Privacy Policy

This policy describes how PantryZero handles information when you use the website at pantryzero.app, the PantryZero iOS app, and the API behind them. PantryZero is operated by GRIFFIN DIGITAL LLC, a Michigan limited liability company (“we”, “us”).

The short version: the account and kitchen data you give us is stored so the app can plan meals from your pantry. It is not sold, and the iOS app does not track you across other companies’ apps or sites.

Information you give us

Account. Current sign-up and sign-in use an email address and a sign-in link or one-time code sent by Supabase Auth. The iOS sign-up form also lets you provide an optional name, which is stored with your Supabase account. Supabase manages email verification, your account id, and session tokens, along with any password or password-recovery information for older accounts. Our API receives an access token to verify your identity; it does not receive your sign-in code or password. App records are linked to your Supabase account id. Loading subscription status also stores or updates the email address from that token so the operator can find your account and manage subscription access.

Terms acceptance. We store the Terms version you explicitly accept and the server-recorded acceptance time, linked to your account id. This lets us require agreement to the latest effective Terms before you continue using the app.

Pantry and cooking. Ingredient names, quantities, units, categories, expiry dates, storage location (pantry, fridge, or freezer), and any estimated value. Meal-plan slots. Grocery-list items, including whether one was marked purchased and which recipe it came from. Recipes you favorite or file in a collection. Events logged when food is cooked, discarded, or marked expired, including an estimated value used for the waste tally.

Preferences. Dietary restrictions you turn on, ingredients you do not want suggested, an optional daily calorie target, a default number of servings, how long you usually have to cook on a weeknight, how adventurous suggestions should be, and foods you say usually spoil, if you save that.

Messages. If you contact support, your email address and the information you include in the message are used to respond to your request.

Information stored on your device

The website saves your Supabase session in browser storage to keep you signed in, and records whether you have completed the welcome flow. It also keeps recently loaded app data in memory while the page is open. The iOS app stores its Supabase session in the device’s Keychain and saves settings such as your biometric sign-in preference and configured API address locally.

The iOS app also saves a copy of your pantry on the device for offline viewing. Signing out or deleting your account through the app does not currently clear that pantry cache. Deleting the iOS app, rather than offloading it, removes its local pantry cache. Clearing the website’s browser storage removes its saved session and welcome preference. Neither action deletes your account or data stored on our servers.

Photos, camera, and barcodes

Receipt and shelf photos. If you scan a receipt or a shelf, the app sends that image to our API, which forwards it to Anthropic to read grocery items (and, on a receipt, line prices). The entire selected image is sent, so it may include personal details visible on a receipt or in the background. You can review the extracted items before adding them. The scan endpoints do not save the image or extracted result in our app database; the ingredient details and any prices you choose to add are saved to your pantry. We do not train our own model on these images. Anthropic’s handling and retention are governed by its commercial terms and data-retention policy. Deleting your PantryZero account does not itself delete copies retained by Anthropic.

Scanning is optional. The iOS app uses the camera to read product barcodes and expiry-date text on the device; those camera images are not sent to our API. Receipt and food-photo scanning use images you select with the system photo picker. You can skip scanning and type items in instead.

Barcodes. When barcode lookup is on, the iOS app sends the barcode from your device to Open Food Facts (world.openfoodfacts.org) to fetch a product name and category. That request does not pass through our servers or include your PantryZero account id. Open Food Facts also receives ordinary network information, such as your IP address, when your device makes the request.

Biometric sign-in. If you enable it on a supported device, the app can ask iOS to authenticate you with Face ID or Touch ID before reusing a stored Supabase session. This optional sign-in action does not add a biometric lock to every app launch. The app receives the authentication result, not your biometric data, and does not send biometric data to our servers.

Subscriptions

PantryZero Pro is billed by Apple through the App Store. We do not receive your card number, Apple ID password, or billing address. After a purchase or restore, the app sends Apple’s signed transaction to our API. We store the plan, status, whether the current period is a free trial, when access expires, the product id (com.pantry.pro.monthly or com.pantry.pro.annual), and Apple’s original transaction id, plus the cached email. Apple keeps its own record of the purchase.

Website analytics

If the website is configured with an analytics hostname, pages load Plausible. Plausible receives page-view requests with the page address, referrer, IP address, and browser information. It uses that information to produce website statistics, including approximate location and device information. Its published policy says it does not store raw IP addresses or user-agent strings, use cookies, or track visitors across websites. PantryZero does not send your account id, pantry, or dietary preferences to Plausible. The iOS app does not include it. If the analytics hostname is unset, the script is not loaded.

Technical information and logs

Hosting and authentication providers receive network and device information when you connect, such as your IP address and browser information. Our API records operational events and errors, including request paths and account ids for some account-related events. The iOS app also writes device logs for failed API requests, including request URLs and error responses. These logs help diagnose problems and operate the service.

When the website, the iOS app, or our API hits an error or crashes, it sends an error report to Sentry. A report contains the error and stack trace, the app version, device or browser type and operating system, recent app activity leading up to the error (such as screens visited and request addresses), and your PantryZero account id when you are signed in. It does not include your email, password, access token, pantry contents, or photos. Error reports are used only to find and fix problems.

How we use it

• To sign you in and keep your pantry, plan, grocery list, and preferences on your account.
• To score recipes against what you have, including food that is close to expiring.
• To confirm a PantryZero Pro purchase with Apple and apply free-plan limits when you are not subscribed.
• To answer email you send us.
• To maintain sessions, support offline pantry viewing, and diagnose service problems.
• To record your agreement to the Terms version you reviewed.

Personal information is not sold. It is not used for advertising or for tracking you across other companies’ apps and websites.

Who else handles it

• Supabase manages your account, email verification, and sessions. See its privacy policy.
• Apple processes App Store payment and subscription status for PantryZero Pro.
• Anthropic (anthropic.com) receives a receipt or shelf image only when you use scanning.
• Open Food Facts receives a barcode from the iOS app when you use barcode lookup.
• Plausible may receive website page views, as described above.
• Sentry receives error and crash reports, as described above.
• Hosting providers run the website, API, and database and handle requests to them. The production services use Railway hosting and Cloudflare for public traffic. The iOS app can also be configured to use a different API address; that server receives the access token and app data sent to it, and its operator is responsible for its data handling.

Those providers process information to provide their services. They may do that in the United States or in other countries where they operate, under their respective terms and privacy policies.

How long we keep it, and how to delete it

Your account and app records remain until you delete them or your account. Signing out or deleting the app from your phone does not delete server records. Our scan endpoints do not persist receipt or food photos in the app database; Anthropic’s separate retention is described above. Support correspondence and operational logs are separate from your pantry records and are not automatically removed by the in-app account-deletion flow.

You can delete the account yourself. On the iPhone, open the Profile tab and choose Delete Account. On the website, open your profile and choose Delete account. Type DELETE to confirm. That removes your Supabase sign-in and the data stored for that user: pantry items, meal plans, grocery lists, dietary preferences, favorites, recipe collections, waste events, Terms acceptance records, and the subscription record, including the cached email. The shared recipe catalog is not part of your account and stays up. The server retains your account id and the deletion time so it can reject previously issued access tokens. That deletion record currently has no automatic expiry and does not contain your email address or kitchen data. Local device storage is separate, as described above.

The sign-in account is removed before the app records. If the sign-in provider cannot be reached or deletion is not configured on the server, deletion fails without removing app records. If the later app-data cleanup fails, the sign-in account may already be gone while app records remain. Contact support if deletion does not complete. Service-provider logs and any backups are subject to their separate retention policies and are not selectively erased by this flow.

Deleting the account does not cancel an App Store subscription. If PantryZero Pro is still renewing, turn it off under Settings → your name → Subscriptions. Apple may keep its own record of the purchase after the account is gone.

You can also email [email protected] and ask to delete the account, to send a copy of what is stored, or to correct it. That address is an alternate to the in-app deletion flow.

Children

PantryZero is not directed at children under 13, and personal information is not knowingly collected from them. If you believe a child under 13 has given us information, email [email protected] and it will be deleted.

Security

The API requires a valid Supabase access token for account data and scopes requests to the signed-in account. Production connections use HTTPS. Protect your email account and sign-in links or codes, and do not share them. No transmission or storage method is perfectly secure.

Changes

If this policy changes, the date at the top of this page changes with it. The new policy applies to information collected after that date.

Contact

[email protected]

The terms for using PantryZero, including PantryZero Pro, are on the Terms of Use page.