1. Who We Are
StillFresh ("we," "us," or "our") is the operator of the StillFresh mobile app (bundle ID: com.vivek-0217.stillfresh), available on the Apple App Store and Google Play Store.
If you have any questions about this policy, email us at [email protected].
2. What We Collect
2a. Information You Give Us
- Account information — your email address (and optionally a display name) when you create an account.
- Authentication tokens — if you sign in with Apple or Google, we receive a token that confirms your identity. We do not receive your Apple ID or Google password.
- Pantry items — food names, quantities, purchase dates, best-before dates, storage notes, and any photos you upload.
- Freshness answers — your responses to "Still Fresh?" check-in questions (e.g., "Does it smell OK?").
2b. Information We Generate Automatically
- Device data — device type and operating system, needed to route Apple vs. Android in-app purchases correctly.
- Usage data — how often you generate recipes (stored locally on your device in AsyncStorage so we can enforce the weekly free limit). We do not send this counter to our servers.
- Push notification identifiers — so we can send you expiry reminders. You can disable these in your device settings at any time.
2c. Photos & Camera
When you use the "Scan Receipt / Photo" feature, your image is sent over an encrypted connection to our Supabase Edge Function for AI analysis. The image is processed to identify grocery items and is not permanently stored on our servers. A URL reference to the image may be stored in your pantry item record if you choose to attach it, and it is accessible only to your account.
2d. What We Do NOT Collect
- We do not collect your full name unless you choose to set a display name.
- We do not collect your location.
- We do not collect financial or payment information (this is handled entirely by Apple or Google).
- We do not use advertising SDKs or sell your data to advertisers.
3. How We Use Your Data
We use your data only for these purposes:
- To create and maintain your account.
- To store and sync your pantry items across your devices.
- To run AI image analysis and generate recipe suggestions on your behalf (via our server-side edge functions).
- To send push notifications reminding you of upcoming expiry dates (only if you grant notification permission).
- To verify your subscription status through RevenueCat.
- To improve the app and fix bugs (we may review anonymised error logs).
🔑 API keys for Gemini and OpenAI are stored as server-side secrets and are never bundled into the app. Your data is sent to AI providers only through our secure Supabase edge functions, not directly from your device.
4. Third-Party Services
StillFresh uses the following third-party services. Each has its own privacy policy.
Supabase
We use Supabase as our backend — for authentication, database storage (your pantry items), and edge functions (AI processing). Your data is stored in Supabase's cloud infrastructure. See: supabase.com/privacy
RevenueCat
We use RevenueCat to manage in-app subscriptions. RevenueCat receives a pseudonymous user ID (your Supabase user ID) to track your entitlements. It does not receive your email address or any payment card details. See: revenuecat.com/privacy
Apple (iOS only)
If you use Sign in with Apple or purchase a StillFresh Pro subscription on iOS, Apple processes your authentication and payment under Apple's privacy policy. We do not receive your real email address if you choose "Hide My Email." See: apple.com/legal/privacy
Google (Android only)
If you use Sign in with Google or purchase on Android via Google Play, Google processes your authentication and payment. See: policies.google.com/privacy
AI Providers (Gemini / OpenAI)
When you scan a receipt or photo, or request recipe suggestions, the image or pantry item list is sent to an AI model (either Google Gemini or OpenAI, configured server-side). This data is processed under the provider's API terms. We do not send any personally identifying information alongside images — only the image content itself.
Expo / React Native Infrastructure
The app is built with Expo. When using the Expo push notification service, your device push token is shared with Expo to route notifications. See: expo.dev/privacy
⚠️ We do not use Firebase, Google Analytics, Meta/Facebook SDK, or any third-party advertising or analytics SDK.
5. In-App Purchases & Subscriptions
StillFresh offers a StillFresh Pro subscription with two plans (monthly and yearly). Purchases are processed entirely by Apple (on iOS) or Google (on Android) — we never handle your payment information directly.
Auto-Renewal Disclosure
Subscriptions automatically renew at the end of each billing period (monthly or yearly) unless you cancel at least 24 hours before the renewal date. Your account will be charged within 24 hours prior to the end of the current period.
RevenueCat's Role
Our subscription infrastructure is powered by RevenueCat. RevenueCat receives your anonymised user ID and purchase receipt to verify your entitlements. It operates as a data processor on our behalf and does not use this data for advertising.
How to Cancel
- iOS: Open Settings → [your name] → Subscriptions → StillFresh → Cancel Subscription.
- Android: Open the Google Play Store → tap your profile icon → Payments & subscriptions → Subscriptions → StillFresh → Cancel.
Cancellation takes effect at the end of the current billing period. You retain Pro access until then.
6. Data Retention
We keep your account data and pantry items for as long as your account is active. If you delete your account, we will delete your personal data from our servers within 30 days, except where we are required by law to retain it longer (e.g., for tax or fraud-prevention purposes).
To request account deletion, email [email protected] with the subject line "Delete My Account."
7. Children's Privacy (COPPA)
StillFresh is not directed to children under the age of 13 (or 16 in the European Union / United Kingdom). We do not knowingly collect personal information from anyone under these ages.
If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected] and we will delete the data promptly.
In compliance with the Children's Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code, we do not collect data for profiling children, use persuasive design features targeting minors, or enable social sharing features accessible to children.
8. Your Rights (GDPR — EU / UK Residents)
If you are in the European Economic Area or United Kingdom, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate data.
- Erasure — ask us to delete your data ("right to be forgotten").
- Portability — receive your data in a machine-readable format.
- Restriction — ask us to limit how we process your data.
- Objection — object to processing based on our legitimate interests.
- Withdraw Consent — if processing is based on consent, withdraw it at any time.
Our legal basis for processing your data is: contract performance (to provide the app features you use), legitimate interest (to improve app stability), and consent (for push notifications).
To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
9. California Residents (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal information we collect, use, and disclose.
- Delete personal information we hold about you.
- Correct inaccurate personal information.
- Opt out of the sale or sharing of your personal information. We do not sell or share your personal information with third parties for advertising purposes.
- Non-discrimination — we will not discriminate against you for exercising these rights.
To submit a request, email [email protected] with the subject line "California Privacy Request."
10. Security
We take reasonable technical measures to protect your data, including:
- All data transmitted between your device and our servers uses TLS encryption.
- Database access is controlled by Row Level Security (RLS) rules in Supabase, so you can only ever read or write your own data.
- API keys for AI providers are stored as server-side secrets and never bundled into the app binary.
- Authentication uses industry-standard JWT tokens managed by Supabase Auth.
No method of transmission over the internet is 100% secure. If you discover a security issue, please report it responsibly to [email protected].
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. If the changes are material, we will notify you via an in-app notice or email.
Continuing to use StillFresh after changes are posted constitutes your acceptance of the updated policy.
12. Contact Us
Questions about this policy? Contact us at:
📧 [email protected]