Privacy policy

Norva · last updated 16 August 2026

The short version

Norva has no account, no server and no analytics. Everything you enter and everything you scan stays on your phone. What leaves it goes to two places, and only two: Open Food Facts, to look food up — the barcode you scanned, the aisle you are asking about, and the product photos the app displays — and, only if you subscribe, the service that checks your subscription is still valid. That second one never learns anything about your food.

What stays on your phone

Stored in a database on your device and nowhere else:

• Your profile — first name if you gave one, sports, goals, sessions per week, body mass if you gave one, and any foods you said you don't eat.
• Your scan history — the products you scanned, when, the grade each was given, and whether you said you took it or put it back.
• Cached product data — nutrition facts fetched from Open Food Facts, kept so the app works offline and to avoid re-asking for the same product.
• Your settings — theme, language, and whether the Sunday reminder is on.

None of this is transmitted anywhere. Uninstalling the app deletes all of it.

What leaves your phone

Every request in this section goes to Open Food Facts and nowhere else. Each one carries your device's IP address, as any web request does, so Open Food Facts can see what is being looked up from your connection. They are a non-profit collaborative database and their own privacy policy governs what they do with it.

The barcode you scan. When you scan a product, Norva asks for its nutrition data. There is no other way to get the facts for a product you have just picked up.

The aisle, when the app looks for a better option. To answer "better, in the same aisle" it searches that product's category. That request carries the category and the country your phone's region setting reports — without it the search answers on the whole database and could name a product sold five thousand kilometres away. It never carries your profile, your history or your grades.

Product photos. The app shows the picture Open Food Facts holds for a product, on the product screen and in your history. Loading a picture is a request for that picture, so opening your history asks for the photos of the products in it.

If you tap a scientific source in Method and sources, your browser opens PubMed. That is a normal web visit, subject to PubMed's policy.

Nothing else is sent to Open Food Facts, ever — not your profile, not your scans, not your grades, not your settings.

The subscription check

One other service is involved: RevenueCat, which answers a single question — does this device hold an active subscription?

It is asked every time the app starts, whether or not you have ever subscribed. That is deliberate, and it is what keeps the answer honest: a subscription can lapse, be refunded, or be cancelled from your store account, and none of those pass through Norva. Asking only at the moment of purchase would leave the app showing a subscription that no longer exists — or hiding one you had just restored on a new phone. The same call is what fetches the prices the paywall shows, so that they come from your store rather than from us.

What it receives: an anonymous identifier generated on your device, your device's IP address as any web request carries, and whether this install is permitted to show you notifications. If you subscribe, it also receives the store receipt and which plan you took. There is no account behind that identifier, nothing links it to your name or your email, and it is not shared between apps.

What it never receives: your profile, your scans, your grades, your body mass, your goals, your settings. Nothing about your food goes anywhere near it.

Uninstalling the app ends this.

What Norva does not do

• No account, no sign-in, no email address.
• No analytics, no crash reporting, no advertising, no tracking of any kind.
• No profiling, no automated decision-making about you.
• Nothing about you or your food is ever sold, shared or used for advertising — including the subscription check, which exists to answer one question and is never used for anything else.

Subscriptions

Payment is handled entirely by the App Store or Google Play. Norva never sees your card, your billing address or your store account. It receives one answer — whether this device holds an active subscription — and stores that answer on the device.

That answer is checked through RevenueCat, described above. It is the only thing in this app that talks to a service about you, it happens only if you subscribe, and what it exchanges is a receipt and an anonymous identifier.

The camera

The camera is used to read barcodes and nothing else. No image is captured, stored or transmitted. The frames are read for a barcode and discarded.

Notifications

On by default, and one switch turns every one of them off — Profile → Notifications. Your phone asks its own permission the first time as well, and refusing it there settles the matter until you change it in your phone's settings.

Everything Norva sends you is scheduled by your phone, locally — the Sunday review, the warning the day before a trial charge, all of it. No server is involved and nothing is sent to us; there is no "us" to send to. Whether your phone granted that permission is the one thing reported to the subscription check above, because nothing else would ever tell us whether the promise of a warning can be kept.

Your data, your control

• Export — Profile → Your data → Export a backup writes a JSON file and hands it to your phone's share sheet. You choose where it goes; it is not uploaded anywhere on your behalf.
• Delete — press and hold a scan in your history to select scans and delete them, or clear the whole history at once. Uninstalling removes everything, permanently.
• Share a verdict — the card is drawn on your phone and saved to its temporary storage, then handed to the share sheet. Where it goes next is whatever app you pick, and that app's policy applies from there. The card deliberately carries no first name and no history.

There is no data to request from us, correct with us, or ask us to erase, because we hold none. Under GDPR terms: we are not a data controller for anything you enter, since it never reaches us.

The one exception is the subscription record described under If you subscribe — an anonymous identifier and a store receipt, held by RevenueCat on our behalf as a processor. Write to the address below and we will have it erased; it contains nothing about you beyond the fact that a purchase was made.

Health data

Norva explains how foods relate to training outcomes. It does not diagnose, treat or prevent any condition, and does not replace advice from a doctor or a registered dietitian. It is not a medical device.

Children

Not directed at children under 13.

Changes

If a future version starts collecting anything, this policy changes first and the app says so before it does.

Contact

Norva is published by Killian Doubre, 5B Rue Léon Bertrand, 06200 Nice, France.

Questions about this policy, or about anything the app does with your data: contactnorvaapp@gmail.com

That email address is also the one Norva identifies itself with when it asks Open Food Facts for a product, as their API requires.