Privacy policy
Last updated 9 October 2026
GreenSpecs reads the sustainability claims on a product label and scores them. We score products, not people.
This page covers the GreenSpecs app at greenspecs.app, the GreenSpecs browser extension, and the GreenSpecs app for Shopify stores. GreenSpecs is run by YKO, Inc., which also runs YKO.Earth.
The short version. You can use GreenSpecs without an account. We do not show ads, we do not sell data, and we do not use tracking cookies.
A scan sends us the product and, if you allow it, where you are, so we can see where products are sold. You can delete your account in the app at any time.
What we collect when you scan
- The product. Its name, brand and the claims on the label, and the score we work out.
- A photo, if you take one. It is sent to Google's Gemini model to read the label. We do not keep the photo.
- Your location, if you allow it. Your phone's coordinates and the town they fall in. We never show coordinates to other people.
- A price, if you type one. It stays with that scan and is never shown in the public feed.
- A random device ID. Made on your device so your scans stay together without an account.
- Basic request details. Every web request carries your IP address. Our host, Cloudflare, turns it into a country and city; we store those, not the IP address.
If you sign in
- With Google: we store only the anonymous ID Google gives us for you. Not your name, email or photo.
- With an emailed link: we store your email address, to send the link and to know it is you next time.
- With the browser extension's password sign-in: we store your email and a salted hash of your password (PBKDF2). We never store the password itself.
When you sign in, we record the time, the method, your country and city, and your browser type. This helps us spot sign-ins that are not you.
On your device
The app keeps your recent scans, your sign-in token and a few settings in your browser's local storage, so the app opens fast. They stay on your device. Clearing your browser data removes them.
Why we use it
- To score the product and show you the result.
- To keep your scan history, if you sign in.
- To build a picture of which products are sold where, and which claims shoppers check. This feeds the public brand records on YKO.Earth. It uses products, places and prices, never who scanned them.
- To keep the service safe: to stop abuse and limit how often one address can call the service.
Who else handles it
We share data only with the services that run GreenSpecs, and only what each one needs.
| Service | What it does for us | What it receives |
|---|---|---|
| Cloudflare | Hosts the app and its database; counts page views without cookies (Web Analytics); routes our email | Every request, including your IP address |
| Google (Gemini) | Reads labels and helps write the score | The product name, label text and any photo you take |
| Google Sign-In | Lets you sign in with Google | Handled on Google's side; we receive only your anonymous Google ID |
| Anthropic (Claude) | Writes some plain-language explanations of a score | The product and its score, never who you are |
| Resend | Sends sign-in emails | Your email address and the link |
| OpenStreetMap (Nominatim) | Turns your coordinates into a town name | Your coordinates, sent straight from your device, if you allow location |
| YKO.Earth | Our sister service; builds public brand records | The product, its score, the town, your location rounded to about 1 km, and any price. Never your account or device ID. The app also loads brand records from it directly, so it sees your IP address the way any website does |
We do not sell personal data, and we do not share it for advertising. We will disclose data if the law requires it.
How long we keep it
- Sign-in links expire after 15 minutes. Sign-in sessions end after 30 days.
- Scans are kept while GreenSpecs runs, because product scores are built from them.
- If you delete your account, we remove it and every link from your scans to you: your location, price and device ID come off them. The product scores stay, because they describe products, not you.
- Data already sent to YKO.Earth is about products and places and carries no account. Email us if you want a particular scan removed there too.
Your choices
- Location: you can say no, or turn it off later in your phone's settings. Scanning still works.
- Delete all your data: in the app, open Menu, then Delete my data, and tap the button twice. It happens straight away, with or without an account.
- Anything else: email hello@greenspecs.app to see, correct or delete your data. We reply within 48 hours.
Wherever you live, including the EU, the UK and California, you can ask for a copy of your data or ask us to delete or correct it. We do not sell or share personal data as California law defines those words. You can also complain to your local data protection authority.
GreenSpecs for Shopify
This part is for store owners who install our Shopify app.
- What we read: the app asks Shopify for read-only product access. For each product we store its title, vendor, barcodes, description (up to 2,000 characters) and the addresses of up to four of its product photos. The photos are sent to Google's Gemini model to read them, as in the app; we keep the addresses, not the photos.
- What we keep: your store's myshopify.com address, your public web address if you give it, and the grade we work out for each product.
- What we never hold: your customers' data or orders. We do not keep a Shopify access token.
- On your storefront: the badge asks greenspecs.app for a product's grade. We record which product was asked for, never who was looking at it.
- When you uninstall: Shopify tells us 48 hours later, and we delete everything we hold for your store.
We answer Shopify's customer data requests: we hold no customer data, so there is nothing to return or erase.
Children
GreenSpecs is not made for children under 13, and we do not knowingly collect their data. If you think a child has given us data, email us and we will delete it.
Security
Everything travels over HTTPS. Sign-in tokens are long random values that expire. Admin tools need a secret key. Every Shopify request is checked against Shopify's signature.
Found a problem? Email hello@greenspecs.app with "security" in the subject.
Changes
If we change what we collect or who we share it with, we will update this page and the date at the top. If the change is significant, we will say so in the app.
Contact
YKO, Inc. · questions and deletion requests: hello@greenspecs.app