Draft, not yet in effect. This policy is awaiting legal review and will take effect when Shelfsmith is released.

Privacy Policy

Last updated October 13, 2026

The short version.

We collect what the app needs to work: your account, your household's pantry and shopping list, and your preferences.
We never sell your information, show you ads, or track you across other apps and websites.
Receipt photos are sent to Anthropic's AI to read the items, only after you allow it, and we delete each photo as soon as it has been read.
Diets and allergies are stored only with your separate permission, and are erased if you withdraw it.
You can delete your account, and your data with it, from inside the app at any time.

Who we are

Shelfsmith is operated by Rhett Lindell ("we", "us"), who is responsible for your personal information as its controller. Contact us about anything in this policy at lindellrhett@gmail.com.

What we collect and why

Information	Why we use it
Account details: your email address, a password (stored only as a secure hash, never readable by us), and the display name you choose.	To create your account, sign you in, send account emails such as confirmation and password reset links, and show your name to the people in your household.
Household information: the household's name, its invite code, who belongs to it, and who owns it.	To let the people you share a kitchen with see the same pantry and shopping list.
Pantry, shopping list and cooking history: the ingredients you add, quantities, dates, which member added them, the recipes you mark as cooked, and your favourite recipes.	To show which recipes you can make, keep the household's lists in sync, and rank recipes you have not made recently. Pantry items, shopping lists and cooking history are visible to everyone in your household. Favourites are private to you. To order recipes by popularity, we also count how many people have saved each recipe and how many households have cooked it, combined across all users. Only the combined totals are used, never who saved or cooked what, and they are not used until enough people use the app that no one person can be picked out.
Preferences: recipes you would rather not see, and a maximum cooking time.	To filter and rank recipes for you. Private to you.
Diets and allergies, only if you allow it: the diets you follow and ingredients you never want to see.	To hide recipes that do not suit you. This can reveal health information, so it is covered by a separate permission and our Consumer Health Data Privacy Policy. Private to you, never shown to your household.
Receipt photos, only if you allow it, and the items read from them.	To add your groceries to the pantry without typing. See Receipt scanning below.
Your privacy choices: when you gave or withdrew each permission.	To respect your choices and show that we did.
Subscription status, if you subscribe: which plan you are on, when it renews or ends, and an anonymous App Store purchase identifier.	To unlock subscriber features for you and your household. Apple takes payment. We never receive your card or bank details.
Notification token, only if you turn on reminders.	To send the reminders you asked for, such as food that is about to expire.
Technical information: IP address, device and app version, and records of requests to our servers.	To run the service securely, prevent abuse, and fix faults. Kept by our hosting provider for a short period.

We collect this information from you, from the other members of your household (who can add items and see shared lists), and from Apple when you subscribe. We do not buy information about you from anyone.

Receipt scanning

Receipt scanning is optional and asks for your permission before it is first used.

When you scan a receipt, the photo is uploaded to our servers and sent to Anthropic, the company that makes the Claude AI, which reads the items and returns them to us.
Receipts can show more than groceries: the store and its location, the time of purchase, and sometimes part of a payment card number or a loyalty programme name. Please bear this in mind when choosing to scan.
Anthropic processes the photo on our behalf under its commercial terms, which do not permit it to use the photo to train its AI models.
We delete the photo from our servers as soon as it has been read, whether or not reading succeeded. If an upload is interrupted before the photo is read, the photo is deleted automatically the next time anyone in your household scans a receipt, or when your household is deleted.
We keep the list of items read from a receipt for up to 90 days so that you can finish reviewing it. Like the pantry, it is visible to your household. Nothing is added to your pantry until someone confirms it.
You can withdraw permission at any time in the app under Settings, then Privacy. Adding items by hand works without it.

Who we share it with

We do not sell your personal information, share it for targeted advertising, or allow anyone to track you. We share it only as follows.

Your household. Members of a household you belong to see its pantry, shopping list, cooking history, member names and roles.
Service providers who process information on our behalf, under contracts that limit them to providing their service to us and require them to protect it:
- Supabase: database, sign-in, file storage and server functions, and delivery of account emails.
- Anthropic: reading receipt photos, only when you use receipt scanning.
- RevenueCat: managing subscriptions, if you subscribe.
- Apple: App Store purchases, and delivery of notifications if you turn on reminders.
- Expo: routing notifications to Apple, if you turn on reminders.
Legal reasons. If required by law, or where necessary to protect the rights, safety or property of our users, the public or us.
Business transfer. If the app is sold or transferred, your information may pass to the new operator, who must continue to protect it as this policy describes. We will tell you before that happens.

How long we keep it

Receipt photos: deleted as soon as they have been read, as described above.
Items read from a receipt: up to 90 days.
Diets and allergies: until you withdraw permission or delete your account.
Your account, preferences and favourites: until you delete your account.
Shared household data: pantry items, list entries and cooking history stay with the household while it has members, because the other members rely on them. If you leave or delete your account, anything you added stays with the household but is no longer linked to you. A household is deleted, with all of its data, when its last member leaves.
Backups and logs: our hosting provider keeps backups and server logs for a limited period, after which deleted information is overwritten. This is normally no longer than 30 days.

Your choices and rights

Wherever you live, you can:

See and correct most of your information directly in the app.
Delete your account in the app under Settings, then Privacy, then Delete account. This permanently deletes your account and personal information, as described above.
Withdraw permission for receipt scanning or for storing diets and allergies, in Settings, at any time. Withdrawing does not affect anything done before.
Ask for a copy of your information, or ask us any question about it, by emailing us.

Depending on where you live, you may have further rights, including to object to or restrict how we use your information, to have it transferred to you in a portable format, and to complain to a regulator. We respond within the time the law allows, normally 30 days, and may need to confirm your identity first. We will not treat you differently for exercising your rights.

United Kingdom

Under UK data protection law, we rely on these legal bases:

Contract, to provide the app you signed up for.
Consent, for receipt scanning.
Explicit consent, for diets and allergies, which are special category health data.
Legitimate interests, in keeping the service secure and preventing abuse.
Legal obligation, where the law requires us to keep or disclose information.

You can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put things right first.

Canada

You may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or in Quebec, the Commission d'accès à l'information. The person responsible for protecting personal information at Shelfsmith is Rhett Lindell, reachable at the email address above.

Australia

You may complain to the Office of the Australian Information Commissioner at oaic.gov.au if you are not satisfied with our response.

United States

Residents of California and other states with consumer privacy laws have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale, sharing for targeted advertising, or profiling. We do not sell or share personal information for targeted advertising, and we do not profile you in ways that produce legal or similarly significant effects. If we decline a request, you may appeal by replying to our decision, and we will respond within 60 days. If your appeal is denied, you may contact your state attorney general. Residents of Washington, Nevada and similar states should also read our Consumer Health Data Privacy Policy.

Where your information is processed

Shelfsmith is operated from the United States, and our service providers process information in the United States and other countries. If you live in the United Kingdom, Canada or Australia, your information will be transferred to and stored in the United States, where privacy laws may differ from yours. Where the law requires it, we protect these transfers with recognised safeguards, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.

Security

Information is encrypted in transit and at rest, access is restricted so that each household can reach only its own data, and passwords are stored only as secure hashes. No system is perfectly secure, so we cannot guarantee absolute security, but we will notify you and the relevant regulators of a breach where the law requires.

Children

Shelfsmith is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we will delete it.

Changes to this policy

If we make material changes, we will tell you in the app or by email before they take effect, and update the date at the top. Where a change needs your consent, we will ask for it.

Contact

Rhett Lindell, lindellrhett@gmail.com