Privacy Policy

Last updated on:

Effective date: 19 August 2026

1. Who is responsible for your data

This Privacy Policy describes how Pantry processes personal data through the Pantry website, mobile application, API, support and waitlist flows, and related services (together, the Service).

Pantry is operated by Leif Arriens, Wetternstr. 30, 21720 Steinkirchen, Germany. Leif Arriens is responsible for processing personal data described in this policy. For privacy questions or requests, contact contact@pantryapp.net. Our postal and legal contact details are also available in the Legal Notice.

This policy applies to processing for which Pantry is responsible. A household member, employer, app-store provider, identity provider, hosting provider, or other third party may have separate responsibilities and privacy terms for its own processing.

2. The data the Service handles

The data we process depends on the features you use.

The website is a localized site served through Pantry’s AWS infrastructure and CloudFront. A necessary cookie or similar browser storage records your website cookie-consent choice. The website loads PostHog analytics according to the configured consent flow, with analytics disabled by default.

If you submit the waitlist form, Pantry receives the email address you provide to manage the waitlist. We do not currently send automated waitlist messages, but we may email you when the product launches. The form sends a waitlist-signup event containing your email address and, where available, a PostHog distinct ID, to Pantry’s waitlist endpoint. The endpoint forwards this event to PostHog’s EU endpoint to record the waitlist signup. This waitlist processing is separate from the optional product analytics described below. Pantry retains waitlist signup events, including the submitted email address, until the product launches. To unsubscribe from the waitlist or request deletion of your waitlist information, email contact@pantryapp.net.

Website and CDN operators may process technical request data such as an IP address, browser or device information, requested URL, language, and timestamps. This information is used to deliver, secure, troubleshoot, and improve the website.

2.2 Accounts and authentication

The app supports email one-time-code sign-in, Apple sign-in, and anonymous or headless account flows. Depending on the flow, Pantry processes:

  • an internal user ID;
  • email address and email-verification status;
  • Apple account identifier and claims supplied by Apple;
  • name, if you provide one;
  • app language, recipe language, and timezone;
  • one-time-code verification records; and
  • account, sign-in, session, and security records.

Refresh-token records include a hash of the token, creation, expiry, revocation and last-use timestamps, replacement information, and, where supplied by the request, IP address and user-agent information. The raw refresh token is not stored by the token repository. On the device, the app stores access and refresh tokens in the platform’s secure storage. It also uses local app storage for selected pantry state, sort preferences, local settings, and time-limited cache entries. Abandoned headless users are scheduled for deletion after 30 days if they have not been linked to a registered account.

2.3 Pantry, household, and recipe data

When you use the app, Pantry stores the data you enter or create, including:

  • pantry name, owner, timezone, members, roles, invitations, and access records;
  • food-item name, barcode, quantity or fill level, icon, expiry date, and image URL;
  • recipes, ingredients, quantities, preparation steps, servings, meal type, language, and links to a pantry;
  • diet preferences and recipe-generation settings; and
  • notification subscriptions and related delivery state.

A shared pantry is visible to the users who have been invited or granted access. Pantry does not offer a public-pantry or public-profile feature. We will update this policy if that changes.

2.4 Product lookup and external images

When you scan or submit a barcode, the API sends the barcode and selected language to Pantry’s product-lookup service. The service uses an ingested Open Food Facts product database and may return product name, categories, labels, quantity, serving-size and an Open Food Facts image URL. The barcode lookup service is operated as part of Pantry’s infrastructure. The public Open Food Facts data has its own terms and notices.

The app can display an image URL returned with product data. Pantry does not provide a general-purpose user file-upload feature for this purpose, and the imageUrl field refers to an external product image URL.

2.5 Image recognition and AI-assisted features

If you use image-based item recognition, the app sends a base64-encoded camera image to the authenticated API. The API sends the camera image, the requested language, and instructions directly to OpenAI to identify food products and suggest names, icons, and estimated expiry dates. The original image is not stored in the Pantry database through this feature.

If you generate or refine a recipe, the API sends the relevant pantry-item metadata, selected dietary and recipe settings, and any additional instruction or base recipe to OpenAI. AI providers process data under their applicable service terms and contractual privacy safeguards.

AI results are suggestions. Do not submit sensitive personal data, another person’s image, or confidential information unless you have a lawful basis and it is necessary for the requested feature.

2.6 Notifications, email, subscriptions, and purchases

If you enable notifications, Pantry stores Expo push tokens, the relationship between a token and your user account, pantry-notification subscriptions, and token delivery or invalidation events. Push messages are sent through Expo’s push service and platform notification infrastructure.

Email one-time codes and welcome messages are delivered through Amazon SES using Pantry’s email queue and transactional email service.

If you use paid features, including a weekly or monthly Pantry Pro subscription in the iOS app, the app and API process a membership or entitlement plan, expiry state, purchase and subscription synchronization events, and identifiers needed to validate the entitlement. Purchases are made through the Apple App Store and Pantry uses RevenueCat for purchase and entitlement synchronization. Apple and RevenueCat may process additional data under their own terms.

2.7 Logs, security, and product analytics

The API assigns request and trace IDs and logs request method, path, duration, status, errors, and operational events. Security and rate-limiting code can use IP addresses, authenticated user IDs, request paths, timestamps, and refresh-token user-agent data. Production infrastructure sends service logs to Amazon CloudWatch Logs. CloudWatch production logs are currently retained for three months. Other logs, database backups, CDN logs, and provider logs are retained as needed for security, operations, legal obligations, and service recovery.

Optional product analytics is provided through PostHog’s EU endpoint:

  • on the website, the cookie-consent interface controls the analytics category and PostHog is configured to opt out by default;
  • in the mobile app, analytics is disabled by default, consent is stored with the user preference, and the choice can be changed in Settings; and
  • app events can describe onboarding, scans, barcode lookup failures, recipe generation and refinement, paywall and purchase events, and feature usage. The app’s PostHog client disables GeoIP and uses identified-only person profiles. The API also checks stored analytics consent before sending authenticated events.

We do not use analytics data to sell personal data or to serve advertising based on pantry content.

Pantry uses personal data to:

  • create and secure accounts, authenticate users, and maintain sessions;
  • provide pantry management, household sharing, recipe storage, product lookup, notifications, and requested AI-assisted features;
  • remember language, timezone, dietary, notification, and analytics preferences;
  • process app-store purchases and maintain subscription entitlements;
  • send one-time codes, welcome messages, service notices, and security communications;
  • operate, troubleshoot, rate-limit, prevent fraud and abuse, and protect the Service;
  • measure product use where analytics consent has been given and improve the Service;
  • respond to support, privacy, and rights requests;
  • comply with legal obligations, establish or defend claims, and enforce the Terms and Conditions; and
  • operate the waitlist if you submit your email address.

Depending on the context and applicable law, processing is based on performing a contract with you, our legitimate interests in operating and securing the Service, your consent, compliance with legal obligations, or another lawful basis. Where processing relies on consent, you may withdraw consent at any time for future processing. Withdrawal does not affect processing completed before withdrawal. The app analytics choice can be changed in Settings. Website analytics choices can be changed through Cookie Preferences in the footer.

4. Recipients and service providers

Pantry does not sell personal data. Depending on the feature, data may be disclosed to:

  • Amazon Web Services for hosting, PostgreSQL database, Redis or Valkey caching, queues, logs, email delivery, and related infrastructure;
  • PostHog for consent-controlled product analytics and for recording waitlist-signup events containing the submitted email address;
  • OpenAI for recipe generation and image-based product recognition, including processing camera images as described above;
  • Expo and Apple notification infrastructure for push delivery;
  • Amazon SES for transactional email delivery;
  • RevenueCat and Apple for in-app purchase and entitlement processing;
  • Pantry’s product-lookup service and the Open Food Facts data source for barcode lookups; and
  • courts, regulators, law-enforcement authorities, professional advisers, or other recipients where disclosure is required by law or reasonably necessary to protect people, rights, or the Service.

These providers process data only as needed for the relevant service, under applicable agreements and privacy safeguards.

5. International transfers

Pantry’s core AWS infrastructure is hosted in Frankfurt, Germany, in the eu-central-1 region. Pantry and its service providers may nevertheless process or access personal data in countries outside your country of residence. Where required, Pantry uses a lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, or another approved safeguard, and applies appropriate supplementary measures.

6. Retention and deletion

Pantry keeps data only for as long as needed for the relevant purpose, legal obligations, security, dispute handling, and backup recovery. Account and service data is deleted or anonymized when it is no longer needed, subject to legal holds, technical copies, backups, and records that must be retained by law.

You can request account deletion in the app. The account deletion service deletes the user, associated pantries and pantry data, recipes, memberships, tokens, and related records handled by that service. Abandoned headless accounts are scheduled for deletion after 30 days. Refresh tokens are deleted when expired or revoked by a scheduled cleanup job. Verification tokens, expired invites, and invalid push tokens also have cleanup jobs. Redis entries such as rate-limit and cached consent data are temporary and expire according to configured cache behavior.

Deletion requests are sent to relevant service providers where required and handled according to their applicable retention and deletion processes. Backups and records retained for legal, security, dispute, or fraud-prevention reasons may persist for the period necessary for those purposes and are protected from routine use.

7. Your rights and how to contact us

Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing; receive a portable copy of certain data; withdraw consent; and complain to a data-protection supervisory authority. You may also have rights concerning automated decision-making and profiling where applicable.

To exercise a right, email contact@pantryapp.net and include enough information for us to verify and handle the request. We may ask for information needed to verify your identity and protect your account. Account deletion is available in the app. We will handle data-access and export requests in accordance with applicable law.

8. Children

The Service is intended for people who can lawfully use it under the law that applies to them. If you are under the age at which you can consent to processing or enter into an agreement in your country, use the Service only with the involvement and permission of a parent or legal guardian where required. If you believe that a child has provided personal data improperly, contact contact@pantryapp.net so that we can review and take appropriate action.

9. Automated decisions and food safety

Pantry’s AI features generate suggestions. They are not intended to make decisions that produce legal or similarly significant effects. Pantry does not guarantee that an AI suggestion, expiry estimate, product record, or recipe is complete, accurate, allergen-safe, or suitable for a particular person. Review outputs and use independent food-safety judgment.

10. Security

Pantry uses technical and organizational measures intended to protect personal data, including HTTPS/TLS, encrypted database storage, access controls, JWT session validation, hashed refresh tokens, role-based pantry access, rate limiting, secure response headers, and operational logging. No service can be guaranteed completely secure. If we become aware of a personal-data breach that requires notice, we will notify affected people and authorities as required by applicable law.

11. Changes to this policy

We may update this policy when the Service, providers, or legal requirements change. We will update the effective date and provide additional notice when required by law. The German and English versions are intended to have the same meaning. If the versions differ, the interpretation required by applicable mandatory law applies.

12. Contact

Privacy and data requests: contact@pantryapp.net

User support requests: support@pantryapp.net

Responsible operator and postal contact:\n\nLeif Arriens\n\nWetternstr. 30\n\n21720 Steinkirchen\n\nGermany