This policy explains what data the ThatFridge iOS app and its backend service (together, "ThatFridge", "we", "us") collect, why, who we share it with, and the choices you have. ThatFridge is operated by Muhammad Naufal Kamaruddin, an individual developer. Contact: support@thatfridge.com.
1. Data we collect
Account & identity
- Your name, email address and username.
- A hashed password (we never store it in plain text).
- Authentication tokens issued to your devices.
Content you create
- Fridges you own or join — names, storage sections, and any fridge photo you upload.
- Food items — name, quantity, category, expiry / best-before date, storage location, and an optional link to where you buy it.
- Shopping list items.
- Recipes — titles, ingredients, steps, tags, links you import, and any photo or video attachments you add. We work out an estimated calorie count per serving for each recipe from its ingredients, using a built-in nutrition table and, where that cannot cover them, by sending the recipe's name, ingredients and steps to our AI provider (see §4).
- AI-generated icons — the short prompt you type and the resulting image, kept in your icon library.
- Fridge notes, goals, and earned badges.
- Kitchen Lab automations — the sentence you type to describe an automation, the trigger and steps it becomes (which you can edit), and a log of each run and what it did. The sentence is sent to the AI provider to draft the automation (see §4); once saved, it runs on our server without further AI use.
- Meal plans and cooked-recipe logs — what you plan or log for a day: a name, an optional recipe, a meal label you choose (such as “Dinner”), an optional reminder time and note, and whether you cooked it. You can attach an entry to a fridge; when that fridge is owned by a ThatFridge Pro user, the other members of that fridge can see and edit those entries, and your username is shown on the ones you add. Otherwise an entry is visible only to you.
- Fridge sharing — if you invite someone to a fridge or request to join one, we store that request and the members list. People who share a fridge can see its contents, notes and items (and its meal plans, as described above).
- Blocking — if you block another user, we store that block so it can stop future contact between you (search, invites and join requests) in both directions. Blocking someone doesn't affect any fridge membership or content that already existed.
Photos you submit
When you use receipt scanning, fridge-photo scanning, or add a recipe photo, the image is uploaded to our server and sent to an AI vision provider to extract text and item details (see §3). Images are stored on our server so the feature keeps working; you can delete the associated items and recipes in the app.
AI chat & "remembered facts"
- Your chat messages and conversation history with the AI crew.
- Kitchen context sent alongside a message so the AI can answer usefully. This is your current inventory, and — when a question calls for it — your sticky notes, shopping list, saved recipes, remembered facts and usage history. It is sent to the AI provider with the message and is not retained by them.
- Actions the crew takes for you. When you ask, the AI can act in your own account — add or edit an item, tick off the shopping list, leave or remove a note, save a recipe, plan or remove a meal on your meal plan. It only ever changes your own data, and it asks you to confirm before deleting anything.
- Photos and PDFs you attach to a chat message are sent to the AI provider with that message so it can read them. We do not keep a copy on our server.
- Links you share. If you paste a recipe or article link, our server fetches that page, reduces it to plain text, and sends the text to the AI provider so it can read the recipe. We fetch only the address you provided.
- Remembered facts — the AI extracts short notes about your preferences and household (e.g. "prefers vegetarian meals") from conversations and stores them to personalise future replies. You can view and delete every remembered fact in Profile → Settings → Privacy & data.
Usage & diagnostic data
- Usage history — which items you used up or threw away and when. This powers your "Kitchen Score", streaks, weekly score snapshots and organizer tallies. Deletable in the app, including day by day from the in-app calendar.
- Product-analytics events — first-party, no third-party SDK. We record coarse events such as app opens and which onboarding steps you reached, with a random device id and (once you sign in) your account id, so we can see where the sign-up flow loses people and fix it. Small, non-sensitive event properties only; deleted automatically after 180 days.
- Suggestion-improvement data — when you use an app feature, we may record a food type or item name, our icon, food-group, shelf-life or storage guess and the value you kept, whether you accepted or corrected an estimate (including Autofill), scan and barcode outcomes (for a scanned receipt or photo, the name we proposed if you changed it), item-removal outcomes and how long after removing an item you added it again, how you respond to expiry and low-stock alerts and to the tips on Home, which alert types you switch on or off, the filters you pick for recipe suggestions and where in the list the recipe you cooked appeared, how you author Kitchen Lab automations (trigger type, number of steps, whether you edited the draft, ran a dry run or enabled it — never the text you wrote or the step contents), how many days ahead you plan a meal and whether you then cook or skip it (never its name, label or note), how long adding an item took and by which method, and ratings of app answers. These structured records are linked to your account for up to 180 days. They do not contain notes, chat text, photos, receipts, contacts, meal names or the text of Kitchen Lab automations. Statistics combined across users, without account or device IDs, may be kept longer. We only act on patterns seen across multiple users.
- Undo copies — so you can undo removing an item, we keep a copy of it (including any note you added) for about a day; after that only the outcome (used or thrown out) and timing remain, for up to 180 days. Items removed by a Kitchen Lab automation keep their copy for up to 180 days so that run can be undone.
- Server logs — IP address, device/browser user-agent and timestamps, kept for security and debugging.
Purchases & AI credits
AI features are metered in "AI credits". We keep your current credit balance and a log of credit transactions (grants and what each was spent on) tied to your account.
ThatFridge Pro is an auto-renewing subscription, and you can also buy one-off AI-credit packs. Both are sold through the app store you installed from — Apple (iOS) or Google (Android) processes your payment and we never receive your card details. We use RevenueCat to manage entitlements and purchases; RevenueCat receives a pseudonymous app-user ID (your account ID), purchase and receipt data, device/platform information, and your AI-credit balance (mirrored for display), so we can tell whether your Pro access is active and keep your balance in sync.
Notifications
Expiry and low-stock reminders, and any reminder time you set on a planned meal, are scheduled locally on your device. Our server also creates matching in-app notification entries (the item name and fridge) that appear in your Notifications feed; they are deleted automatically after 60–180 days. Separately, activity notifications — invites, fridge membership changes, notes, and item activity from people you share a fridge with — are delivered as push notifications. This requires registering a push token (an identifier tied to your device, issued by Expo's push service) with our server; when a notification fires, we send that token plus the notification's title and body to Expo, which relays it to Apple's push notification service (iOS) or Firebase Cloud Messaging (Android). See §4 for Expo as a data processor.
Android waitlist (website)
If you join the Android waitlist on thatfridge.com, we store your email address, the time you agreed to be contacted, which form you used, and the two-letter country Cloudflare reports for the request. We do not store your IP address. We use this only to send you one email when ThatFridge is available on Android, and we delete the list once that email has gone out. To be removed sooner, email support@thatfridge.com. Joining the waitlist does not create an account.
2. What we do NOT collect
- No advertising identifiers (IDFA), no ad networks, no cross-app or cross-site tracking.
- No location data.
- No third-party analytics SDKs in the current version.
- No access to your contacts or photo library beyond the specific images you choose to add.
- No audio. Voice dictation runs on your device; only the text it produces is put in the message box.
3. How your data is used
- To provide the core service — store your inventory, sync it across your devices and household, and send reminders.
- To generate AI features — recipe suggestions, "what should I eat", chat answers, receipt/photo parsing, and food-icon generation.
- To carry out actions you ask the AI crew to take in your own account (e.g. adding an item, updating your shopping list).
- To calculate your Kitchen Score and progress.
- To improve food suggestions and spot incorrect guesses using structured feedback from the items and features you use. This sharing is on by default. You can turn it off in Profile → Help improve ThatFridge's suggestions and choose Delete my improvement data to remove your linked feedback records.
- To operate purchases — your Pro subscription and AI-credit packs — and meter AI usage against your credit balance.
- To secure the service, prevent abuse, debug problems and meet legal obligations.
- To review AI-generated icons and their prompts so we can curate generic, non-personal ones into a shared icon set offered to all users. A curated icon is stripped of any link to you and shown without attribution.
We do not sell your personal data, and we do not use your content to train our own models.
4. Third parties we share data with
We share the minimum necessary with service providers who process data on our behalf:
| Provider | Purpose | Data shared |
|---|---|---|
| DigitalOcean, LLC (servers in Singapore) | Runs our servers and database | All application data, at rest |
| Cloudflare, Inc. | DNS and hosting for our public website (this page) | Standard web request logs (IP, user-agent); no account content |
| OpenRouter | Routes AI chat / recipe requests to large-language-model providers | Your message text and the kitchen context for that question (inventory, and where relevant your notes, shopping list, recipes, remembered facts, usage history); the text of any link you ask the crew to read; any photo or PDF you attach to a message; the sentence you type to draft a Kitchen Lab automation; what you type into Ask Chef (on the recipe form and the meal plan); the items, fridge contents, recipes, meal plans, shopping list and dates you choose to attach to a chat message; when you use Autofill on an item, its name, weight, calories and other custom-field values, plus a few of your own earlier entries for the empty custom fields being filled; a recipe's name, ingredients and steps when its calories are estimated by the model; when you tap Autofill on the meal plan, the names of items in your fridge (with how soon they expire), your recipe names and the meals already planned for that week |
| Downstream LLM providers (via OpenRouter) | Generate the AI responses | Same as above, per OpenRouter's routing |
| fal.ai | Receipt / fridge-photo vision parsing and food-icon image generation | The image you submitted and short prompts |
| RevenueCat | Subscription and in-app-purchase entitlement management | Account ID, purchase / receipt data, device info, AI-credit balance |
| Resend | Sends transactional email (password-reset codes and similar account emails) and the one-time Android launch email to waitlist sign-ups | Your email address and the email's content |
| Expo (650 Industries, Inc.) | Delivers push notifications | Push token, notification title and body |
| Apple | App distribution, payments, in-app purchases, push delivery (iOS) | Handled under Apple's privacy policy |
| App distribution, payments, in-app purchases (Android) | Handled under Google's privacy policy |
We may also disclose data if required by law, or to protect the rights, safety or property of ThatFridge or its users.
5. Data retention
We keep your data while your account is active. You can delete individual chat sessions, remembered facts and usage history at any time in the app. When you delete your account (see §6) we hard-delete your user record, authentication tokens, chat history, remembered facts, your AI-credit balance and transaction log, and the fridges you own together with their items, notes, sections and shopping lists, and your AI-generated icon library, your Kitchen Lab automations and their run logs, and the meal-plan entries you added (entries you added to someone else's fridge go with your account; entries other people added to a fridge you owned become their personal entries if that fridge is deleted). Suggestion-improvement records that were linked to you are unlinked from your account at that point and then deleted automatically after 180 days. Backups containing residual copies are rotated out within 30 days. Fridges owned by other people that you were merely a member of are not deleted, but your membership is removed. If one of your generated icons was previously curated into the shared icon set, that de-identified copy carries no link to you and remains in the shared set.
6. Your choices and rights
- Delete your account — in the app: Profile → Delete account. This is immediate and permanent.
- Delete some of your data without deleting your account — Profile → Settings → Privacy & data to remove remembered facts, chat history and usage history at any time; individual items, recipes, notes and shopping-list entries can each be deleted from their own screen. To remove the suggestion-improvement records linked to you, use Profile → Settings → Privacy & data → Delete my improvement data (this erases those records and the item names kept with your removal history; the timing and used/thrown-out outcome of each removal remain for up to 180 days). You can also switch improvement sharing off in the same place. See §5 above for what's kept and for how long.
- Access / correct / export your data — email support@thatfridge.com and we will respond within 30 days.
- Depending on where you live (e.g. EEA/UK GDPR, California CCPA/CPRA) you may have additional rights to object to or restrict processing, or to lodge a complaint with your data-protection authority. Our legal bases for processing are performance of our contract with you, your consent (for optional AI features), and our legitimate interests in securing and improving the service.
7. Security
Passwords are hashed with bcrypt. Traffic between the app and our servers uses HTTPS. Access to production systems is restricted. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Children
ThatFridge is rated 9+ and is intended for a general audience managing a household. It is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
9. International transfers
Our servers are located in Singapore. Our AI providers (OpenRouter and the models it routes to, and fal.ai) process data in other countries, including the United States. These transfers rely on your consent, which we ask for at sign-up (a dedicated checkbox, or the notice shown before Apple / Google sign-in), and, where a provider offers them, on standard contractual clauses. Some AI features will not work without this consent; you can withdraw it by deleting your account.
10. Region-specific information
South Korea (PIPA)
When you sign up in Korea we ask for your explicit consent to (a) collect and use the
personal data described in this policy for the purposes stated, and (b) transfer that data
across borders to the AI and infrastructure providers listed in section 4, including to the
United States, for the purpose of providing AI features and hosting the service. You may
withdraw consent by deleting your account, though some AI features will not work without it.
A Korean-language version of this policy is available on request and will be published at
thatfridge.com/privacy/ko. Personal-information protection officer:
Muhammad Naufal Kamaruddin,
privacy@thatfridge.com.
Malaysia (PDPA)
We process your personal data on the basis of your consent, given at sign-up, and in accordance with the Personal Data Protection Act 2010 (as amended). You may withdraw consent, access or correct your data, or raise a complaint by contacting privacy@thatfridge.com. We will notify affected users and the Commissioner of a personal-data breach that causes or is likely to cause significant harm, as required by law. A Bahasa Malaysia notice covering the same points is at thatfridge.com/privacy/pdpa.
United Kingdom
For users in the UK, the UK GDPR applies. Our lawful bases are: performance of our contract with you (running the core service), your consent (optional AI features and the cross-border transfer in section 9), and our legitimate interests in keeping the service secure and working. You can access, correct, port, erase or restrict your data by emailing privacy@thatfridge.com, and you may complain to the Information Commissioner's Office (ico.org.uk). We are not established in the UK; contact the address above for any data-protection matter.
Switzerland
For users in Switzerland, the revised Federal Act on Data Protection (revFADP) applies. Personal data is transferred to Singapore and the United States as described in sections 4 and 9; because these countries are not on the Swiss adequacy list, the transfer relies on your explicit consent, obtained at sign-up. You may exercise your access, correction and deletion rights, or contact the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch), regarding our processing.
11. Changes to this policy
We will post any changes on this page and update the "Last updated" date. Material changes will also be surfaced in the app.