Your privacy, plainly stated.

Your account

• Your email address and display name.
• A password hash (bcrypt — we can't read your password), if you use one.
• If you sign in with Google or Apple, the ID that provider gives us for you, and the name and email address it shares (with Apple this may be a private relay address).
• Whether your email is verified, and when and to which version of the notice you gave health-data consent.
• Where you first came from, recorded once at sign-up: the campaign tags in the link (for example utm_source), the referring website's domain, and the page you first landed on.

Your health information — only what you choose to enter

• The medicines you save: the NDC code, the label text, and anything you add — a nickname, who the medicine is for (a person tag, which may be a family member you care for), notes, lot number, quantity, days' supply, start date and expiry date. If you enter details about someone else, please make sure they're happy for you to.
• Your allergies, so the app can flag medicines that match them.
• An emergency contact (name, phone number, relationship), if you add one.
• Dose schedules: the times you want reminders, and your time zone.
• Your accessibility settings (text size, contrast, read-aloud voice and speed, which label sections to show).

Devices, payments and security

• A random device ID created by the app on your phone or browser. We store only a salted, one-way hash of it, to enforce one free trial per person.
• A notification address for each phone or browser you turn alerts on for — a push token issued through Expo for the phone app, or your browser's push address (and its browser name) on the web. It's deleted when you sign out on that device, turn its notifications off, remove it in Settings → Recall alerts, when the device stops accepting our notifications, or when you delete your account.
• Subscription records: which store or Stripe billed you, the plan, status and dates, and the purchase identifiers Apple, Google or Stripe issue. We never see or store your card number.
• A security log: sign-ins, sign-outs, password resets, consent changes, exports, shares, saved medicines and photo identifications, each with the time, your IP address and your browser or device's user agent. It is deleted automatically after 90 days, and straight away if you delete your account.
• A record of which reminder, recall and getting-started emails we've sent you, so you never get the same one twice.

Stored only on your device: your sign-in token, the list of medicines you recently viewed (cleared when you sign out), the device ID above, and your display settings before you sign in.

• Barcodes and 2D codes are decoded on your own phone; only the code is sent to us.
• Photo identify: if you photograph a label, the photo is sent to Groq, which reads the NDC and the brand name, generic name and strength printed on it. If Groq can't take the request, the same photo goes to our backup reader, DeepInfra, instead. The photo is then discarded — we never write it to disk, cache it or log it. You confirm what it read before anything is saved.
• Plain-English directions (optional, off unless you switch it on): the FDA label's directions are sent to Groq (or, if Groq can't take the request, DeepInfra) to be rewritten in simpler words. That text is the manufacturer's public label, not anything about you. The rewrite is shown labelled “AI-generated — verify with your pharmacist”, with the FDA original a tap away.
• Under our agreement Groq may not use inputs or outputs to train any model, and we have Zero Data Retention enabled, so Groq does not store the photo or the text. Processing happens in the United States.
• DeepInfra holds a photo or label text only in memory while working on it and deletes it as soon as it answers; it never writes it to disk and does not use it to train any model.

A share link is how you show your list to a family member or caregiver without them signing up. Anyone with this link can see the medicines in this list, your display name, the label text, and which of your allergies each medicine matches — until you revoke it. It never shows your email address, password, emergency contact, notes or settings. You can revoke a link at any time in Share, and deleting your account revokes all of them.

No advertising, no ad pixels, no Google Analytics, no Meta pixel, no product analytics — and we never sell your data. The iPhone and Android apps have no analytics at all.

This website uses one measurement tool, Cloudflare Web Analytics. It counts page views on every page of this website: the address of the page, the referring site, your country and your device type. It is cookieless and does not follow you to other sites.

We use these service providers to run VerifyDrugLabel. This is all of them, and what each one receives.

• Railway — hosts our server and database, so your account and everything above lives on their infrastructure.
• Cloudflare — serves this website and sits in front of our API, so every request passes through it (your IP address and the request itself), plus Web Analytics above.
• Groq — label photos and label directions, as described under Photos and AI.
• DeepInfra — label photos and label directions, only when Groq can't take the request, as described under Photos and AI.
• Drug databases, queried by our server with only the code or name being looked up — never your identity or IP address: the FDA's openFDA and NIH DailyMed (labels and recalls), the National Library of Medicine's RxNav (drug names and ingredients), the CMS NADAC dataset (typical pharmacy prices), and UPCitemdb and Go-UPC (to identify a retail barcode).
• Resend — sends our email (sign-in, verification, password reset, FDA recall alerts, and getting-started tips). Receives your email address and the message.
• Expo — relays the phone app's push notifications (receives the push token and the notification text) and delivers app updates (sees your IP address and app version when the app checks for one).
• Apple — Sign in with Apple; App Store subscriptions; and push delivery to iPhone and iPad.
• Google — Sign in with Google; Google Play subscriptions; and push delivery to Android.
• Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser) — delivers browser notifications you turn on. It receives an encrypted message it cannot read.
• Stripe — handles web payments, including your card details and billing email.
• Sentry — receives crash and error reports so we can fix bugs. Web addresses in reports have searches and link codes removed, request bodies are never sent, and your IP address is not included.

A recall or reminder notification's text never names your medicine on the lock screen of the phone app: a recall alert says there is an FDA recall on a medicine you saved, and you open it to see which. Browser dose reminders do name the medicine, which is why signing out takes that browser off your reminders.

Information about your medicines is health data. We process it only with your explicit consent, which you give separately from these terms — an unticked box at sign-up, or the consent screen the first time you open the app. You can withdraw it any time in Settings → Health data consent. Withdrawing stops us processing it: our server refuses to save, look up or share medicines for your account until you agree again, and you can then export your data or delete your account.

• Sign-in, verification and password-reset emails, when you ask for them.
• FDA recall alerts about medicines you've saved, while your free trial or subscription is active. They can't be switched off while it is, and they stop when your trial or subscription ends.
• A few getting-started tips during your free trial and occasional product news. Turn them off in Settings → Emails or with the unsubscribe link in any of them.

• Export (Settings → Your data): a JSON file of everything we hold about you — profile, preferences, allergies, emergency contact, saved medicines with all their details, dose schedules, share links, push devices, recall alerts sent, subscriptions, your trial record, the emails we've sent you and your security log. Passwords and live link and device tokens are left out, because the file is easy to forward.
• Correct: edit your medicines and settings in the app, or email us to change your email address.
• Delete a medicine from History at any time.
• Notifications: turn push alerts off in Settings, or block them in your phone or browser settings.
• Delete your account (Settings → Danger zone): immediate and permanent — see what deleting removes and what stays. A web subscription is cancelled at the same time; App Store and Google Play subscriptions must be cancelled in the store.
• Depending on where you live (for example California, Washington, the EU or the UK) you have rights to access, correct, delete and port your data, and to object to or restrict processing. Email us to use any of them; we don't discriminate against anyone who does.

• Your account and health information: until you delete them or your account.
• The security log: 90 days, then deleted automatically.
• After you delete your account: your normalised email address and the salted hash of your sign-up device, linked to nothing else, so the same person can't start a second free trial; and a deletion record with no email or IP address, purged after 90 days.
• Database backups age out on our host's schedule and are only used to recover from a disaster.
• Payment records are kept by Stripe, Apple and Google under their own rules.

• Every connection uses HTTPS; plain HTTP is refused.
• Every request is checked against your account: you can only reach your own data, except through a share link you created.
• Your sign-in token expires automatically, and signing out revokes it on our server.
• Logs record a hash of your email address, never the address itself.

VerifyDrugLabel is for adults: you must be 18 or older to use it. It is not directed to children under 13 (under 16 in the EU), and we don't knowingly collect their personal information. If you believe a child has given us information, email us and we will delete it.

Email privacy@duskfieldstudios.com and a real human will reply. If we change this policy in a way that matters, we'll update the date at the top and tell you in the app or by email before it takes effect.