- Your account record, including your email address
- Every scan you have ever saved. This is enforced by the database itself: the scan records are tied to your account with a rule that deletes them along with it, so it is not a cleanup step anyone can forget
- The photo files those scans point to
There is also a Delete account option inside the app, and it does the whole job: everything in the list above, plus everything held on your phone — your profile, your settings, your on-device history — and it signs you out. If any part of it fails, the app tells you so and stops: you stay signed in, nothing on your phone is cleared, and you can try again. Email us as above if you would rather we did it, or if the button will not work for you.
Two honest caveats. First, if a temporary signed link to one of your photos was already issued before you deleted your account, it can still work until it expires — at most six hours. Second, our database provider keeps routine backups, so a deleted record can survive inside a backup until that backup rotates out of existence. In neither case is the data reachable through the app or used for anything.
7. How we protect it
- Photos live in a private storage bucket. Nothing is served publicly, and the database never stores a link — only an internal path.
- When a photo does need to be shown, it is shown through a signed link that expires after six hours.
- Every scan record carries the account that owns it. Every query filters on that, and the database enforces per-account rules of its own as a second layer.
- Everything in transit is encrypted with TLS — between the app and our server, and between our server and every company in section 4.
- The key that lets us call the AI model lives on the server only. It has never been in the app, where anyone could pull it out.
No system is perfectly secure, and it would be dishonest to claim otherwise. What we can say is that we have kept the amount of data worth stealing as small as the product allows.
8. Where your information is processed
SOKEN is run from the United States, and every company in section 4 processes data in the United States. If you use SOKEN from the UK, the EEA, or Switzerland, your information is transferred there.
The United States has not been found to offer the same level of data protection as the EEA in general terms. Where our providers offer them, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) as the safeguard for those transfers, alongside the technical measures in section 7.
9. Your rights in the UK and the EEA (GDPR)
If the GDPR applies to you, you have the right to:
- Access the personal data we hold about you, and get a copy of it
- Rectification — have anything inaccurate corrected
- Erasure — have it deleted (see section 6)
- Restriction — have us pause using it while a dispute is sorted out
- Portability — receive your data in a machine-readable format, or have it sent to another service
- Object to processing we carry out on the basis of legitimate interests
- Withdraw consent at any time, where consent is what we rely on. Withdrawing it does not undo what was lawful before
- Complain to a supervisory authority in the country where you live or work. In the UK that is the Information Commissioner’s Office; in the EEA it is your national data protection authority. You do not have to come to us first, though we would like the chance to fix it
To exercise any of these, email support@sokenhealth.com. We will respond within one month. There is no charge.
Legal bases
| What we do | Legal basis |
|---|---|
| Running your account, analysing your scans, keeping your history | Performance of a contract — Article 6(1)(b). This is the service you asked for |
| Handling food and scan information that may count as health data | Your explicit consent — Article 9(2)(a). You give it by choosing to scan a meal, and you can withdraw it by deleting your account |
| Keeping the service working and preventing abuse | Legitimate interests — Article 6(1)(f). Our interest is a service that stays up and is not abused; we consider that this does not override your rights, given how little data is involved |
| Keeping records we are required to keep | Legal obligation — Article 6(1)(c) |
Automated decisions
SOKEN scores food automatically. That score is information about food, not a decision about you: it has no legal effect and nothing similarly significant turns on it. No automated decision-making within the meaning of Article 22 takes place.
10. Your rights in California (CCPA/CPRA)
In the last twelve months we have collected these categories of personal information:
- Identifiers — your email address
- Visual information — your food photos
- Commercial information — whether you have an active subscription
- Inferences — the verdicts and scores produced from your scans
Each was collected for the purposes described in section 2, from you, and disclosed only to the service providers listed in section 4.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the last twelve months, and we have no plan to. There is no “Do Not Sell or Share My Personal Information” link on this site because there is nothing to opt out of. A Global Privacy Control signal has nothing to act on here for the same reason.
You have the right to:
- Know what we have collected about you, where it came from, why, and who received it
- Get a copy of it
- Have it corrected
- Have it deleted
- Limit our use of sensitive personal information. Food and health information can count as sensitive. We use it only to provide the app you asked for, which is a permitted purpose; we do not use it to infer characteristics about you for anything else
- Not be treated differently for exercising any of these rights. The app works the same either way
Email support@sokenhealth.com to make a request. We will verify it by replying to the email address on the account, since that is the only identifier we hold. You may use an authorised agent; we may ask for proof of their authority.
11. Cookies
This page sets no advertising cookies and runs no analytics scripts. If you sign in on the website, a cookie strictly necessary to keep you signed in may be set. That is the only kind used.
12. SOKEN is for adults only
SOKEN is not for anyone under 18. You must be 18 or older to create an account or use the app.
We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete the account and everything attached to it. If you believe a child has given us information, email support@sokenhealth.com and we will act on it.
13. SOKEN is not medical advice
SOKEN presents published research. It is not a medical device, it does not diagnose or treat anything, and it is not a substitute for a qualified healthcare professional. Its analysis is produced by an AI model and can be wrong.
The full disclaimer is at the top of the Terms of Service, and it is the most important thing on either page. Please read it.
14. Changes to this policy
If this policy changes, the “Last updated” date at the top changes with it, and the new version appears here.
If a change is significant — a new company receiving your data, a new category of information collected, or a new purpose — we will tell you in the app before it takes effect, and give you the chance to delete your account first. We will not quietly widen what we collect and date-stamp it.
15. Contact
FO Squad, Inc.
support@sokenhealth.com
A postal address is available on request for anyone who needs one to exercise a legal right.