Privacy Policy

Summary of Key Points

This summary provides key points from our Privacy Notice. See the full sections below for more details.

• •We collect personal information you provide to us.
• •We do not collect biometric data. If you turn on biometric unlock, your fingerprint or face is checked by your own device and is never sent to us.
• •We record how you use the app in detail. This includes every screen you open, every tap you make, and a video style recording of your screen while you use it.
• •The prompts we send to our AI provider are recorded so we can monitor cost and quality. Your photos are not recorded.
• •When you sign in with Google, we receive basic profile information from Google.
• •We process your information to provide, improve, and administer our Services.
• •We share information with the service providers listed in section 4. We do not sell your personal information and we do not use it for advertising.
• •We implement appropriate organisational and technical security measures.
• •Depending on your location, you may have certain rights regarding your personal information.

1. What Information Do We Collect?

Personal Information You Disclose to Us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information we collect may include:

• •Names
• •Email addresses
• •Contact or authentication data
• •Contact preferences
• •Usernames
• •Passwords
• •A profile picture, if you set one or if you sign in with Google

Information You Put Into the App

Using StillGood means giving it information about your kitchen. We store the food items you add, their quantities, expiry dates, categories and storage locations, the photos you take of products and receipts, your shopping lists, the recipes you save or create, what you record having cooked, and the households you belong to along with the members in them.

Information We Receive From Google

If you sign in with Google, Google gives us your name, your email address and your profile picture URL so that we can create or recognise your account. If you buy a subscription or an extra household seat, Google Play tells us that a purchase was made and which product it was for.

Sensitive Information

We do not collect or process biometric data, government identifiers, health data, or any other special category of sensitive personal information. StillGood can be unlocked with your fingerprint or face if you choose to turn that on. That check is performed by your device, which tells the app only whether it succeeded. Your fingerprint and face data never leave your device and we never receive them.

Payment Data

Subscriptions and one-off purchases are sold and processed by Google Play Billing. We never see or store your card number, security code, or billing address. Google Play tells us only that a purchase was made and which product it was for, so that we can grant the plan or the extra household seat you paid for.

Application Data

If you use our application, we may also collect the following information if you choose to provide us with access or permission:

• •Mobile Device Access: We may request access to your device camera and storage to enable food scanning and other features.
• •Push Notifications: We may request to send you push notifications regarding your account or certain features of the application. You may turn them off in your device settings.
• •Device and Usage Data: We collect your device type and operating system, the app version you are running, your general region as inferred from your IP address, and your time zone, which we use to reset your daily allowances at your own local midnight.

2. How Do We Process Your Information?

We process your personal information for the following purposes:

• •To facilitate account creation and authentication and otherwise manage user accounts.
• •To deliver and facilitate delivery of services to the user.
• •To respond to user inquiries and offer support to users.
• •To send administrative information to you, including details about our products and services, changes to our terms and policies.
• •To enable user-to-user communications.
• •To request feedback and to contact you about your use of our Services.
• •To protect our Services, including fraud monitoring and prevention.
• •To understand how the app is actually used, so we can find what is confusing or broken and improve it. Section 5 explains this in detail.
• •To monitor what our AI features cost us and how well they perform.
• •To save or protect an individual vital interest, such as to prevent harm.
• •Expiry Date Reminders: To send expiry date reminders and food waste reduction notifications to help you manage your pantry effectively.

3. What Legal Bases Do We Rely On?

We only process your personal information when we believe it is necessary and we have a valid legal reason (legal basis) to do so under applicable law.

• •Consent: We may process your information if you have given us permission. You can withdraw your consent at any time.
• •Performance of a Contract: We may process your personal information when necessary to fulfil our contractual obligations to you.
• •Legitimate Interests: We may process your information when it is reasonably necessary to achieve our legitimate business interests. Understanding how our app is used, and keeping it working, are the interests we rely on for section 5.
• •Legal Obligations: We may process your information where necessary for compliance with our legal obligations.
• •Vital Interests: We may process your information where necessary to protect your vital interests or the vital interests of a third party.

4. When and With Whom Do We Share Your Information?

We share your information with the service providers we use to run StillGood. They process it on our instructions and for no purpose of their own. They are:

• •Supabase: our database, file storage and sign-in provider. It holds your account and everything you put into the app.
• •Google Gemini: the AI that reads your product photos and receipts, estimates expiry dates, and generates recipes and insights. Section 7 covers this.
• •Google Play: sells and processes subscriptions and one-off purchases, and tells us the outcome.
• •Google Sign-In: used only if you choose to sign in with Google.
• •PostHog: our product analytics and session recording provider. Section 5 covers this.
• •Sentry: receives crash and error reports from the app so we can fix faults.
• •Vercel: hosts stillgoodapp.org and provides its traffic statistics.
• •Resend: sends transactional email such as password resets and account notices.
• •Open Food Facts and TheMealDB: we query these for product and recipe information. We send them a barcode or a search term. We do not send them anything that identifies you.

We may also need to share your personal information in the following situations:

• •Business Transfers: We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition.
• •Other Users: When you share personal information or interact with public areas of the Services, such personal information may be viewed by all users. If you join a household, the other members can see the items you add and the activity you generate in it.
• •Legal Requests: We may disclose your information where we are legally required to do so.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it to target ads.

5. Analytics and Session Recording

We want to be direct about this section, because we record more than most apps do. We use PostHog, a product analytics service, to understand how StillGood is actually used. PostHog processes this data on servers in the United States.

What We Record in the App

• •Every screen you open, and when.
• •Every tap you make. This is captured automatically, and it includes the text label of whatever you tapped. On a pantry row that label is the name of the food.
• •Named actions such as adding an item, running a scan, generating a recipe, checking out a shopping list, opening a notification, and starting or completing a purchase.
• •Your plan, whether you are in a household and whether you own it, the date you signed up, your platform and your app version.
• •If you are in a household: the household identifier, its plan, how many seats it has and how many members are in it. We do not record the name you gave your household.
• •Every request the app makes to our servers, including which feature was called, whether it succeeded, and how long it took. We do not record the contents of those requests.

Session Recording

We record your screen while you use the app, and play it back to understand where people get stuck. These recordings are not masked. That means a recording can show your pantry photos, the contents of a receipt you scanned, the item names you type, and the information on your account screens. Please treat the app as though someone may watch a recording of your session, because they may.

What We Do Not Record

Our named analytics events never carry your email address, your display name or your profile picture. We do not record your password at any point, and password fields are handled by your device keyboard rather than captured as text by us.

On the Website

On stillgoodapp.org we record the pages you visit, the address you arrived from including any campaign tags in the link, and the links and buttons you click, including when you leave for Google Play. We also use Vercel Analytics, which measures traffic volume and page speed.

Experiments

We sometimes show different versions of a screen to different people to find out which works better. PostHog decides which version you see, and records which one you were shown.

Your Choices

We do not currently offer an in-app switch to turn analytics off, and we would rather tell you that plainly than imply a control that does not exist. If you want your data excluded, email us using the address in section 14 and we will exclude you and delete what we hold about you in PostHog. None of this data is used for advertising and none of it is sold.

6. Cookies and Similar Technologies

On stillgoodapp.org, PostHog sets cookies so that it can recognise a returning browser and group your visit into a single session. Vercel Analytics measures traffic without setting cookies that identify you. We do not use advertising cookies and we do not allow third parties to track you across other websites.

The mobile app does not use cookies. It stores your sign-in token in your device secure storage, and your preferences and cached data in ordinary app storage. Removing the app removes both.

7. Do We Offer AI-Based Products?

We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies. We provide AI Products through Google Gemini. Our AI Products are designed for the following functions:

• •Image analysis: scanning and recognising food products and receipts via your camera
• •Expiry estimation: reading printed dates and estimating how long food will last
• •Recipe generation: creating recipes from what is in your pantry
• •AI insights: describing patterns in your food inventory and waste
• •Content moderation: checking recipes, reviews and names that people submit

To do this we send Google Gemini the photo you scanned or the text the feature is about, such as your shopping list lines or your pantry contents.

How We Monitor Our AI

We record the text prompts we send to Gemini, together with the response, so that we can monitor what our AI features cost and whether their quality is getting better or worse. These records go to PostHog and are covered by section 5. Because a prompt describes what you asked about, it can contain your food names, your shopping list text or your recipe text.

Your photos are not stored in these records. Before a prompt is recorded, the image is replaced with a short placeholder noting that an image was present.

To opt out, you may choose to manually enter product information instead of using AI scanning. Manual entry allows you to add items without relying on AI-based image recognition.

8. How Long Do We Keep Your Information?

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law. No purpose in this notice will require us to keep your personal information for longer than the period of time in which you have an account with us.

Some records are cleared sooner. Your cooking history, activity feed, scan history, completed shopping list items and in-app notifications are deleted automatically after six months. Analytics and session recordings are kept according to our provider retention settings and are deleted when that period ends.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information.

9. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. Your data is separated from other accounts by database level access rules, your sign-in token is held in your device secure storage, and traffic between the app and our servers is encrypted. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. You should only access the Services within a secure environment.

10. What Are Your Privacy Rights?

Depending on your location, you may have rights that allow you greater access to and control over your personal information. These may include:

• •The right to request access and obtain a copy of your personal information
• •The right to request rectification or erasure
• •The right to restrict the processing of your personal information
• •The right to data portability
• •The right not to be subject to automated decision-making
• •The right to object to the processing of your personal information, including the analytics described in section 5

Account Information

To review, change, or terminate your account, you can:

• •Log in to your account settings and update your user account.
• •Delete your account from within the app, under Settings.
• •Contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases.

11. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track feature. As no uniform technology standard for recognising and implementing DNT signals has been finalised, we do not currently respond to DNT browser signals. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

12. Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you, correct inaccuracies, get a copy of, or delete your personal information.

Your rights include:

• •Right to know whether or not we are processing your personal data
• •Right to access your personal data
• •Right to correct inaccuracies in your personal data
• •Right to request the deletion of your personal data
• •Right to obtain a copy of the personal data you previously shared with us
• •Right to non-discrimination for exercising your rights
• •Right to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve (12) months, and we will not do either in the future. We do disclose personal information to the service providers listed in section 4 so that they can perform services for us.

13. Do We Make Updates to This Notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently.

14. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, email us at hello@stillgoodapp.org. A human reads every message.

15. How Can You Review, Update, or Delete Your Data?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. To request to review, update, or delete your personal information, please contact us using the information provided above.