KitchensGuardian Privacy Policy

1. Who we are

KitchensGuardian is a mobile app that helps you track what is in your kitchen, read your grocery receipts, and plan what to cook before food expires. It is made by KitchensGuardian, Inc., a Delaware corporation (“KitchensGuardian”, “we”, “us”).

We are responsible for the personal information described in this policy.

Contact: support@kitchensguardian.com
Postal address: KitchensGuardian, Inc., 1111B South Governors Avenue, Ste 42756, Dover, DE 19904, USA

This policy covers the KitchensGuardian app on Google Play and the Apple App Store, our backend services, our email support, and the kitchensguardian.com website.

Where we offer the app. KitchensGuardian is offered in the United States and Canada only. The app is not listed in other App Store or Google Play regions, and we do not offer it to people outside those two countries.

2. Summary

• We collect your email, name and password (stored as a one-way hash) to run your account.
• We process photos of your receipts and of your fridge or pantry to read what is on them. A photo is deleted as soon as the scan finishes, and the temporary copy expires automatically within 15 minutes whatever happens.
• After you sign up, you can try a first scan before you pay: up to three photos of your kitchen, or one receipt. We read them the same way and do not keep the photos. Section 3.2 explains what we keep from it, and for how long.
• We send those photos, together with the country and currency set on your account, to OpenAI to read them. We do not send your name, email or account id to OpenAI. OpenAI does not use this data to train its models.
• We keep the text we read from your receipts (store, date, prices, item names, store codes) to build your pantry and to make future scans faster and more accurate for everyone. The shared part of this data is anonymous: it holds no account, kitchen, receipt or device identifiers.
• If you share a kitchen with other people, they can see the shared pantry, requests and your display name. They never see your email address.
• Subscriptions are sold through the Apple App Store and Google Play. We never see your payment details.
• The app shows no ads. From version 1.1.5, if you allow it, the app uses AppsFlyer to measure our ads on Meta’s services, such as Facebook and Instagram: AppsFlyer, and through it Meta, learn when the app is installed and opened. Ad measurement starts only if you allow it, and you can turn it off again (section 3.11). We collect crash reports through Firebase Crashlytics. From version 1.1.6, in app versions that offer the choice, Google Analytics for Firebase also helps us understand app use and improve setup if you separately allow Google app analytics. The website uses its own Google Analytics. Section 12 explains both uses and how to refuse them.
• We do not sell your personal information and we do not give it to data brokers. If you allow ad measurement, AppsFlyer gets your device’s advertising identifier, your IP address and when the app is installed and opened, and passes installs and app opens to Meta (section 3.11). Neither of them gets anything about your food, recipes or diet.
• You can delete your account in the app or by emailing us. Section 10 explains the account data we delete and the records that remain. These include shared-kitchen data, anonymous shared data and information already received by external providers. Deleting your account does not automatically erase previously collected Google app analytics or change the analytics choice saved on your phone. Turning off app analytics stops future collection; it does not recall data Google already received. Sections 10–12 explain these limits.

3. What we collect

3.1 Account data

• Email address. Used as your login, to send verification and password-reset codes, and to contact you about your account.
• First and last name. Your display name is shown to other members of kitchens you join and included in invitations and notifications.
• Password. We store only a bcrypt hash of your password. We cannot read your password.
• Verification and password-reset codes. Short codes we email you to confirm your address or reset your password.
• Profile photo (optional). Stored as an image inside your user record.
• Google sign-in. If you sign in with Google, Google sends us a signed token. We check that token with Google and keep only the email address and name it contains, together with a record that your address is verified. We do not store a Google account identifier.
• Sign in with Apple. Apple gives the app an identifier for your account, a one-time code and, on first sign-in, the email address and name you choose to share. Our server exchanges the code with Apple for a sign-in token. We keep the email address and name, Apple’s identifier for your account, and that token, which we store encrypted. We use them to sign you in and, when you delete your account, to tell Apple to end the app’s access. If Apple tells our server that you stopped using Sign in with Apple with our app, or deleted your Apple account, we sign you out everywhere.
• Subscription status. Whether a plan is active, its plan id and its expiry date. We do not receive or store card numbers or other payment details (see section 3.8).
• Account settings: country, currency and unit system. The currency used for prices always comes from this setting, never from the receipt.

3.2 Photos

• Receipt photos. Up to five photos per receipt. The app compresses them on your phone and uploads them over an encrypted connection. The backend holds the photo only while the scan runs and deletes it as soon as the scan finishes. The temporary copy expires automatically within 15 minutes whatever happens, including when a scan fails. Photos are never written to long-term storage. The app deletes its own copy when you sign out or delete your account.
• Fridge and pantry photos (smart kitchen setup). Up to three photos per area (fridge, freezer, pantry, spices and other), at most 12 per scan. They are handled the same way: read, sent to OpenAI for recognition, and deleted as soon as the scan finishes. The list of items detected and the list you confirm are stored with your kitchen.
• First scan before you pay (scan preview). After you sign up, and before you subscribe or set up a kitchen, you can take up to three photos of your kitchen, or one photo of a receipt, to see what the app finds. Before you scan, the app tells you the photos go to OpenAI.
  • Our server sends the photos to OpenAI to read them (section 5). It does not store the photos, and nothing from a preview is written to our database.
  • Kitchen photos: we keep the list of items found for up to 30 days. It is filed under a fingerprint of each photo, not under your account. When your kitchen is set up, the app scans the same photos into it and can use that list instead of sending them to OpenAI again.
  • Receipt: we keep the text read from it (the printed lines, the store name, the date and the total) for up to one hour, linked to your account, so the scan in your kitchen can reuse it. If you delete your account, we delete it then. If our temporary store can’t be reached at that moment, it still expires within the hour.
  • To prevent abuse, we count each day’s previews per account and per IP address. The IP address is kept only as a one-way hash, and the counts delete themselves within two days.
  • The app keeps its own copy of the photos on your phone. It deletes them once they are in your kitchen, when you sign out or delete your account, or the first time you open the app after 7 days.
• Item, recipe and profile photos. If you add a photo to an item, list entry or your profile, we store that image.

A content fingerprint (a SHA-256 hash) of each receipt and fridge photo is stored with your scan record so that the same photo does not need to be read twice. The fingerprint cannot be turned back into the photo. It is deleted with your scan history. A first scan before you pay has no scan record: its fingerprints are used only to file the temporary results described above.

3.3 Receipt contents

When we read a receipt we extract and store:

• store or chain name, receipt date and receipt total, together with the country and currency from your account settings (we do not take the currency from the receipt)
• each printed line: the raw line text, price, quantity, unit, store product code and barcode where printed
• the pantry items created from the receipt, with the price you paid, the store, the source line and the receipt they came from
• a record of each receipt scan (receipt id, photo fingerprint, store, date, total, the lines read, the kitchen and account that scanned it)

A receipt may contain other information about you that is printed on it, such as a loyalty-card number, the last digits of a payment card, a cashier name, your name or a store address. We do not look for that information and do not extract it on purpose, but it is in the photo while the photo is processed (see section 5 on AI processing). You can cover it before you scan. None of it is ever written to the shared data described in section 7.

3.4 Pantry, lists, recipes and cooking data

• Pantry items: name, quantity, unit, expiry date, storage location, package and price details, who added them.
• A history of item names ever added to your kitchen (used for suggestions, capped at 500 names).
• Grocery lists.
• Item add requests between kitchen members: what was requested, who requested it, who reviewed it and any reason given.
• Recipes generated for your kitchen, favourite recipes, meal plans and notes.
• Cooking and consumption data: what you mark as used, cooked or finished, and the usage patterns and estimates we build from it to predict when you will run out.
• Corrections you make to a scan result (before and after values). These teach the app to read your receipts better next time. Corrections are private to your kitchen and are deleted with your account.
• Your answers to the questions the app asks when you first set it up (for example how often you cook, who you cook for and what you spend on groceries) stay on your phone. We do not receive them.

3.5 Kitchens and members

• Kitchen name, the host, each member’s role and display name, and the kitchen’s unit system, country, currency and time zone.
• The kitchen’s invitation code. The code can be used more than once, expires after 7 days, and is revoked and replaced with a new one whenever a member is removed.
• Invitations and join requests: kitchen name, inviter’s display name, invitee, status.
• Recipe start requests between members: sender, host, recipe title, status.

3.6 Device and technical data

• Push notification token. A token from Firebase Cloud Messaging that lets our backend send notifications to your phone. We store it with your account and delete it when your account is deleted.
• App version. The app may send its version number with each request.
• IP address. Our servers record the IP address of every request in server logs and use it for rate limiting (to stop abuse). We do not build profiles from it.
• Platform (Android or iOS) for push delivery.
• We do not collect your precise location. The app does not request location permissions.
• We do not collect your contacts or your photo library beyond the photos you choose. From version 1.1.5 the app contains the AppsFlyer SDK to measure our ads. It runs only if you allow it, and then reads your device’s advertising identifier and records installs and app opens (section 3.11). The app shows no ads and contains no SDK that shows ads. Google’s Firebase SDKs (Crashlytics, Cloud Messaging, Firestore) and the RevenueCat SDK collect basic device information on their own; see sections 3.8 and 12.

Optional Google Analytics for Firebase can collect additional app-instance, device, network and usage information if you allow it, as described in section 3.12.

3.7 Crash data

The app uses Firebase Crashlytics. When the app crashes or hits an error, Crashlytics sends Google a report with the device model, operating system, app version and a technical stack trace, together with a Firebase installation identifier that Crashlytics attaches to each report. We do not attach your email address or your name to crash reports.

3.8 Payments and subscription management

Subscriptions are sold through the Apple App Store or Google Play. We never see your card number, bank details or billing address.

We manage subscriptions through RevenueCat, Inc. (United States), which checks your purchase with the store and tells our backend whether your plan is active. For this to work, our backend creates an identifier for your account and the app passes it to RevenueCat. That identifier is specific to billing and is not your email address or your name, but it does refer to your account, so we treat it as personal information. RevenueCat also receives the store purchase and the device and app information its SDK collects. RevenueCat acts as our service provider. We receive back only whether your plan is active, which plan it is and when the current period ends. See our Subscription Terms.

3.9 Support messages

If you email us, we keep the email thread so we can help you and keep a record of the request. There is no in-app contact form today.

3.10 Server logs

Our backend writes a log line for every request containing the method, path, IP address, request id and timestamp. The path does not include anything you type, so searches and other query values are never written to the log. Logs do not contain email addresses, verification codes, receipt text or sign-in tokens. Logs are kept for up to 30 days and are used only for debugging and security.

3.11 Ad measurement

We advertise KitchensGuardian on Meta’s services, such as Facebook and Instagram. From version 1.1.5, the app can use AppsFlyer to learn which of those ads lead people to install and open the app, but only if you allow it.

• On Android, the app asks the first time you open it. Until you tap Allow, nothing is sent to AppsFlyer and your advertising ID is not read.
• On iPhone, the app asks with Apple’s tracking prompt. If you choose Ask App Not to Track, AppsFlyer does not run at all.
• If you already use the app, it asks once, the first time you open version 1.1.5.

If you allow it, AppsFlyer receives:

• your device’s advertising identifier (the advertising ID on Android, the IDFA on iPhone) and other device identifiers AppsFlyer uses, such as its own install ID and, on iPhone, the IDFV;
• your IP address. AppsFlyer may use it to work out your approximate location, such as your country or city;
• your device model, operating system and app version, and similar technical details such as your language and network type;
• when the app is installed and each time it is opened.

AppsFlyer works out which of our ads, if any, led to the install, and passes installs and app opens to Meta Platforms, Inc., which uses them, under its own terms, to measure our ads and to improve how they are delivered. If you came from one of our ads, the app uses that only to choose which welcome screens to show you, and that choice stays on your phone.

We never send AppsFlyer or Meta your name, email address, account or billing identifier, anything about your purchases or subscription, or anything about your food, recipes, diet or kitchens. AppsFlyer keeps this data under its own retention periods. Meta keeps what it receives under its own retention periods.

To turn it off: after you sign in, tap Ad settings on the setup screens (next to Sign out or delete account, or inside it; it is there before you pay), or later go to Profile, then System, then Ad measurement. It stops at once. On iPhone you can also turn off tracking for the app in Settings, then Privacy & Security, then Tracking. On Android, until you sign in, you can stop it only by uninstalling the app or clearing its storage in Android settings; the app then asks again the next time you open it. Your answer belongs to the phone, not to your account, so it stays after you sign out or delete your account. The app works the same either way.

3.12 Optional Google app analytics

Google app analytics is a separate choice from ad measurement. Collection starts off. From version 1.1.6, in app versions that offer the choice, Google Analytics for Firebase measures app installation and use and helps us understand which setup screens people reach and whether setup finishes, if you allow it. The app works the same if you refuse.

Google receives an app-instance identifier, app and device information, network-related metadata and usage events. This can include app version, operating system, device model, approximate location derived from network information, installation, session and engagement events, crash-related events where supported, and supported automatic store-purchase information.

Our custom setup events contain only a fixed setup-screen identifier or a completion marker and a fixed indication that the event came from setup. They do not contain your answers, kitchen codes, food, photos, receipt text, recipes, diet, name, email or KitchensGuardian account identifier. Google can still associate analytics events through the app-instance and device information it receives; these records are not anonymous.

This choice does not allow Google advertising or ad personalization. The app keeps Google’s advertising-storage, advertising-user-data and advertising-personalization consent purposes denied. App analytics does not enable the separate AppsFlyer/Meta ad-measurement choice described in section 3.11.

You can change Google app analytics in Ad settings during setup or in Profile, under System. Turning it off stops future collection and asks Firebase to reset its local analytics identity and data. It does not delete information already received by Google or recall a request already accepted. Your choice belongs to this phone and remains when you sign out or delete your KitchensGuardian account.

4. Why we use your information

We use your information to run the app for you. The table below sets out each use.

In Canada we collect, use and disclose personal information with your knowledge and consent, except where the law allows otherwise. By creating an account and using the app you consent to the uses in this table, except ad measurement and Google app analytics. Each runs only if you separately allow it when the app asks, and stops when you turn it off (sections 3.11 and 3.12). You can withdraw your consent, and you can object to the uses we have described as improving the app; section 9 explains how.

5. AI processing: what we send to OpenAI

We use OpenAI’s API to read photos and text. This is what leaves our servers and goes to OpenAI:

• Receipt reading: the receipt photo itself, and a prompt containing the country and currency set on your account.
• Receipt enhancement: the line texts extracted from the receipt (item names and prices), with the currency, country and unit system.
• Fridge and pantry recognition: each fridge or pantry photo, the area label (for example “fridge” or “freezer”) and your unit system.
• First scan before you pay (scan preview): the same as receipt reading or fridge and pantry recognition above. For a receipt, if your account has no country or currency yet, we use your phone’s region.
• Recipes: the names and quantities of items in your pantry, items that are expiring, and any free-text recipe request you type.
• Expiry estimates: the item name and where it is stored.
• Icons and recipe images: the ingredient name, or the recipe title and summary.

What we do not send to OpenAI: your email address, your name, your user id, your kitchen id, your billing identifier, your push token, your IP address, or anything from your account record. Requests are made under our company API key, not under any identifier tied to you.

A receipt photo may itself show personal information printed by the store (see section 3.3). If you want to be sure it is not sent, cover that part of the receipt before scanning.

How OpenAI treats this data: KitchensGuardian signed OpenAI’s Data Processing Addendum on October 11, 2026, so OpenAI processes this data as our service provider under our instructions. Under OpenAI’s API terms, data sent through the API is not used to train OpenAI’s models. OpenAI keeps API inputs and outputs for up to 30 days to monitor for abuse and then deletes them. We do not have a zero-data-retention arrangement with OpenAI.

AI results are estimates. Item names, amounts, prices and expiry dates can be wrong. The app helps you review every result before it is saved, and you should always check food yourself before eating it.

6. Who we share information with

We share personal information only with the service providers below, with Meta to measure and improve our ads if you allow it (section 3.11), with other members of your kitchens, and where the law requires. We do not sell personal information. We do not share it with data brokers.

If we are ever acquired or merge with another company, your information may transfer to the new owner under this policy. We would tell you before that happens.

7. Using data to improve the app and train our own models

We use data from scans to make the app work better for everyone. This section explains exactly how, because some of it crosses between users.

7.1 Shared caches

When the app reads a receipt line with high confidence, we save the result (item name, price, quantity, unit, storage, expiry estimate) in a shared cache keyed by the normalised item text, currency and country. When any user later scans a line with the same text and a similar price, we reuse the cached reading instead of asking the AI again. The same applies to:

• exact printed receipt lines for a given store chain
• price and size estimates per product (per currency and country)
• store product codes, once at least three different kitchens and three different users agree on what they mean
• barcode lookups
• a shared ingredient catalog (expiry days, storage advice, icon) that is created automatically from scan results
• a pool of generated recipes and icons that can be reused

7.2 What shared data contains, and what it never contains

Shared data (the receipt line cache, product code cache, price estimates, quantity profiles, promotion counts, training log, recipe cache and icon store) is anonymous. It may contain:

• the normalised line text and the item name
• product codes (UPC, PLU or barcode)
• the store chain name only (for example a supermarket brand), never a branch
• package size and type, category and shelf life
• the exact price from the receipt, the currency and the country
• the month of the scan (never the exact date or time)
• aggregate counts (for example how many times a line has been seen)

It never contains your user id, kitchen id, receipt id, email, name, device token, billing identifier, IP address, photo, payment card digits, loyalty numbers, cashier names, store branch address or phone, or transaction ids. Nobody, including us, can trace a shared row back to you.

7.3 Scan history, corrections, and training our own models

We keep a history of each scan (the items read, the kitchen and account that scanned) and a log of corrections you make (what the AI read, what you changed it to). These are private to your kitchen. We use them to show you your history and to make your own future scans better. Both are deleted when you delete your account (section 10).

Separately, we produce anonymous data from scan results and keep it to improve the app and to train KitchensGuardian’s own future models. Only the anonymous data described in section 7.2 is kept for this. Everything that points to you (your user id, kitchen id, receipt id and the exact date) is removed before anything is kept, the month is kept instead of the date, and we hold a written record of how we do this and why the result cannot be traced back to a person. We review that record as the app changes. Once data is anonymous it is no longer information about you.

You can ask us to stop using your scan data to produce anonymous training data by emailing support@kitchensguardian.com. Data that is already anonymous cannot be traced back to you, so it cannot be removed.

We never try to re-identify anonymous data, and we never allow anyone else to.

7.4 Recipes

Recipes we generate for one kitchen may be reused for another kitchen with a similar set of ingredients. A reused recipe contains ingredient names and steps. It does not contain your name or kitchen name. What a recipe says you are missing is always worked out against the pantry of the kitchen that is asking, so a reused recipe never tells you anything about another kitchen’s pantry.

7.5 What we will not do

• We will not sell scan data or receipt data.
• We will not use your photos to train models. Receipt and fridge photos are deleted automatically after the scan finishes, so we could not do this even if we wanted to.
• We will not publish receipt contents in a way that identifies you.

8. Shared kitchens

When you join a kitchen with other people:

• All members can see the kitchen’s pantry, grocery lists, item add requests, recipes, meal plans and consumption data for that kitchen.
• All members can see each other’s display name and role. Members never see each other’s email addresses.
• The host can remove members and can delete the kitchen. When a member is removed, the kitchen’s invitation code is revoked and a new one is generated.
• Anyone with the kitchen’s invitation code can ask to join while the code is valid. Codes expire after 7 days. Share the code only with people you trust, and ask the host to refresh it if it leaks.
• Items, requests and recipes you add to a shared kitchen belong to that kitchen. If you leave or delete your account, they stay with the kitchen (section 10).
• A subscription belongs to one account. If a kitchen’s owner has an active subscription, it also covers the kitchen’s members while they use that kitchen. It does not let them create or own a kitchen of their own. A member’s own subscription does not cover the other members of a kitchen they joined.

9. Your rights and how to use them

You can:

• Access the personal information we hold about you.
• Correct inaccurate information. You can edit your name and profile in the app. Email us for anything else.
• Delete your account and personal information (section 10).
• Receive a copy of your information in a machine-readable format. There is no in-app export yet. Email us and we will send you a JSON copy within 30 days.
• Object to our use of your information to improve the app, including the shared caches and the production of anonymous training data, and ask us to pause a specific use while we review it.
• Withdraw your consent. We will explain what that means for your use of the app before we act on it. You can turn off ad measurement and Google app analytics separately in the app (sections 3.11 and 3.12). Refusing or turning off either optional choice does not restrict the app.
• Not be treated differently for exercising any of these rights.

How to make a request: email support@kitchensguardian.com from the email address on your account, and tell us which right you are exercising. We will reply to that address to confirm it is you. We answer within 30 days under PIPEDA and Quebec law, and within 45 days for CCPA requests. We may extend where the law allows, and we will tell you why. There is no charge for a reasonable number of requests.

9.1 California (CCPA/CPRA) and other US states

• We do not sell personal information. Ad measurement (section 3.11) runs only if you allow it. You can opt out in the app (Ad settings during setup, or Profile, then System, then Ad measurement) or, on iPhone, in Settings, then Privacy & Security, then Tracking.
• You have the right to know, delete, correct, and opt out, and the right not to be discriminated against.
• We do not use or disclose sensitive personal information for purposes other than providing the service.
• An authorised agent can make a request for you with signed permission.
• CalOPPA: the app is not a website and does not respond to browser “Do Not Track” signals. The website does not allow third parties to collect personal information about you across other sites over time. In the app, if you allow ad measurement, AppsFlyer collects device identifiers, your IP address and when the app is installed and opened, over time, and passes installs and app opens to Meta (section 3.11).

9.2 Canada (PIPEDA)

We collect, use and disclose personal information with your knowledge and consent, except where the law permits otherwise. You can withdraw consent, subject to legal or contractual limits, and we will explain the consequences. You can ask for access to your information and challenge its accuracy. If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

9.3 Quebec (Law 25)

If you live in Quebec, the same rights apply, and:

• Person in charge of the protection of personal information. Ido Zeev Berger, Chief Executive Officer, KitchensGuardian, Inc., 1111B South Governors Avenue, Ste 42756, Dover, DE 19904, USA, ido@kitchensguardian.com.
• Before sending personal information outside Quebec we assess the sensitivity of the information, the purposes it will be used for, the protections it will receive and the legal framework of the destination country, and we keep a written record of that assessment. Section 14 says where your information goes.
• You can ask us to stop distributing your personal information, or to de-index a link to it, where the law allows.
• If you are unhappy with our response, you can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

10. Account deletion: what goes and what stays

You can delete your account in the app, by opening the side menu and choosing Delete Account, or by going to Profile and choosing Delete Account. Either one opens a confirmation dialog. You can also email support@kitchensguardian.com with the subject “Delete my account” (see our Account Deletion page).

When you delete your account, we delete the following account data, subject to the exceptions below:

• your user record: email, name, password hash, profile photo, verification codes, subscription status, account settings
• your kitchen memberships
• your pantry, scan history, receipt records and scan corrections, where the kitchen has no other members
• your favourite recipes, meal plans you created and your grocery lists
• invitations you received and invitations you sent, including your name on them
• item add requests you made or reviewed
• your push notification token and device registration
• your sign-in sessions (all tokens are revoked)
• receipt text from a first scan before you pay that is still in our temporary store (section 3.2). If that store can’t be reached at that moment, the text still expires within an hour.
• your subscriber record at RevenueCat, including the billing identifier for your account
• your user document in Firebase Firestore (display name, push token) and the records stored under it
• the app’s local data on your phone, including cached photos, account preferences and the local setup-screen markers, except your answers to the ad-measurement and Google app-analytics questions, which belong to the phone (sections 3.11 and 3.12). Signing out also preserves these choices and the setup-screen markers; account deletion clears the setup-screen markers.

Kitchens you host: if other members remain, the kitchen becomes read-only for them. A remaining member who has their own active subscription, and does not already own a kitchen, can take ownership in the app, which reopens it. If you are the only member, the kitchen and everything in it (items, pantries, setup sessions, consumption data, recipes) is deleted.

What stays after deletion:

• Data belonging to a kitchen that still has other members: pantry items, receipt records, recipes, meal plans and consumption data stay with that kitchen, under the control of its remaining members. You are removed from the member list, and the items you added are no longer marked as added by you.
• Anonymous shared data (section 7.2). It contains nothing that identifies you, so there is nothing to delete.
• Server logs for up to 30 days. Logs contain your IP address but not your email, name or tokens.
• Database backups for up to 7 days. Deleted data disappears from backups when they expire, and we never restore it to the live service.
• Records we must keep by law, for example tax and accounting records of a purchase.
• If Apple has told us that you stopped using Sign in with Apple with our app or deleted your Apple account: a one-way hash of Apple’s identifier for you, with the date and kind of that notice, so that an old Apple sign-in cannot be used again. It is not linked to any account.

Cached scan results in our temporary store expire on their own within 30 days and are no longer linked to any account once yours is deleted.

Deleting your account does not cancel a subscription. Cancel it in the App Store or Google Play first; see our Subscription Terms.

Google may retain app analytics it received before deletion under the retention settings in section 11. Deleting your KitchensGuardian account does not automatically submit a deletion request for that analytics data. The app currently offers no individual control for deleting earlier analytics from Google’s servers. We do not attach your KitchensGuardian account identifier or email to these events. Contact support@kitchensguardian.com about an analytics privacy request. We assess requests based on our ability to identify the relevant records and the deletion tools Google makes available. We cannot promise to match those records by email alone or erase them automatically. Turning off Google app analytics stops future collection and resets local analytics data, but does not delete earlier events from Google’s servers.

11. How long we keep data

12. Analytics, tracking and cookies

In the app

• Ads. The app shows no ads. From version 1.1.5, if you allow it, the AppsFlyer SDK reads your device’s advertising identifier to measure our own ads (section 3.11).
• iOS tracking. From version 1.1.5, the app asks for your permission to track with Apple’s App Tracking Transparency prompt. If you allow it, AppsFlyer uses the IDFA only to measure our ads (section 3.11). If you don’t, AppsFlyer does not run at all. You can change your answer in Settings, then Privacy & Security, then Tracking.
• App analytics. From version 1.1.6, in app versions that offer the choice, Google Analytics for Firebase is optional and starts off. If you separately allow Google app analytics, Google receives the app-instance, device/network and app-use information described in section 3.12, including our limited setup-screen and completion events and supported automatic SDK events. This choice does not permit Google advertising or ad personalization. Turn it off in Ad settings or Profile, under System. Data already received is handled as described in sections 10 and 11. We do not use the Meta SDK in the app. If you separately allow ad measurement, AppsFlyer records installs and app opens and no other events (section 3.11).
• Crash reporting. Firebase Crashlytics, as described in section 3.7.
• Subscription management. The RevenueCat SDK, as described in section 3.8.
• Photo scanner on Android. Google’s ML Kit document scanner, as described in section 6.
• Cookies and local storage. The app does not use web cookies. It stores a sign-in token and preferences on your device so you stay signed in. It also keeps your Google app-analytics choice and a short local list of fixed setup-screen markers, without your answers or account identifier. The list prevents duplicate events when you go back, reopen the app or sign in as another account. Screens seen while analytics is off are remembered locally and are not uploaded later if you opt in. Signing out preserves the list; account deletion clears it.

On kitchensguardian.com

• The website uses Google Analytics 4 to count visits and see which pages and links people use. It sets identifiers in your browser and tells us things like which pages you viewed, which buttons you clicked, roughly where you are (at city level, from your IP address) and what kind of device you used. We do not use it to target ads, and we do not combine it with your account.
• You can refuse it. Use your browser’s tracking protection, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout. Blocking it does not change how the website works.
• The website is a separate thing from the app. Nothing Google Analytics collects on the website is sent to the app or added to your account.

13. Children

KitchensGuardian is not directed at children. You must be at least 16 years old to use it. We ask your age when you create an account and we do not allow accounts for anyone under 16. We do not knowingly collect personal information from anyone under 16, and we do not knowingly collect personal information from children under 13 at all. If you believe a child has created an account, email support@kitchensguardian.com and we will delete it.

14. Where your information goes

Our servers are hosted by Railway in the United States. OpenAI and RevenueCat process data in the United States. Google services, AppsFlyer and Meta may process data in the United States and elsewhere. If you use the app from Canada, your information is transferred to and processed in the United States.

For Canadian users, your information may be subject to the laws of the United States, including access by US authorities under lawful process. Our agreements with each of these providers require them to protect your information and to use it only to provide the service to us. If you live in Quebec, section 9.3 explains the assessment we carry out before information leaves the province.

15. Security

We work to protect your information:

• All traffic between the app and our servers uses TLS encryption.
• Passwords are hashed with bcrypt. We never store your password in readable form.
• Access to production systems is limited to the founder and to contracted developers who are bound by confidentiality agreements. Access is removed when an engagement ends.
• Receipt and fridge photos are held only while the scan runs and are deleted automatically afterwards.
• Sign-in tokens expire and are revoked when you sign out or delete your account.
• Server logs never contain email addresses, verification codes, receipt text or tokens.
• Rate limits protect sign-in, code and scanning endpoints from abuse.

No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that creates a real risk of serious harm, we will notify you and the relevant authorities as the law requires, including the Office of the Privacy Commissioner of Canada and the Commission d’accès à l’information du Québec where that applies. To report a security issue, email support@kitchensguardian.com with “Security” in the subject.

16. Changes to this policy

We may update this policy as the app changes. We will post the new version in the app and on our website with a new “Last updated” date. For significant changes, we will notify you in the app or by email before they take effect. Continued use after the effective date means the new policy applies.

17. Contact

KitchensGuardian, Inc.
Email: support@kitchensguardian.com
Postal address: 1111B South Governors Avenue, Ste 42756, Dover, DE 19904, USA

Person in charge of the protection of personal information (Quebec, Law 25): Ido Zeev Berger, Chief Executive Officer, at the postal address above, ido@kitchensguardian.com.

For privacy requests, put “Privacy request” in the subject and write from the email address on your account.