Sick Savvy

Privacy policy

2 October 2026

This is your diary. You choose what to write, whether someone else can run a shop check for you, and when to ask for the account to be deleted. Sick Savvy is not a diagnosis and it is not medical advice.

What you control

You add the meals, symptoms, known triggers, and medicines. You can remove a meal, a symptom, or a medicine in the diary. Sharing is optional, and you can revoke it in Settings. You can sign out. A shop scan is checked, then left off the diary.

What you type in

An account is a name, an email, and a password. The password is stored as a PBKDF2 hash.

The diary keeps meals, ingredient lists, symptoms, and the times you enter. It keeps known triggers you add. You can also turn on coeliac, FODMAP, lactose, histamine, or nightshade. Medicines you record stay on the account.

A shop scan sends the barcode so the product can be read. It is not saved as a meal.

A label photograph is read on your phone. You can correct a word before it is saved. The text you keep is saved with the meal. The photograph itself is not uploaded.

Why it is kept

It is kept to show the diary, to assess the triggers you have named, and to run the shop check.

A tick means nothing on your lists matched. A caution means a possible match. A cross means something on a list was on the label. When you share, the other person's scanner says whether you can have the item. "Can have this" means none of your known triggers matched. It does not mean the food is medically safe.

Sharing

You can create a code in Settings. Someone else's shop scanner then says whether you can have an item. They see your name and a yes or no. They do not see your known triggers, meals, symptoms, or medicines. Revoke the code in Settings and the check stops.

Who else touches it

Cloudflare hosts Sick Savvy.

Open Food Facts describes products. A name search is asked from your browser. A barcode, while you log a meal or in the shop scanner, is sent to Sick Savvy, which asks Open Food Facts and keeps the product it returns. The diary is not sent to Open Food Facts.

NOVA groups and additive notes come from public sources so a product can be described. The diary is not sent to those sites.

A medicine name can be matched to the public TGA recall and shortage lists. That match is not clinical advice.

Premium is A$4.99 a month. When you subscribe, card payments are handled by Stripe. Sick Savvy does not store the card number. Your name and email are sent to Stripe so the subscription can start. If payments are not configured, a subscription is not started.

The label reader loads its files from jsDelivr when you photograph a list. The photograph is not sent there.

What Sick Savvy does not do

Sick Savvy does not show ads, does not sell personal information, and does not use third-party trackers. The Android app is a WebView of this site. It does not add a separate analytics kit.

The sign-in cookie

A cookie named sicksavvy_session keeps you signed in. It is httpOnly, so a page script cannot read it. It is there to keep the session, and it is not used for advertising. It lasts about 30 days. Signing in sets it again. Sick Savvy stores a hash of the cookie value.

A few display choices, such as whether NOVA is on, stay in the browser on this device.

How long it is kept

The account and the diary are kept while the account exists. Ask for the account to be deleted on the account deletion page. The form on this page can carry the same request.

Children

Sick Savvy is not made for children.

Changes

A change to this page is how this policy is updated.