Privacy Policy

We collect only the information needed to run the app. The table below lists every category:

We do not collect your name, phone number, address, payment details, location, device identifiers, or biometric data. We do not run behavioural tracking or advertising pixels.

The Smart Pantry mobile app requests only the permissions it needs. Below is every permission the app may request and exactly why:

Permissions the app never requests:

• Microphone
• Photo library
• Location / GPS
• Contacts
• Push notifications
• Health & fitness data
• Bluetooth
• Face ID / Touch ID / biometrics
• Background app refresh

All account and application data is stored in a MongoDB database. Depending on deployment configuration this may be a MongoDB Atlas cluster hosted on AWS or Google Cloud infrastructure in the EU or UK. Data is protected by:

• Passwords stored as bcrypt hashes (cost factor ≥ 10) — the original password cannot be recovered even by us.
• Session tokens are signed JWTs stored in httpOnly, SameSite=Lax cookies on web — inaccessible to JavaScript and not sent cross-site.
• On mobile, session tokens are stored in iOS Keychain or Android Keystore — hardware-backed secure storage inaccessible to other apps.
• All traffic is served over HTTPS / TLS. Plain HTTP is not accepted.
• Database credentials are stored as server-side environment variables and are never exposed to the client or logged.
• Access to production data is restricted to authorised personnel only.

We take reasonable technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 UK GDPR.

Under UK GDPR, every purpose for processing personal data must have a lawful basis. Below are our purposes and the corresponding lawful basis for each:

We do not rely on consent as the basis for any processing (other than the device permissions listed in Section 2 which are handled by your operating system). You can withdraw your data entirely by deleting your account (see Section 7).

We do not use your data for marketing, profiling, or selling to third parties.

We retain personal data for as long as your account is active. Specifically:

There are no separate retention periods for sub-categories of data. Everything tied to your account is removed in a single irreversible operation when you delete your account (see Section 7).

Smart Pantry uses a small number of infrastructure services. None of them receive your pantry, meal plan, or shopping data. The full list:

We do not use Firebase, Supabase, Stripe, Google Analytics, Meta Pixel, Mixpanel, Amplitude, Segment, or any other analytics or advertising platform.

You can permanently delete your account and all associated data at any time. There are two ways:

Option A — self-serve (instant):

1. Sign in and go to Profile.
2. Scroll to the Account section.
3. Tap Delete account and confirm.

Option B — by email (within 30 days):

If you cannot access the app, email us at smartpantryhelp@outlook.com and we will delete your account manually within 30 days.

Deletion removes all of the following from our database immediately and irreversibly: your user record, profile, pantry items, meal plans, shopping list data, shopping history, cooked meal logs, and any custom recipes. Anonymous aggregated data (recipe pattern hashes) that cannot be linked back to you is retained separately.

There is no grace period or recovery option. Once deleted, your data cannot be restored.

In compliance with Apple App Store Review Guideline 5.1.1(v) and Google Play Data Safety requirements, account deletion is available directly within the app and removes all associated personal data. This also satisfies the UK GDPR right to erasure (Article 17) and EU GDPR equivalent.

Web app

Smart Pantry uses a single authentication cookie (sp_session) to keep you signed in. This cookie:

• Contains a signed JWT — no personal data is embedded in the token itself.
• Is marked httpOnly and SameSite=Lax — JavaScript cannot read it.
• Expires after 24 hours.

A second cookie (theme_pref) stores your light/dark theme preference. It contains no personal data.

The web app uses a service worker to cache pages and API responses locally for offline access. Cached data mirrors what is already on the server and is cleared when the cache version changes or when you clear site data in your browser.

We set no advertising, analytics, or tracking cookies. No third-party scripts load cookies on smartpantry.website.

Mobile app

• Session token — stored in iOS Keychain or Android Keystore via expo-secure-store. Hardware-backed; no other app can access it.
• Offline cache — non-sensitive UI state (pantry, meal plan, shopping list) may be cached in AsyncStorage to support offline browsing. This data mirrors what is already on the server and is cleared on sign-out.
• Preferences — theme choice, font size, and tutorial completion status are stored in AsyncStorage. These contain no personal data.

Smart Pantry is not directed at children under the age of 13 and we do not knowingly collect personal data from anyone under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at smartpantryhelp@outlook.com and we will delete that data promptly.

Users between 13 and 17 should use the app only with the knowledge and consent of a parent or guardian.

Under UK GDPR (and equivalent EU GDPR) you have the following rights. Most can be exercised directly in the app:

To exercise any of these rights, contact us at smartpantryhelp@outlook.com. We will respond within 30 calendar days and will not charge a fee for reasonable requests. We may ask for proof of identity before fulfilling a request.

If you believe we have not handled your personal data in accordance with applicable data-protection law, you have the right to lodge a complaint with the relevant supervisory authority:

We would appreciate the opportunity to address your concern directly before you contact the supervisory authority. Please email us first at smartpantryhelp@outlook.com and we will respond within 30 days.

Smart Pantry is the data controller for the personal data described in this policy. If you have any questions about this policy or how your data is handled, please contact us:

We aim to respond to all data-related requests within 30 days. For complex requests involving multiple rights or large volumes of data, we may extend this by a further two months — if so, we will notify you within the initial 30-day period and explain the reason for the extension.

We may update this policy from time to time as the service evolves or legal requirements change. The effective date at the top of this page reflects the most recent revision. Where changes are material, we will notify you by email (if we have one for your account) or by displaying a notice in the app. Continued use of the app after notification of a change constitutes acceptance of the revised policy.