What evidence would support a food app’s on-device processing claim?
Separate feature-level developer statements, privacy declarations and observed connections without inferring an entire app architecture from one test.
Before treating a food app as entirely local, identify which step a statement describes. Reading text from a photo, explaining ingredients, storing history and syncing an account can be separate operations. A claim about one operation may leave the others unanswered.
Write a question at the feature level
Start with a concrete question: does the original image leave the phone when I request this particular result? Then ask separately about extracted text, account information and later synchronisation. Copy the developer's exact answer and its version or date instead of reducing it to a broad private-app label.
Google's Data safety explanation describes disclosure exceptions: some data processed only temporarily off the device need not be declared as collected in that section. Consequently, a no-collection declaration is not by itself proof that every operation happens on the device. Use the policy and feature documentation to clarify the actual claim.
Keep three evidence types in different columns
| Evidence | Example entry | Limit |
|---|---|---|
| Developer statement | Exact wording for a named feature | Reported practice, not your own observation |
| Behaviour test | Fresh input completed while disconnected | Does not establish later transfers |
| Connection observation | Domains contacted during a recorded period | Does not identify a request's full contents or purpose |
For an invented scenario, a feature extracts text while disconnected, then the app contacts a domain after reconnecting. These observations alone cannot tell you whether the connection carried the image, an account check or something else. Preserve the uncertainty rather than choosing the most reassuring or alarming explanation.
Use available platform evidence carefully
On iOS and iPadOS 15.2 or later, Apple's App Privacy Report can show sensor access and contacted domains. Enable it through Settings, Privacy & Security, App Privacy Report. It starts collecting after activation and covers recent activity, including connections made through content within an app. The report's own data is stored on the device; that statement does not describe where another app processes its images.
Record what action you performed and when, then compare the observation with the developer's stated feature behaviour. If the relationship remains unclear, ask about that specific operation and destination. A domain list is useful context for a question, not an architecture audit.
Inspect Ingredi AI's current Apple listing or Android listing before downloading or choosing a subscription. This guide has not inspected Ingredi's source code, network payloads or processing infrastructure and makes no on-device-only claim for it.