Who we are
Media Nutrition Label (“the app,” “we”) is an independent media-literacy app, built and run by one person in Connecticut, United States. We are responsible for the data described here. Privacy questions or requests about your data: support@mnl-app.com. We aim to answer within 30 days.
What we collect
Account: your email address, a display name, and a securely hashed password (we can never read the original). App data: the labels saved to your diary after each scan (you can delete any of them), your in-app preferences, counts of how many scans, claim checks and research runs you make (used to enforce the plan limits and to prevent abuse), and whether MNL Pro is on your account. Your IP address is seen by our server on every request, as any web server sees it. We use it only to rate-limit sign-in, sign-up and scanning: we store a keyed hash of it — not the address itself — and delete that hash within hours. We never write the address itself to our database. We do hold the key to that hash, so the honest claim is that we do not read it rather than that we could not. If you write to us — by email, or with a report sent from inside the app — we keep your message, your email address, anything you attach, and our reply. A report sent from the app also carries the label’s id, when it was scanned, the first words of the label and the app version, so that we can find the label you mean. Mail to our address is passed on by Cloudflare, which routes mail for our domain, and kept in a Gmail account, which Google provides. If you are reporting a label, telling us a label is false about you, sending a copyright notice or making a request about your data, we also log it in a spreadsheet kept with Google — your name and address as you gave them, what you told us in brief, what we decided and when — and keep that log for three years from when we received it (our monthly copy of it can hold an entry up to a month longer), so that we can show we responded. Other messages stay in that mailbox; ask us and we will delete yours. No advertising identifiers, no location, no contacts, no cross-app tracking.
What happens when you scan
The screenshot, screen-recording frames, message text, or fetched post preview and caption you submit are sent over an encrypted connection (HTTPS) to our server, which forwards them to Anthropic (United States) — the company behind the Claude AI model — solely to generate your label. Anthropic handles it as our service provider, under commercial terms that forbid training their models on it, and deletes it within 30 days. Content their automated safety systems flag may be held by them for up to two years, and a safety score about that content for up to seven. Those are Anthropic's own published retention periods, not ours, and not something we can shorten. If you scan a screen recording, the audio is transcribed by software running on our own server and the file itself never leaves it. Our server holds your media only for the seconds the read takes and then discards it — it is never written to our database. Only the label is saved, and only to your account. We ask your permission before your first scan, we name Anthropic when we ask, and scanning stays off until you give it. You can withdraw it in You → Your Data at any time.
Video and links
If you scan a screen recording, our server samples frames across the timeline and transcribes the audio itself, with speech-recognition software running on our own machine — the video file is never sent to a third party. If you paste or share a link, our server fetches that public post on your behalf (the site sees our server, not your device) and sends the post's preview image and caption to be read — not the page itself. What comes back from that fetch — the site's name, the post's title, its caption or description as written, whether it had an image, and the label we produce from it — may stay in the server's memory for up to a day, so that repeat scans of the same public post are instant. It is keyed to the post rather than to you: it is not linked to your account, and it is gone when the server restarts.
Deeper research
If you tap “Check this claim,” the claim printed on your label and the search terms it suggests are sent to the AI model; if you tap “Dig deeper,” the label itself is. Your original media is not sent again. The model searches the public web and reports what sources say, and what comes back is saved with that label — it is deleted when you delete the label or your account.
Your Brain, Labeled
The monthly Brain report sends aggregate statistics about your scan history — counts of technique types and emotional-pull levels, not the labels themselves — to the AI model, which returns a profile describing patterns in what you have been reading. That is profiling: it produces inferences about you, not only about the media. It runs only when you ask for it, the result is stored in your account until you delete it, and everything else in the app works if you never use it.
Analytics and crash reports
We use PostHog (United States) as our analytics processor, to see how the app is used in aggregate and to receive crash reports. PostHog receives event names, counts, your app and OS version, which update your phone is running, a randomly generated identifier stored on your device (we also keep a copy of it with your account, so that a renewal our server reports is counted under the same identifier), and short fixed labels for which screen you were on or which option you chose — never anything you typed or scanned — and, in the case described in “Who else receives your data” below, the purchase record that section names. It does not receive label text, technique names, scan content, transcripts, captions, URLs, your email address, your name or your user id. Two different mechanisms keep that true and they are not equally strong, so we describe both rather than let one stand for the other. What an event carries alongside its name is checked in code before it is sent: any property whose name refers to content is dropped, and only short strings, plain numbers and true/false values are allowed through at all. A crash report is different, because a crash produces text nobody wrote for it — an error message, and the list of places in the code it came from. Before that leaves your phone we strip out email addresses, web addresses, file paths, anything shaped like a long identifier, and quoted text; each file path is cut down to a bare file name; and only the last few code locations are kept. That is a filter rather than a guarantee, and we would rather say so than claim a certainty the code cannot deliver: it is built to catch content, and on this one path it is best effort by nature. We never call PostHog’s identify function, so no person profile is created; there is no session replay and no screen recording. Your IP address reaches PostHog as part of ordinary network traffic, and PostHog may derive an approximate region from it. After your first label the app may ask you once where you heard about MNL. Answering is optional: if you tap one of the fixed choices on screen, that choice goes to PostHog as one of the short fixed labels described above, under the same identifier; if you skip, PostHog receives only that you skipped. There is no box to type in, and your answer is not saved to your account.
Who else receives your data
A handful of companies help us run the app. The ones that receive data as you use the app are named here with what each gets; the two that carry and hold mail you send us, Cloudflare and Google, are described in “What we collect”. Anthropic (United States) reads the media you scan, and the label text and scan statistics that “Deeper research” and “Your Brain, Labeled” describe, as set out above. Fly.io (United States) hosts our server and our database. Expo (United States) delivers the app’s software updates: every time you open the app it asks Expo’s servers whether newer app code has been published, so Expo sees your device’s IP address, which platform you are on, which version of the app’s built-in code you are running, and which update it hands back — nothing about you, your account, or anything you scan. Resend (United States) sends the mail the app has to send you: your password-reset code, and, if you subscribe, the billing notices the Terms describe. Resend therefore receives your email address and the message we ask it to deliver. RevenueCat (United States) manages subscriptions for us. Once you have signed in on a device it receives your account id and the analytics identifier described above, so that a purchase can be matched to the right account; if you subscribe it also receives which plan you bought and the receipt Apple issues; and it receives the advertising report described in “If we advertise the app”. It never receives your payment details, which only Apple ever sees, and never anything you scan. If you subscribe, our own server also sends our analytics processor a record of the purchase and of each renewal, cancellation or billing problem — which plan, which store, the amount in US dollars, and when — under the same analytics identifier described above, not your account id and not your email address; RevenueCat does not send anything to our analytics. PostHog (United States) is our analytics processor, as described above. Anthropic, Fly.io, Expo, Resend, RevenueCat and PostHog each act as our service provider: it may use what it receives only to provide that service to us, and none of them is permitted to sell it or to use it for its own advertising. Apple is different — Apple takes the payment if you subscribe, and answers the advertising question described in “If we advertise the app”, and Apple’s own privacy policy governs what Apple does with both.
If we advertise the app
If we advertise MNL on the App Store through Apple Ads, Apple can tell us whether an install came from one of our ads. Whenever you are signed in, whether or not we are running any ads, the app passes RevenueCat (our subscription processor, named above) a token that Apple creates for this purpose. RevenueCat sends the token to Apple, and Apple replies with whether the install followed one of our ads and, if it did, which campaign, ad group and keyword, the country or region, whether you tapped the ad or only saw it, whether it was a first download or a re-download, which ad and where it was shown, and when. RevenueCat keeps that reply with your account id, so that we can count how many installs and subscriptions each campaign brought in. We use it only to measure whether our own advertising worked. It contains no advertising identifier, we never ask for tracking permission, and it tells us nothing about what you do in anyone else’s apps or websites. We do not use it to choose ads to show you, our analytics processor does not receive it, and we do not sell it or share it for anyone else’s advertising.
Where your data lives
Our own server and database run on Fly.io in the United States. The other companies listed in “Who else receives your data” hold only what that section says they receive. Saved labels are kept until you delete them or your account, and the app keeps at most your 200 most recent. Password-reset codes are stored only as a keyed hash and expire within minutes. The link cache lives in the server’s memory and does not survive a restart. The rate-limiting counters persist only as the keyed hashes described above, pruned within hours.
Backups
We take regular backups of the database so that a hardware failure does not lose your account. They travel over an encrypted connection and are held in two places, both in the United States and both ours: our hosting provider's infrastructure, and a computer we control. Backups are deleted on a rolling schedule and none is kept longer than 30 days, with one exception: if a backup holds something we need because of a legal claim that has been made against us or that we have good reason to expect, because we are investigating a security incident, or because a court, a regulator or the law requires us to keep it, we set that copy aside, keep it only until the matter is over, and then delete it. Nobody else is given a copy, except our own lawyer, or anyone a court, a regulator or the law requires us to give it to. Our server opens each new backup automatically to check that it is complete; beyond that, we open a backup only to restore the service after a failure, to test that we can, to investigate a security incident, or to find what a legal matter needs.
What we never do
We don’t sell or rent your data, and we don’t share it for anyone’s targeted advertising; the only advertising use is measuring our own ads, as described in “If we advertise the app”. We don’t build advertising profiles. We don’t share your content with anyone except the service providers named in “Who else receives your data”, each of which is required to use it only to provide the service; mail you send us, and anything you attach, is held as “What we collect” describes. We may disclose data where the law requires it, and we will tell you if that happens unless we are prohibited from doing so.
Your controls
You → Your Data exports every label you have saved as JSON, or clears your history. For a copy of anything else we hold about you, email support@mnl-app.com. Individual labels can be deleted from your diary. Deleting your account (You → Edit profile) removes your profile, your labels, your preferences, your usage counts, your scan counters, your referral code and your reports from our database, immediately and permanently: we cannot undo it and we cannot get any of it back for you. Four things outlast it, and we would rather tell you than let you find out. A copy can remain in a backup until that backup is deleted, as described above. We keep the record of which agreements you accepted — the document, the version your app showed you, a fingerprint of the text we were publishing when you accepted, the time you accepted it, and the account id it belonged to — because being able to show that you agreed is itself a legal obligation; that record is not deleted with the account, and there is nothing in it about what you scanned. If we ever removed one of your labels ourselves — after a report, a complaint, or a breach of the Terms — we keep a note that we did: the label’s id, our reason for removing it, and when. The label itself was deleted when we removed it and is not in the note. When you delete your account we take your account id out of that note, although the log of reports described in “What we collect” can still show which account the label came from for the three years the Terms describe; we keep the note for at least that long, because it is how we show that we acted. And if you ever subscribed to MNL Pro, we keep the record that we sent you the billing notices the law requires — which notice it was, the address we sent it to, the plan and price it described, when it went out, whether it was delivered, the account it belonged to, and a fingerprint of the message, but never the message itself, which is deleted with your account — for at least three years, because we have to be able to show that we sent them. Deleting your account does not by itself remove what RevenueCat and PostHog already received: RevenueCat’s record of your account id, analytics identifier, purchases and any advertising report, and the analytics events sent under your analytics identifier. Email support@mnl-app.com and we will ask both to delete them, within the 30 days described below. You can also sign out everywhere, which invalidates every existing sign-in token, and correct your display name at any time. Depending on where you live — Connecticut included — you may have the right to confirm, access, correct, delete or export your data and to opt out of profiling; the controls above cover most of that directly, and anything they do not, we will handle within 30 days of your asking. If we refuse a request you can appeal by replying, and we will answer the appeal within 60 days.
If a label names you
This section is for people who do not use MNL. If a label the app produced names you and states something about you that is false, write to support@mnl-app.com — the Terms say what we do about it and how quickly. To act on a request like that we have to keep a short record of it: the name we were asked to stop producing claims about, a simplified form of that name used for matching, a note of the request and its date, and who entered it. That is the whole of that record; your message to us, and the log we keep of requests like yours, are kept as “What we collect” describes. We do not go looking for anything else about you and we do not build a profile of you. We keep it for as long as the request stands, because that list is the only thing that keeps the promise; ask us to remove it and we will, and labels naming you can be produced again after that. What we can do is narrow, and we would rather say so plainly: from the moment a request is recorded we stop the app producing new labels, claim checks, research or reports that name you, and we can delete a label from our own systems. We cannot reach a label already saved on somebody's phone or already shared elsewhere, and we do not rule on whether the post underneath it was true.
Security
Passwords are hashed with scrypt, sign-in tokens are signed and can be revoked account-wide, all traffic is encrypted in transit, and the sign-in and sign-up endpoints are rate limited. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you at your account email and notify regulators as the law requires.
On your device
Your sign-in token is kept in the device’s secure storage, together with a copy of your account details as our server last sent them (your email address, display name and in-app preferences), so that the app can open before it reaches us. Reminder and digest notifications are scheduled locally on your phone — nothing about what you scan leaves your device to power them. The analytics identifier described above (a copy of which we also keep with your account) and a small queue of pending events are stored locally too, and so are a few small records the app keeps for itself, including whether you passed the age question and when (never your date of birth), that you agreed to AI processing and on which account, how many scans you have finished, which technique cards you have been shown, how many times you have opened the app and when it last asked you for a rating, and which one-time tips and questions you have already seen. Deleting the app may not remove these. On iPhone, items in secure storage can stay on the phone after the app is deleted, and if you install MNL again it can read them: you may still be signed in if that sign-in has not expired, the same analytics identifier is used again, and the answer to the age question still applies. Signing out removes the sign-in token and the copy of your account details from the phone. Deleting the app does not delete your account; the in-app deletion does that.
Children
The app is not directed to children under 13, is not marketed to them, and we don’t knowingly collect their data. To create an account you must be at least 13. If you believe a child under 13 has one, contact us and we will delete the account and its data promptly.
Where the app is available
Media Nutrition Label is offered in the United States. It is not offered in, marketed to, or intended for users in the European Economic Area or the United Kingdom. If that changes, we will update this policy before it does.
Changes
If this policy changes materially, we will publish the new version here with a new date before the change takes effect, and we will ask you to accept it in the app the next time our Terms change. The date above always reflects the current version, and we keep the previous one available on request.