Privacy policy

• Effective date: October 26, 2026

"Planned" means the feature isn't built yet; this page describes how it will work when it is.

The short version

• We keep what the app needs to run your kitchen: your sign-in email, your kitchen's lists, pantry and recipes, and the food preferences you choose to give us.
• Allergies, foods you can't eat and diets are health data. We save them only after you say yes, and we share them with your kitchen only after a second yes.
• We don't sell your data. We don't show ads.
• Reading a photo of your shelf or a receipt uses an AI service, and more AI features are planned. We never send the AI service your account name, your email or who has which allergy. A photo goes as you took it, so anything printed in it, such as a loyalty-card name on a receipt, a medicine label or a letter, reaches the AI provider. The app has no way to crop it, so keep those out of the shot or cover them.
• You can delete your account at any time, and it takes effect at once.
• Children under 13 don't get an account. A parent adds them to the kitchen instead.

Who we are

Pantry Assistant is run by Mosier Information Services, Inc., 211 E. Main Street, Suite 213, Lakeland, FL 33801, United States. It's a one-person team. Questions about this policy go to support@mosierdata.com.

What the app keeps

Your account

• Your email address, used to sign you in. You sign in with a one-time code or link we email you; there is no password, and no Sign in with Apple or Google for now.
• Whether you said you are 13 or older, and the date you said it. We ask your birth year once, when you first sign up, only to check this. We do not keep the birth year.
• Your name as other people in your kitchen see it, a color, and a profile photo if you add one. A profile photo is seen only by people in your kitchens and is never sent to an AI service.
• Your settings, such as your daily Check-in reminder time.

Your kitchen

A kitchen is the group of people who share one fridge and pantry. Everyone in a kitchen sees its shared data.

• Shopping lists and their items. A Private List is seen only by the person who made it.
• The Pantry: the food on hand, how much is left, and dates.
• Recipes, the week's dinner plan and the daily Check-in answers.
• Photos that come with recipes you import. They're stored with the kitchen's copy of the recipe.
• Who is in the kitchen and what each person can do there.
• When someone changes a line, their name shows on it for a day.

Your food preferences

• Likes and dislikes, and recipe ratings (ratings are planned). These aren't health data. They're shared with a kitchen only where you eat.
• Allergies, foods you can't eat and diets. See "Health data" below.

Recipe links you import

When you share a recipe link to the app, our server fetches that public page and reads the recipe from it with our own code. No AI is used for this.

Delivery order emails (planned)

Later, as a planned subscription-only feature, you'll be able to forward a grocery delivery email to your kitchen's own order address. Our code cuts out the item lines (name, amount, price, date) and sends only those to our AI gateway to be read; the name, address and payment details are not sent. We keep the store, the date and each food line with its amount and price. The original email is deleted once you confirm the items, or after 30 days, whichever comes first. We never keep the delivery address or card digits, and only food lines are kept.

Our website's email forms

On pantryassistant.app you can ask us to email you a link to the app, join the waitlist, or, once the app is out, ask for occasional notes about using it. A link is sent once and we don't keep your address; we count only how many links went out each day. The waitlist and the notes keep your address, which of the two you asked for, the phone you chose and which page you signed up on, but only after you open the link in the confirmation email and tap Confirm; if you don't within 7 days, nothing is kept. Every email from these lists has a link to leave. Leaving deletes your address from both at once and puts it on our email service's do-not-send list for these emails, so you won't get them again even if we ever restore an older copy of our database. Those copies are kept for 7 days, so your address can stay in them for up to 7 days after you leave. While a form is in use we count, for an hour or a day and in memory only, how often your network and your address used it, to stop abuse. We never sell, rent or share your email address.

Our welcome and waitlist emails

After you join the waitlist or make an account, we may send a short series of emails. They are timed only from things our server already holds to run the app: the day your account was made, whether your kitchen has saved a Check-in or finished a Put Away and on how many days, and which of a recipe share, Fill My Week or a scan your kitchen has used. They never use your allergies, diets, who eats with you, or anything about your health, and we do not track whether you open an email or tap a link in it; taps are only counted in total. The welcome and "what changes" emails are service mail about your account. The rest go only if you tick "Occasional notes about using Pantry Assistant" at setup, which starts unticked. Every one has a link to unsubscribe, and one tap in your mail app does the same. Leaving stops them at once; we keep only a count of how many people left after each email, with no address. The series ends on its own when your kitchen is using the app most days, when you leave, or when you delete your account.

Crash reports

When the app crashes, it sends a crash report to our error reporter. The report keeps where the crash happened and the app version. It leaves out recipe text, what you typed and your account details. It takes no screenshots and records no screens.

Our website

This website counts visits and button clicks in totals on our own server, with no cookies and no address or device id kept.

What we don't collect

• No advertising or ad tracking. The app has no ads.
• No location sent to the AI. Profile photos are rebuilt on our server as a fresh image with no location data, and the copy we keep of a shelf scan photo has none either. Recipe photos are stored as we receive them, so we make no promise that their location data is removed. Your phone removes metadata, including location, from shelf and receipt photos before upload: the camera and the picker are asked not to include it, and the app then strips whatever is left from the photo's bytes.
• No contacts. Text invites go out from your own phone's messages app, not from us.
• Guests you add to one dinner are forgotten after that dinner, allergies included.

Health data

Allergies, foods you can't eat and diets (such as vegetarian, gluten-free, halal or kosher) are health data, and some are religious data. We hold them to one strict standard for everyone, wherever you live.

• You opt in first. Before the first one is saved, you see one screen and tap "Allow saving my allergies". "Not now" saves nothing. We record when you said yes.
• Sharing is a second opt-in. On the same screen, each kitchen where you eat has its own unticked line: "Share with [kitchen] so dinners plan around it". It starts off. With it off, people in that kitchen can't see your allergies and dinners there don't plan around them.
• Who sees it. With sharing on, only people in that kitchen, and only while you eat there. Turning sharing off removes the shared copy, and phones drop it the next time they sync.
• Never to outside AI apps. A connected AI app (such as ChatGPT or Claude) never reads your allergies, foods you can't eat or diets, whatever your settings.
• Never sold or shared for any other reason. It goes only to the people you share it with and to the services that run the app, listed below.
• The app is a planning helper. It reads like this on screen: "The app leaves out dinners with your allergies, using the ingredients it knows about. It can miss things. Always check labels."

AI features

Two features in the app use AI today: reading a photo of your shelf (Shelf Scan) and reading a photo of a receipt (Receipt Scan). Other AI-assisted features (such as reading a grocery order email, or writing a dinner from what's in your pantry) are planned.

When you use an AI feature:

• You say yes first. The first time you use one, a short screen asks. "Not now" hides AI features for you only. You can change it in Settings.
• No account details go to the AI. Every AI request goes through one gateway on our server. Apart from photos, it sends only food details: recipes, ingredients, food names and amounts, how many people eat, a time limit, and allergens as plain food words ("no peanut"). It never sends your account name, email, account or kitchen id, location, or who has which allergy. A photo is sent as taken, so anything printed in it (such as a loyalty-card name or the last digits of a card on a receipt, a medicine label or a letter) reaches the AI provider; the app can't crop it, so keep those out of the shot or cover them.
• Order emails. Parsing a forwarded order email is a planned subscription-only feature. Its item lines (name, amount, price, date) go to the AI gateway; name, address and payment details never do.
• Photos. Before upload, your phone shrinks the photo and removes its metadata, including location (see "No location sent to the AI" above). On builds with face detection, your phone also blurs faces in a shelf photo before upload. Our server blurs faces in a shelf photo again before it goes to the AI service; a photo the server can't open goes as it came. Receipt photos aren't blurred, because blurring stops them being read. A receipt photo is held in our server's memory only while the request runs. We never save it to storage, and your phone deletes every temporary file copy of the photo as soon as it has read it (if a delete fails, the file stays in the app's cache until the system clears it), and drops its in-memory copy when you confirm or drop the scan. The web app makes no file copy. Other scan photos sit in private storage and are deleted as soon as you confirm the scan, or when an unconfirmed scan expires. Only the results are kept. This covers our copy: the AI provider handles the photo under its own policy (see AI providers).
• AI providers. Requests go through OpenRouter. On every request we ask for zero data retention, no training, and US servers only. We can't promise what a provider keeps beyond that. Some providers, Google among them, may keep a copy for safety checks under their own policies. We never choose a provider that trains on our data. Anthropic's Claude under its paid terms, which don't allow training on our data, is also allowed. We never send requests to an AI company's own service based in China. This page will list the current providers by name.

Who processes your data

These services help run the app. Each gets only what its job needs.

A connected AI app you choose to link (such as ChatGPT or Claude) is not our processor. It reads your kitchen's shared data under its own terms, never your allergies. You can disconnect it in Settings at any time. The connection is planned.

Where your data lives

• On our server and database, hosted by DigitalOcean in New York, United States (its NYC3 data center).
• On your phone. Each phone keeps a copy of your kitchen's data so the app works offline. Signing out on a phone wipes its copy.
• When someone leaves or is removed from a kitchen, their phone drops that kitchen's data the next time it connects. A phone that never reconnects keeps what it had, protected only by its own lock.

How long we keep it

Leaving a kitchen or deleting your account

• Delete your account. It takes effect at once, with no undo. You're signed out everywhere. Your data is wiped within 30 days. You can also email support@mosierdata.com and we'll delete it for you.
• Leave a kitchen. You can leave at any time. You're offered a new kitchen with a copy of the recipes, and your Private Lists can move with you. The pantry and shared lists stay, since the food is physical.
• If you're the last owner of a kitchen and you leave, you first pick a new owner or delete the kitchen. If you delete your account instead, the longest-standing member with an account becomes the owner, preferring an Editor, and is told. If only members with no login are left, the kitchen is deleted.
• What stays behind. Shared things you made, such as recipes and list items, stay with the kitchen, labelled "Former member". Your own food preferences are deleted.

Your choices and rights

• See and download your data. A "Download my data" button in Settings builds a file of your account data and your kitchens' shared data. It never includes other people's private lists, food preferences or contact details.
• Correct it. Edit your details, lists, recipes and preferences in the app.
• Take back a yes. Turn off sharing for a kitchen, delete your allergies, or turn off AI Permission in Settings.
• Delete it. See above.
• Ask us. Email support@mosierdata.com for anything here. We reply within 1 to 2 business days.

Children

• Nobody under 13 gets an account. Sign-up asks for your birth year once, only to check this, and we do not keep it. If you say you are under 13 we do not save your email address in our database, and we do not create an account. Two short-lived copies can remain that we cannot delete early: our email service (SendGrid) sends the sign-in code before we ask for your birth year, and its delivery log holds your address for 7 days (the period our SendGrid dashboard shows; we do not buy its 30-day extension), and our database backups, which are kept for 7 days, can hold the address for those days.
• A parent or other owner can add a child to the kitchen as a Managed Member. A Managed Member has no login. The owner keeps the child's food preferences and gives the health-data yes for them.
• Once the child turns 13 and makes their own account, an owner can link them (planned). Their preferences move to their account, and from then on they control them.
• If we learn that someone under 13 has an account, we delete it. Parents can reach us at support@mosierdata.com.

Security

• All traffic uses HTTPS.
• Every change goes through our server, which checks you're allowed to make it.
• Each phone gets only the data it should, and an automatic test checks this on every change.
• Sign-in tokens last 60 minutes, so a signed-out or deleted account stops getting new data within the hour.
• If a breach affects your health data, we'll tell you as the law requires.

Changes to this policy

We'll update this page when the app changes, and change the effective date at the top. If a change affects how we use data you've already given us, we'll tell you in the app before it takes effect.

Contact

support@mosierdata.com. One-person team, replies within 1 to 2 business days, no 24/7 cover.