Privacy Policy

Introduction

Fridgify is independently developed and maintained in Germany. This Privacy Policy explains how Fridgify ("we," "our," or "the app") collects, uses, discloses, and safeguards your information when you use our mobile application.

Our Privacy Philosophy

• No mandatory user accounts or email registration
• No behavioral tracking or analytics
• No third-party advertising networks
• No social media integration
• Minimal data collection, maximum privacy protection

At a Glance

• We don’t collect personal data or require accounts
• No ads, tracking, or third-party analytics
• Your data stays private and encrypted
• Barcode scans are looked up on your device and never sent anywhere
• Recipes are matched against your pantry on your device; nothing about what you have is uploaded
• Group features are optional and encrypted
• The optional feedback board is public in-app and not encrypted — everything else stays private
• Translation reports are optional, readable only by the developer, and never shown to other users
• Export and delete your data anytime
• Crash reports are opt-in, anonymous, and off by default

Information We Collect

1. Information You Provide Directly

Grocery & Shopping List Data (Encrypted):

• Item names, quantities, and units
• Food categories and expiration dates
• Notes and custom metadata
• Tracked dates (opened, purchased, checked)

Waste Tracking Data (Encrypted):

• Item outcomes (consumed, expired, donated)
• Estimated prices and currency info
• Consumption statistics

Suggestions & Learned Items (Encrypted):

• Frequently used item names, their typical shelf life, unit and storage location
• Barcodes you named or corrected yourself
• Kept on your device; shared within a group only if that group turns on shared learning

Price Memory (Encrypted):

• Prices you paid, read from receipts or scale labels or typed in, remembered per product
• Personal entries never leave your device; group entries sync only if that group turns on shared learning

Group Collaboration Data (Encrypted):

• Group names and roles
• Member participation
• Shared inventory and shopping lists

Recipes & Cookbooks (Encrypted):

• Cookbooks and recipes you write, paste, or read off a photographed page
• The page photo itself stays on your device; it travels in your backups, not in the export
• Synced within a group like your inventory, encrypted before upload

Community Feedback (Not Encrypted, Opt-In):

• Posts, comments, and votes you choose to share on the in-app feedback board
• Transmitted over TLS but stored readable on our server so every user can read them — do not include personal details
• Posted under an automatically generated pseudonym that changes with every post; votes are stored under a separate anonymous hash, uncorrelated with authorship
• Includes basic language-detection metadata for moderation
• Visible only inside the app — never published on the web

Translation Reports (Not Encrypted, Opt-In):

• When you report a wrong or awkward translation, the report contains the app text you picked (its identifier and the text as shown), the app's language and version, the kind of problem, and any wording or description you type
• Stored readable on our server and visible only to the developer, never to other users or on the feedback board
• Kept under the same anonymous hash as your feedback posts, so the app can show which of your reports were fixed; no IP address or device identifier is stored
• The wording and description you type are checked automatically for abuse and contact details, including by OpenAI's moderation service, which receives the text alone and nothing that identifies you (see Data Sharing)
• When you delete your feedback (Feedback → ⋯ → Delete All My Posts) or your account, the link to you is removed and the report stays without it, so a suggested wording can still improve the app. A report the automated check flagged is deleted instead, because its text might identify someone

2. Information Automatically Collected

Pseudonymous User Identifier:

• A randomly generated UUID is created on first launch to enable data sync and device linking
• It is not linked to your real identity and is stored securely in the iOS Keychain
• The Keychain copy may persist across app reinstalls — this is what lets your groups and encrypted data survive if you reinstall. You can delete your ID and all data directly in the app, or request server-side deletion via support@fridgify.app

Device Information:

• Device model and iOS version
• App version
• Locale and timezone (used for date/time formatting only)

Sync Metadata:

• To deliver a change to the right household, our server necessarily sees a small amount of metadata about it: the group ID, timestamps, the size of the payload, and which version of the group key encrypted it
• It never sees the contents. Item names, categories, quantities, prices, dates, notes and outcomes are encrypted on your device before upload, and the server has no key to open them
• The key version is a counter, not a description of your data: it says which generation of a group's key was used, nothing about what was written

Server Logs:

• Like every online service, our servers keep short-lived technical logs when the app connects: IP address, the requested endpoint, response status, and timestamp
• Used solely for security (detecting attacks and abuse) and keeping the service running — never for profiling, analytics, or advertising
• Deleted automatically within 7 days
• They can never contain your inventory, shopping lists, or scans — that data is end-to-end encrypted and product lookups happen entirely on your device

Service Status Check:

• On launch the app fetches a small public status file from fridgify.app so it can show you a maintenance or outage notice
• The request carries no identifier and no data; our web server logs it like any page view (see Server Logs)

Diagnostics Log (only if you turn it on):

• A troubleshooting mode you activate yourself, from the version line in Settings. It records how the app connects to our server: app and iOS version, device model, the state of the device certificate and sign-in token, and each failed request with its error
• It contains no inventory, shopping lists, group names, or keys. It stays on your device, capped in size, until you turn diagnostics off or wipe the device
• It leaves your device only inside an email you write to support yourself, after seeing its full content

Crash Data (Opt-In, via Sentry):

• Off by default — the app asks once whether you want to share anonymous crash reports, and nothing is sent unless you say yes
• Anonymous crash logs and stack traces, collected solely to improve app stability
• No session tracking, no performance monitoring, no personal data or content — ever

Crash Reporting Consent:

You can enable or disable anonymous crash reporting at any time through the app's Privacy settings (Settings → Your Account → Privacy → Diagnostics). Changes take effect immediately. Crash reports, when enabled, never contain personally identifiable information.

Sentry Privacy Policy

3. What We Do NOT Collect

We do not collect or store:

• Email addresses or phone numbers (writing to support shows us your address, which we use only to answer you)
• Real names or demographic details
• Location data or GPS
• Contacts or calendar access
• Camera or photo library access (unless manually used)
• What you scan: barcodes are matched offline against a database on your device
• Web browsing history or in-app usage analytics
• Advertising IDs or tracking cookies
• Social media profiles or logins

How We Use Your Information

Core App Functionality:

• Store and organize your grocery inventory
• Manage shopping lists
• Track expiration dates and waste statistics
• Send local reminders

Group Sharing:

• Synchronize shared lists and inventory
• Manage permissions (Owner/Admin/Member)

Notifications:

• Local alerts (e.g., item expiring soon)
• Sync-triggered updates (e.g., group member adds item)

Community Feedback (only if you set it up):

• Show your posts, comments, and votes to other users inside the app
• Rank ideas and moderate content (automated language and spam checks)

Translation Reports (only if you send one):

• Correct the app's wording in your language
• Check typed wording for abuse before any of it can end up in the app

Crash Reporting (only if you opt in):

• Diagnose and fix stability issues
• Improve performance based on anonymous error logs

Data Storage & Security

Encryption

• AES-256 used for field-level encryption of items, notes, categories
• Encryption keys securely stored in iOS Keychain
• Data encrypted both in transit and at rest
• Group keys are versioned. When someone is removed from a group, the group can be given a fresh key, so anything written from then on is unreadable to them. Each member keeps their own copy of the older keys, so the group's history stays readable
• Every copy of a group key is wrapped with the member's personal key before it reaches us. The server stores keys it cannot open, and never sees one in the clear

Secure Communication

• Mutual TLS (mTLS) and certificate pinning
• JWT token-based authentication
• All sync traffic sent over HTTPS

Local Storage

• Encrypted Core Data + SQLite
• Secure Enclave protection on supported devices

Data Sync & Cloud Services

Backend Sync (Not iCloud):

• Fridgify uses a secure, custom backend (not CloudKit)
• Only encrypted group/shared data is synced
• Aside from feedback posts you write for the community and translation reports you send, no personal data leaves the device unencrypted

Offline-First Architecture:

• App works fully offline
• Changes are queued locally and synced when back online

Barcode Scanning & the Product Database

Lookups happen on your device:

• To recognize scanned products, Fridgify downloads a product database for the countries you choose (barcode, name, brand, category, quantity) and stores it on your phone
• A scanned barcode is looked up in that local database only. Scanning never creates a network request, not to us and not to anyone else, so nobody can learn what you scan, buy, or eat
• QR codes that contain product links (GS1 Digital Link) are decoded on the device; the link itself is never opened, so the brand behind it never learns a scan happened
• Names you assign or correct yourself are stored on your device, encrypted like the rest of your data

What our server sees:

• Which country packs your device downloads, and its occasional checks for updates
• A pack is a bulk file, identical for every user; downloading it says nothing about what you scan

Where the product data comes from:

• The database is built from Open Food Facts, the open community food database, used under the Open Database License (ODbL)
• Full attribution is shown in the app's product database settings

Recipes

Matching happens on your device:

• Fridgify downloads recipe packs for the languages you choose, as bulk files identical for every user, and stores them on your phone. Recipe images arrive the same way, one file per cookbook, only if you turn them on
• Which recipes you can cook is worked out on the device against your local pantry. Your inventory, or any summary of it, is never uploaded for this purpose
• Which recipes you open, match, or cook is never reported to anyone

What our server sees:

• Which packs your device downloads, and its occasional checks for updates, under the same device credential it already uses for sync

Your own recipes:

• Cookbooks and recipes you write are encrypted on your device and sync within a group like your inventory
• A photographed page is read on the device and the photo stays there

Data Sharing & Third Parties

We Share Data With:

1. Sentry (Error Diagnostics, EU servers)
   • App crash reports: crash logs, device model, app version (anonymously; only if you've enabled crash reports — off by default)
   • Server-side errors: when our own backend hits an error, a technical report (error details and the affected endpoint — no IP addresses, no message contents) is sent to Sentry so we can fix it; this concerns our servers, not your device, and is independent of the crash-report setting
   • Sentry Privacy Policy
2. Apple (In-App Purchases)
   • Purpose: subscription and payment processing
   • Shares: transaction receipts
   • Apple Privacy Policy
3. Group Members (if you opt in)
   • Purpose: collaborative inventory/shopping lists
   • End-to-end encrypted
4. Other Fridgify Users (Community Feedback)
   • Purpose: sharing ideas and votes on the in-app feedback board
   • Shares: your posts, comments, votes, and rotating pseudonym
   • Not encrypted — readable by all users inside the app
5. OpenAI (Automated Content Moderation)
   • Purpose: checking text for abuse, spam and contact details before it appears on the feedback board or can end up in the app's translations
   • Shares: only the text of feedback posts and comments and the wording you type into a translation report, sent from our server under Fridgify's own account
   • Nothing that identifies you travels with the text: no ID, no pseudonym, no device information and no IP address, so OpenAI cannot tell who wrote it
   • OpenAI Privacy Policy

We Do NOT Share Data With:

• Advertisers
• Analytics providers (Google, Mixpanel, etc.)
• Social media platforms
• Data brokers or aggregators
• Any other third parties

Group Sharing & Collaboration

• Join groups via invite codes
• All group data is end-to-end encrypted
• Group roles: Member, Admin, Owner
• Leave a group anytime
• Your data stops syncing upon leaving
• When you leave or are removed from a group, that group's items, lists and keys are removed from your device. Access ends and the copy ends with it, so a household's inventory does not live on in the device of someone who is no longer part of it
• Your personal inventory is never touched by this, and rejoining a group simply starts fresh from the server

Your Rights & Choices

Data Access & Portability

• Export all data (JSON format) via Settings → Export
• Includes your grocery items (with prices, quantities, units, notes, and the dates you tracked, such as expiry, opened, and frozen), your shopping lists, your waste and consumption history, your custom items, your custom storage locations and categories, what the receipt importer has learned from your corrections, the prices you paid, your cookbooks and recipes, barcodes you told the scanner to ignore, your event badges, your support purchases, and the groups you own
• Backups made in the app additionally carry photographed recipe pages and any changes still waiting to sync
• Everything is exported in the clear, in a plain JSON file you can read and keep. Nothing in it is locked to Fridgify

Delete Your Data

• Delete individual items or groups anytime
• Delete your entire account and all server-side data directly in the app
• Uninstall app to remove local data
• Lost access to your device? Request deletion by email — the request is cryptographically signed, so only you can make it
• Delete all your feedback directly in the app (Feedback → ⋯ → Delete All My Posts), or email a post ID (long-press any post → Copy Post ID) to support@fridgify.app for selective removal
• Translation reports are unlinked from you rather than deleted, both by Delete All My Posts and by deleting your account: what remains no longer points to you

Notifications

• Customize reminders (same day, 3 days before, etc.)
• Enable/disable per group

Crash Reporting

• Off by default — the app asks once on first launch
• Enable or disable anytime via Privacy settings

Data Retention

• Active data: kept while app is installed or you're in a group
• Deleted data:
  • Local: erased immediately
  • Server: erased within 30 days
  • Backups: purged within 90 days
• Server logs: deleted within 7 days (this also bounds how long any technical reference to a deleted account can linger in logs)
• Diagnostics log: on your device only, capped in size, deleted when you turn diagnostics off or wipe the device
• Feedback content that is held for moderation review is retained until the review completes, then follows the normal deletion rules
• Translation reports: deleted as soon as the developer decides to keep the current wording; otherwise kept without any link to you once you delete your feedback or account, so suggested wording is not lost, while reports the automated check flagged are deleted at that point instead
• The UUID's Keychain copy may persist across reinstalls; delete your ID and data in the app, or request server-side deletion via support@fridgify.app

Children’s Privacy

Fridgify does not knowingly collect data from children under 13. If you believe data was submitted by a child, contact us for prompt deletion.

International Data Transfers

• Servers located in Germany
• Sync may cross borders depending on user location
• All sync data encrypted with mTLS and certificate pinning

GDPR & CCPA Compliance

• Right to access: export your data anytime
• Right to deletion: delete your account in the app, uninstall, or contact us
• Right to portability: JSON export format
• Right to withdraw consent: leave groups or uninstall
• Legal basis for processing: consent and contractual obligation (Art. 6(1)(a)(b) GDPR)

To exercise these rights, contact: support@fridgify.app

In-App Purchases & Support

Fridgify is free to use and provides all core and advanced features at no cost. We offer optional in-app purchases solely for users who wish to support the ongoing development and maintenance of the app.

• Founders Edition (one-time support)
• Monthly / Annual Support Subscriptions
• One-time tips
• These purchases do not unlock additional features; all functionality is available for free
• Processed securely via Apple; we never see your payment details

Apple Privacy Label:

• Data Not Linked to You: identifiers (anonymous user ID), crash data (opt-in)
• No tracking
• No personal data collection

Changes to This Policy

We may update this Privacy Policy to reflect app or legal changes. If changes are significant:

• We update the "Last Updated" date
• Post a notice in the app
• Request acknowledgment if required

Contact Us

• Email: support@fridgify.app
• Website: https://fridgify.app
• In-App: Settings → Help & Support → Contact

Our Commitments to You

• No tracking or profiling
• End-to-end encryption of your data
• No third-party ads or analytics
• Fully functional without registration
• Complete user control over shared data
• Transparent practices with privacy-first design

We respect your privacy — always.