Privacy policy

This Privacy Notice for Dry Cereal Corp Pty Ltd (doing business as Milo) ("we", "us" or "our") describes how and why we might access, collect, store, use and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Download and use our mobile application, Milo, or any other application of ours that links to this Privacy Notice.
• Visit our website at https://milofoodscanner.com or any website of ours that links to this Privacy Notice.
• Engage with us in other related ways, including support requests, sales, marketing or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@drycerealcorp.com.

Table of contents

• 1. What information do we collect?
• 2. How do we use your information?
• 3. What legal bases do we rely on?
• 4. When and with whom do we share your information?
• 5. Do we use cookies or tracking technologies?
• 6. Do we offer artificial intelligence features?
• 7. How do we handle Sign in with Apple and Google?
• 8. What happens to products and photos you add?
• 9. Is your information transferred internationally?
• 10. How long do we keep your information?
• 11. How do we keep your information safe?
• 12. Do we collect information from children?
• 13. What are your privacy rights?
• 14. Controls for Do-Not-Track features
• 15. Do United States residents have specific privacy rights?
• 16. Do other regions have specific privacy rights?
• 17. Do we make updates to this notice?
• 18. How can you contact us about this notice?
• 19. How can you review, update or delete your data?

1. What information do we collect?

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you create an account in the app, add or correct a product, make a purchase, or otherwise contact us.

Account information. Milo uses Sign in with Apple and Google Sign-In. There is no email and password sign-up. When you sign in we receive an identity token from Apple or Google and may collect:

• your email address (Apple lets you hide your real email and share a private relay address instead);
• your name, if you choose to share it;
• your profile picture, if your Google account has one.

Activity in the app. When you are signed in we store, against your account:

• Scan history: the barcode of each product you scan and the date and time you scanned it, so we can show your History and keep it in sync between devices.
• Pantry: the barcodes of products you save to your Pantry and when you saved them.
• Products you add or complete: product details you type in (name, brand, category, ingredients, nutrition values, market) and up to three photos you take of the packaging. See section 8 for how this content is published.

Preferences stored only on your device. The answers you give during onboarding and in Settings, including who you are shopping for, your goals, the allergens and dietary restrictions you want Milo to flag, the additives you want to track, and any notification or reminder choices, are stored in the app on your phone. They are not uploaded to our servers, and they are removed when you delete the app. If you reinstall Milo or move to a new phone you will be asked for them again.

Payment data. Purchases of Milo Premium are made through Apple's App Store. We never see your card number or billing address. Apple handles all payment data under its own privacy policy at apple.com/legal/privacy. Our subscription provider RevenueCat receives purchase records (product purchased, price tier, purchase and expiry dates, and an anonymous app user ID it generates) so the app can tell whether your subscription is active.

Support requests. If you email us we keep your email address and the contents of the conversation so we can respond and improve the app.

Sensitive information. We do not process sensitive personal information on our servers. Health related preferences such as allergies stay on your device, as described above.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.

Application data

If you use our application we may collect the following information if you choose to give us access or permission:

• Camera. Milo asks for camera access to scan barcodes and to photograph packaging when you add a product. Barcode reading happens on your phone. No video is recorded and no camera frames leave your device other than the photos you deliberately take and submit. You can change this permission in your device settings at any time.
• Photo library, contacts, location, microphone. Milo does not request access to any of these. The "invite friends" step in onboarding opens your phone's Messages app with a pre-written text; Milo does not read your address book.
• Push notifications. Milo does not currently send push notifications and does not register your device for them.
• Tracking. Milo does not request permission to track you across other companies' apps and websites and does not use the advertising identifier. Analytics events are tied to a random identifier generated by the app, not to the advertising identifier.

Information automatically collected

In short: some technical information is collected automatically by the servers that run our Services.

When the app or your browser connects to our servers, our hosting providers automatically record standard technical information such as your IP address, device type and operating system version, the time of the request and the resource requested. This information is needed to operate and secure the Services and is kept in short-lived server logs.

Product analytics. The app uses PostHog to collect usage data such as the screens you open, the features you use (for example scanning, saving to Pantry, viewing swaps), the time and duration of sessions, your app version, device model, operating system version, language and country, and an anonymous analytics identifier. If you are signed in, this may be linked to your account identifier so we can understand how the app is used over time. We use this information to fix problems and improve the product. We do not use it for advertising. The website does not use cookies or analytics.

Product lookups. When you scan a barcode that is not already in our database, the app sends that barcode directly to Open Food Facts, a non-profit open database, to retrieve the product's details. Open Food Facts receives the barcode and your device's IP address under its own privacy policy. Your account, history and preferences are not sent to Open Food Facts.

2. How do we use your information?

In short: we process your information to provide, improve and administer our Services, communicate with you, for security and fraud prevention, and to comply with the law.

• To create and manage your account. So you can sign in and keep your History and Pantry with you across devices.
• To deliver the Services. To look up products, score them, show allergen and additive alerts, suggest swaps, and remember what you have scanned and saved.
• To build and publish the product database. Product details and front-of-pack photos you add are made available to all Milo users so that products can be scored and recognised. See section 8.
• To process purchases. To unlock Milo Premium and let you restore it on a new device.
• To respond to your requests and support you.
• To protect our Services. Including fraud monitoring, abuse prevention and enforcing our Terms.
• To produce aggregate, de-identified statistics such as the number of products scanned, which cannot be linked back to you.
• To comply with our legal obligations.

We do not use your information to show you advertising, we do not sell it, and we do not share your scans or preferences with food manufacturers or retailers.

3. What legal bases do we rely on to process your information?

In short: we only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases we rely on to process your personal information. We may rely on:

• Performance of a contract. Most of our processing, including account, History, Pantry and purchases, is necessary to provide the Services you have asked for under our Terms of Use.
• Consent. Where you choose to give us camera access or to submit product photos and details. You can withdraw consent at any time.
• Legitimate interests. To secure our Services, prevent abuse, and understand in aggregate how the app is used so we can improve it, where those interests are not overridden by your rights.
• Legal obligations. Where processing is necessary to comply with the law, respond to lawful requests, or defend our legal rights.

If you are located in Canada, this section applies to you.

We process your information if you have given us express consent for a specific purpose, or where your consent can be implied. You can withdraw your consent at any time. In limited cases permitted by law we may process information without consent, for example to investigate a breach of an agreement or to comply with a subpoena or court order.

4. When and with whom do we share your personal information?

In short: we share information only with the service providers listed below, who process it on our behalf and on our instructions.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We may also need to share your personal information in the following situations:

• Business transfers. In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of our business.
• Legal requirements. Where required to comply with the law, a court order or a lawful request by a public authority, or to protect the rights, property or safety of any person.

5. Do we use cookies and other tracking technologies?

In short: the website does not. The app uses PostHog for product analytics only.

Our website does not set cookies and does not run analytics, advertising or social media tracking scripts.

The app does not use cookies or the advertising identifier. It includes the PostHog software development kit, which stores a random analytics identifier on your device and sends the usage events described in section 1 to PostHog, who process them on our behalf. We do not permit PostHog or anyone else to use this data for advertising, and we do not share it with data brokers or ad networks. Where the law requires your consent for analytics we will ask for it in the app. If we introduce advertising or cross-app tracking in the future we will update this notice and, where required, ask for your consent first.

6. Do we offer artificial intelligence-based features?

In short: yes, and they run entirely on your device. No data is sent to any AI service provider.

Milo uses two on-device machine learning features:

• Milo's take. The short written summary on a product page is generated on your iPhone using Apple's built-in Foundation Models, from the product's ingredients and nutrition data and, where relevant, the preferences you have set. The text is cached on your device for up to 30 days. It is not generated when a product matches one of your allergens, and it is not available on devices that do not support Apple Intelligence.
• Label reading. When you photograph an ingredients or nutrition panel, the text is recognised on your phone using Apple's Vision framework so the app can pre-fill the product form for you to check.

Neither feature sends your data to us or to any third-party AI provider such as OpenAI, Google or Anthropic. Milo's nutrition score itself is not generated by AI. It is a fixed formula described in our scoring guide.

7. How do we handle your Apple and Google sign-ins?

In short: if you sign in using Apple or Google, we receive limited profile information from them.

Milo lets you create an account using Sign in with Apple or Google Sign-In. When you do, we receive the profile information you authorise the provider to share, which is limited to your email address (or Apple private relay address), your name if you choose to share it, and your profile picture if your Google account has one. We do not receive your contacts, friends list, calendar or any other account data, and we cannot post on your behalf.

We use this information only for the purposes described in this notice. We do not control, and are not responsible for, how Apple or Google use your personal information. We recommend you review their privacy notices.

8. What happens to products and photos you add?

In short: product details and front-of-pack photos you contribute become part of Milo's shared product database and are visible to other users.

• Product details you enter (name, brand, category, ingredients, nutrition values and market) are published to all Milo users so the product can be scored and recognised. They are not shown alongside your name or email.
• Front-of-pack photos are stored in a publicly readable image store and displayed as the product image to any user who scans that barcode. Please do not include anything personal in the frame, such as your hands, receipts or your surroundings.
• Ingredients and nutrition panel photos are stored privately as evidence for the details you entered. Only you and our team can view them.
• The file paths of stored photos include a random internal account identifier. This identifier is not your name or email address and cannot be used on its own to identify you.
• When you delete your account, your stored photos are deleted. Product details you contributed remain in the shared database but are no longer linked to any account.

Milo does not currently upload your contributions to Open Food Facts or any other external database. If that changes we will update this notice and our Terms of Use.

9. Is your information transferred internationally?

In short: we may transfer, store and process your information in countries other than your own.

Dry Cereal Corp Pty Ltd is based in Australia. Your account, scan history, pantry and stored photos are hosted by Supabase in the United Kingdom (London, AWS eu-west-2). Our other service providers, including Apple, Google, RevenueCat, PostHog and Cloudflare, operate in a number of countries, so your information may also be transferred to, stored and processed in the United States, the European Union and other locations where they operate. These countries may not have data protection laws as comprehensive as those in your country. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum in our agreements with providers, and we will take reasonable steps to ensure that any overseas recipient handles your personal information in accordance with this notice and applicable law.

10. How long do we keep your information?

In short: for as long as you have a Milo account, unless the law requires otherwise.

We keep your account details, scan history, pantry and stored photos for as long as your account exists. When you delete your account these are permanently deleted from our active database. Product details you contributed remain in the shared database in de-identified form. Purchase records are kept by Apple and RevenueCat under their own retention rules and, where required, by us for tax and accounting purposes. Server logs are retained for a short period for security purposes. Copies of deleted data may persist in encrypted backups for a limited time before they are overwritten.

11. How do we keep your information safe?

In short: we aim to protect your personal information through organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the personal information we process. All data is transmitted over encrypted connections, and database access is restricted so that each user can only read and change their own data. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise that hackers or other unauthorised third parties will not be able to defeat our security. Transmission of personal information to and from our Services is at your own risk.

12. Do we collect information from children?

In short: Milo is designed for parents and other adults. We do not knowingly collect personal information from children.

Milo helps adults make decisions about food for their household, including their children. The app does not ask for or store children's names, ages, dates of birth or individual profiles. The preferences you set, such as allergens to flag, are stored as your own preferences on your device. Our Services are not directed to anyone under 18, and by using them you represent that you are at least 18 years old or the parent or guardian of a minor who is using them with your consent. If we learn that we have collected personal information from a child without appropriate consent, we will delete it. If you believe this has happened, please contact us at support@drycerealcorp.com.

13. What are your privacy rights?

In short: depending on where you live, you have rights that allow you access to and control over your personal information.

In some regions (such as Australia, the European Economic Area, the United Kingdom, Switzerland and Canada) you have rights under applicable data protection laws. These may include the right to request access to and obtain a copy of your personal information, to request correction or erasure, to restrict or object to processing, and, where applicable, to data portability. You can make such a request by contacting us using the details in section 18. We will consider and act on any request in accordance with applicable law.

If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection authority. If you are in Switzerland you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent. Where we rely on your consent, you can withdraw it at any time by changing your device permissions or contacting us. This will not affect the lawfulness of processing before the withdrawal.

Account information

If you would at any time like to review, change or delete the information in your account, you can:

• Delete your account from Settings in the app. This immediately and permanently deletes your account, scan history, pantry and stored photos, and signs you out.
• Change your preferences (dietary restrictions, allergies, what to track) from Settings in the app.
• Request a copy or correction of the information we hold by emailing support@drycerealcorp.com. We will verify your identity before responding.

After deletion we may retain limited information where necessary to prevent fraud, troubleshoot problems, enforce our Terms, or comply with legal requirements.

14. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. Because we do not track users across websites or apps, there is nothing for a DNT signal to switch off. No uniform standard for responding to DNT signals has been finalised, so we do not respond to them specifically. California law requires us to let you know how we respond to DNT signals; this paragraph is that disclosure.

15. Do United States residents have specific privacy rights?

In short: if you are a resident of a US state with a comprehensive privacy law, you may have the right to request access to, correction of, a copy of, or deletion of your personal information.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve months, using the categories defined in the California Consumer Privacy Act.

We retain categories A, B, D, F and H for as long as you have an account with us.

We have not sold or shared personal information for a business or commercial purpose in the preceding twelve months, and we do not use your information for targeted advertising or profiling that produces legal or similarly significant effects. We disclose personal information to the service providers listed in section 4 under written contracts.

Your rights

Depending on your state, you may have the right to know whether we are processing your personal data; to access, correct or delete it; to obtain a copy of it; to opt out of sale, sharing or targeted advertising (which we do not do); and to non-discrimination for exercising your rights. To exercise these rights, email support@drycerealcorp.com. We will verify your identity using the information we already hold. You may designate an authorised agent to make a request on your behalf, and we may require proof of their authority. If we decline a request you may appeal by replying to our decision, and if your appeal is denied you may contact your state attorney general.

California "Shine The Light" law. California residents may request, once a year and free of charge, information about the categories of personal information we disclosed to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

16. Do other regions have specific privacy rights?

Australia

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Privacy Notice satisfies the notice requirements defined in the Privacy Act, in particular what personal information we collect from you, from which sources, for which purposes, and the other recipients of your personal information.

If you do not wish to provide the personal information necessary to fulfil its purpose, it may affect our ability to provide our Services, in particular to create and maintain your account and keep your History and Pantry in sync.

At any time you have the right to request access to or correction of your personal information by contacting us using the details in section 18. If you believe we have breached the Australian Privacy Principles, you may complain to us first, and if you are not satisfied with our response, to the Office of the Australian Information Commissioner at oaic.gov.au.

New Zealand

If you are in New Zealand, you have rights of access and correction under the Privacy Act 2020, and may complain to the Office of the Privacy Commissioner.

17. Do we make updates to this notice?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws and to reflect changes in the app.

The updated version will be indicated by an updated "Last updated" date at the top of this page. If we make material changes, for example adding analytics or a new third-party provider, we will notify you by posting a notice in the app or on this website, or by contacting you directly. We encourage you to review this notice frequently.

18. How can you contact us about this notice?

If you have questions or comments about this notice, you may contact Dry Cereal Corp Pty Ltd by email at support@drycerealcorp.com.

19. How can you review, update or delete the data we collect from you?

You have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete your personal information. You can delete your account and all associated data at any time from Settings in the Milo app. For any other request, email support@drycerealcorp.com. These rights may be limited in some circumstances by applicable law.

Milo is available on the App Store.