anafeed

Privacy Policy

Last updated: 29 September 2026 · Applies to the nanafeed mobile app and nanafeed.io · Deutsche Fassung

1. Who is responsible

Bananiv GmbH, Lyoner Straße 15, 60528 Frankfurt am Main, Germany · maksym@bananiv.com · Legal notice: nanafeed.io/impressum. We are not required to appoint a data protection officer.

2. What we process, why, and on which legal basis

What you must provide. An email address (or an Apple/Google sign-in) and a username are required to create an account. Everything else is optional; without it, some features do not work.

Account. Email address, username, password (stored only as a hash), language, theme and currency settings, the date you accepted the Terms and confirmed your age. If you sign in with Apple or Google, we receive from them your email address (with Apple possibly a private relay address) and, if you allow it, your name. Your email address is never shown to other users. Purpose: running your account. Basis: Art. 6(1)(b) GDPR (contract).

Your public profile and posts. Username, avatar, banner, bio, city, photos, ratings, ripeness and taste scores, prices, brand, store, the place of purchase, comments, stickers (unless you make your collection private), likes, follows and "Also tasted" confirmations. Purpose: the social feed. This information is public: every user sees it, and it can technically be retrieved from our servers without an account. Only share what you are happy to make public. Basis: Art. 6(1)(b) GDPR.

Place of purchase. When you post, you can mark where you bought the banana — by picking a store or by placing a pin on the map. We save the exact point, the city and the country with your post and show it on the map to other users. If you place the pin yourself, choose the store, not your home. Basis: Art. 6(1)(b) GDPR.

Your phone's location. Only if you allow it ("while using the app"). The app uses your current location on your phone to centre the map and show stores near you. We do not send it to our servers and do not store it. To show a street or city name for a point on the map, your phone asks the map service of its operating system (Apple on iPhone, Google on Android). Basis: § 25(2) No. 2 TDDDG (access strictly necessary for a feature you use) and Art. 6(1)(b) GDPR. You can withdraw the permission at any time in your device settings.

Photos. Photos are resized and re-saved on your phone before upload, which removes the camera's location (GPS) from the photo's metadata. In the rare case that resizing fails on your phone, the original file may be uploaded; if you want to be sure, switch off location tagging in your camera settings.

AI banana check and ripeness meter. When you post or scan a photo, a reduced copy is sent to OpenAI to check whether it shows a banana and to estimate ripeness. The result is stored with the post. Basis: Art. 6(1)(b) GDPR. To prevent abuse we count how often each account uses the check (Art. 6(1)(f) GDPR — our interest in preventing misuse and costs). The automated check can reject a photo; this has no legal or similarly significant effect on you, and you can always contact us.

Push notifications. If you allow notifications, we store a push token for your device and send notifications through the Expo push service, which forwards them via Apple Push Notification service or Google Firebase Cloud Messaging. Basis: Art. 6(1)(b) GDPR; your permission via the device prompt. You can switch them off in your device settings.

Usage statistics (only with your consent). If — and only if — you say "yes" in the app, we use Google Analytics for Firebase to measure how the app is used, for example which screens are opened and how many people publish a post. No advertising identifier is collected and no advertising features are used. The statistics are pseudonymous: they use a random app-instance identifier and our internal user ID, never your name or email. Google processes them as our processor, also in the USA; we export them to our own dataset stored in Frankfurt. Basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent at any time in Settings. The app sends no usage events before you answer. On iPhone, the Firebase library may record a single "first launch" event when the app is opened for the very first time; we are removing this with the next app update.

Server logs and security. Our hosting providers record technical data such as IP address, time and requested resource to keep the service secure and working. Basis: Art. 6(1)(f) GDPR (our interest in a secure, working service).

Reports and moderation. If you report content or are reported, we process the report, the content concerned and our decision. Basis: Art. 6(1)(c) GDPR together with the EU Digital Services Act, and Art. 6(1)(f) GDPR (our interest in a safe platform).

Contacting us. If you email us, we process your message to answer it. Basis: Art. 6(1)(b) GDPR where it concerns your account; otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

Content outside the app. If you agree that we may use a post of yours outside nanafeed (for example in app-store screenshots or on our social media), we process it on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Rankings and aggregated statistics. We calculate rankings and indices from ratings (see Terms section 6). To keep them independent, we mark accounts of Bananiv people (owner, staff, contractors, their close family, test accounts) and leave their entries out; this marking is based on our legitimate interest in fair, independent rankings (Art. 6(1)(f) GDPR). We also combine ratings, prices, ripeness, brand and store data of many users into statistics that we share with or sell to third parties such as retailers and brands. We only use groups of at least 10 users, without usernames, photos, timestamps or individual entries; we do not try to re-identify anyone and recipients are contractually prohibited from doing so. This is based on our legitimate interest in building and selling market information about bananas (Art. 6(1)(f) GDPR). Once aggregated in this way, the statistics are no longer personal data.

3. Who receives data

Other users and the public see your profile and posts (section 2). Authorities receive data only where we are legally obliged. You can request a copy of the transfer safeguards from maksym@bananiv.com.

4. Transfers outside the EU

Where a provider is certified under the EU–US Data Privacy Framework, transfers are based on the EU Commission's adequacy decision (Art. 45 GDPR); otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). See the table in section 3.

5. How long we keep data

• Account and content: removed from the app immediately when you delete them or your account. Copies in our daily database backups are overwritten within 7 days.
• Server logs at our hosting provider: up to 7 days.
• Photos sent to OpenAI: kept by OpenAI for up to 30 days for abuse monitoring, not used for training.
• Usage statistics: up to 14 months, then deleted automatically.
• Reports and moderation decisions: until the case is closed and at most 12 months after that, unless needed to defend legal claims.
• Data we must keep by law (e.g. business correspondence): for the legal retention periods.

6. Age

nanafeed is for people aged 16 and over. We do not knowingly process data of children under 16. If we learn that a user is under 16, we delete the account.

7. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future. Write to maksym@bananiv.com.

Right to object (Art. 21 GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR — including the creation of aggregated statistics from your entries. Write to maksym@bananiv.com. We then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You can complain to a data protection authority, for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden.

8. What we do not do

No advertising. No tracking across other companies' apps or websites. No sale of personal data. No automated decisions with legal or similarly significant effects.

9. Users in the United States

We do not sell personal information and do not share it for cross-context behavioural advertising. We collect the categories described in section 2 (identifiers, user content including photos, commercial information such as prices you enter, the place of purchase you choose, app usage data with consent) for the purposes described there. Your phone's precise location is used only on your phone and is not collected by us. Aggregated statistics are deidentified: we do not attempt to re-identify them and contractually prohibit recipients from doing so. Depending on your state, you may have the right to know, access, correct and delete your personal information and to appeal our decision on a request; write to maksym@bananiv.com. We will not discriminate against you for exercising these rights. We do not respond to Do-Not-Track signals because we do not track across services.

10. Changes

We update this policy when the app or the law changes. The date at the top shows the current version; material changes are announced in the app.