Privacy Policy — Osszevet
1) Who we are
Osszevet is provided by independent developer Saifullah Ahad (“we”, “us”, “our”). Contact: [email protected]. Website: saifullah.ai.
2) What the app does
Osszevet lets two independent participants photograph the same medicine name and batch, compare seven packet regions, and record neutral visual observations. It does not authenticate medicine and does not provide medical advice, a diagnosis, or a safety verdict.
3) Data handled
When you start and submit a comparison, the app may handle:
- the medicine label and batch or lot text you enter;
- seven packet photographs, on-device OCR text, perceptual hashes, and photo-quality values;
- an optional country or broad-region label; the app does not request precise location;
- your Same, Different, or Cannot compare observations and image-registration confidence;
- an anonymous Firebase account identifier, a one-way device-proof value, session identifiers, timestamps, block choices, and notification token;
- reports you submit about another participant’s photograph, including the selected reason.
4) Permissions
CAMERA: capture packet photos after you choose Camera.INTERNETand network state: upload evidence, match independent packets, receive findings, submit reports, and use cloud account controls.POST_NOTIFICATIONSon supported Android versions: notify you when an independent match is ready. You may deny it.USE_BIOMETRIC: optional local app lock. Android performs the biometric check; Osszevet does not receive or store biometric data.
You may choose existing images through Android’s system photo picker without granting broad photo-library access.
Packet sharing is off by default. An adult enables it through a local date-of-birth check and can turn it off in Controls. The date is not stored or transmitted; only the sharing choice and, after an unsuccessful age check, a one-day retry time are stored on the device. Local capture remains available. Turning sharing off stops new exchange requests and hides partner photos on this device. It cannot recall requests already sent, uploaded evidence, or copies saved by recipients; use the deletion process for registered cloud evidence.
5) How data is used
- normalize medicine and batch text and find a different account and device with a potentially matching packet;
- show the two photo sets for human review and calculate aggregate observation weights;
- reduce coordinated or related submissions from the aggregate;
- deliver match notifications, retry queued uploads, enforce blocks, investigate reports, and protect the service;
- prepare an evidence PDF locally when you ask, and prepare a cloud account export when you ask.
We do not use packet evidence to advertise to you and do not sell personal information.
6) Service providers and technical data
Osszevet uses Google Firebase services: Anonymous Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Firebase Cloud Messaging, and App Check with Play Integrity. Google processes data under its applicable terms and privacy documentation. ML Kit text recognition runs on the device; Google Play services may download the recognition component.
Google services also process installation identifiers, IP addresses, device/app details and security information. ML Kit processes images on the device, but sends diagnostic and usage information such as performance, error codes and feature events to Google. There is no advertising or Firebase Analytics SDK; this does not mean that the included SDKs collect no telemetry. See ML Kit disclosures and Firebase privacy information.
If you open About Developer → Send feedback, Osszevet prepares a draft and opens your chosen email app. Osszevet does not transmit or store the draft; your email provider handles it only if you choose to send it.
7) Sharing and visibility
A matched participant receives your seven packet photos and your optional country or broad-region label. Photo links last one hour and may be renewed while the evidence remains available. Recipients can save or export copies, which Osszevet cannot recall. Weighted observations contribute to findings for other contributors with the same medicine and batch; these may reflect a very small number of pairs. The app does not send your account ID or device-proof value to the partner. Contact details or other information visible inside an image would still be visible to them. Authorized service administrators may access evidence when required for security, abuse review, support, legal compliance, or service operation. We may disclose information when required by law or to address a serious safety risk.
8) Retention
- Submitted contribution records and their registered packet photos become eligible for cleanup 30 days after submission. A daily job at 03:15 UTC processes up to 300 expired contributions per run. Cleanup can be later because of a backlog or service failure; 30 days is not a guaranteed erasure deadline.
- Reports become eligible for the same daily cleanup after 180 days, with up to 300 processed per run. Reports you submitted are also removed by your account-data deletion request. Reports made by others about your content can remain until their cleanup.
- Export download links expire after 15 minutes. Export files become eligible after 24 hours and are removed at a later successful daily cleanup, ordinarily within about 48 hours of creation.
- Pair observations, pair history, account/session references, block and hidden-content records, and stored notification tokens have no automatic time-based expiry. They can remain until the relevant account-data deletion or an authorized support cleanup. Expiring a contribution does not expire its pair observations or remove their effect from findings.
- Uploads interrupted before a contribution is registered are not covered by the scheduled contribution cleanup or the standard contribution-based deletion. Contact support for a verified cleanup of these files.
- Deleted Storage objects have a seven-day recovery period. Operational logs in the default Google Cloud log bucket are retained for 30 days; required audit logs for 400 days. Firestore currently has no scheduled backups or point-in-time recovery enabled and retains prior versions for one hour.
- Firebase account information remains until account deletion; Google describes removal from its live and backup systems within 180 days after that request and retention of authentication IP logs for a few weeks. Other SDK/security data follows Google's published service policies. Deleting the account does not explicitly delete the Firebase installation ID. ML Kit's disclosure does not give a fixed retention period for all telemetry.
- Local sessions and evidence remain until cleared through account deletion, Android app-data clearing, or uninstall. Temporary camera/image/PDF caches and preferences may persist until Android clears them or app data is removed. PDFs, images or exports saved outside the app and recipients' copies remain under their owners' control.
Android app backup and device transfer are disabled for app data. This is separate from the server recovery and logging periods above. Email correspondence is handled manually for support, safety and legal obligations and has no automatic deletion schedule; you can ask us to remove it.
9) Your controls and account deletion
In Osszevet, open Controls > Delete account and data. The app requests removal of your registered contributions and photos, associated pairs and pair history, your session/device/block/hidden-content records, reports you submitted and cloud exports, then deletes the anonymous Firebase account and local evidence. The exceptions and recovery periods above still apply. Clearing Android app data or uninstalling alone does not request cloud deletion.
Outside the app: email [email protected] with the subject Osszevet account deletion and your anonymous account ID, shown in Controls. State whether you want the whole account or particular evidence removed. Do not send passwords, prescriptions or packet images. We verify control of the account before acting. If the app and its anonymous sign-in have been lost, recovery or ownership verification may not be possible; an email address alone does not identify an anonymous account.
Request account export prepares contribution metadata, session links and reports you submitted. It is not a complete archive of every server record or photo. Export a local evidence PDF for comparison observations. You can enable a PIN or biometric app lock, limit screenshots, revoke Android permissions, report partner photos and block future pairing. Reports are queued for review and do not automatically hide the current image.
10) Security
Osszevet uses HTTPS, access-controlled Firebase rules, short-lived signed photo URLs, App Check enforcement in callable services, anonymous account boundaries, one-way hashes, and server-side validation. No system is perfectly secure, so do not photograph information unrelated to the packet comparison.
11) Children and user content
Osszevet is not directed to children under 13. User-submitted photos must not contain child sexual abuse material or any content that exploits or endangers a child. See the separate Child Safety Standards. We review reported content and may remove content, restrict accounts, preserve evidence, and report to appropriate authorities when required.
12) International processing
Firebase may process data in countries different from yours. By using the cloud evidence workflow, your data may be transferred and processed where Google operates, subject to its safeguards and applicable law.
13) Changes
We may update this policy as the app or legal requirements change. The current version will remain at privacy.saifullah.ai/osszevet.html with a revised effective date.
14) Contact
Saifullah Ahad
Email: [email protected]
Website: https://saifullah.ai
Location: Dhaka, Bangladesh