Privacy Policy

Expiry helps you track household items, expiry dates, locations, shopping list entries, reminders, household sharing, and related household activity. This policy explains what data the app handles and how it is used.

Data You Add to the App

The app may store the inventory information you enter or create, including item names, brands, barcodes, quantities, categories, locations, expiry dates, opened dates, notification settings, notes, shopping list entries, household names, household members, item photos, and change log history.

iCloud and Household Sharing

Expiry can use Apple's iCloud and CloudKit services to sync your data across your devices and, when you choose to share a household, with the people you invite. Anyone holding a public invitation link may access shared data; send links only to people you trust. Apple's handling of iCloud data is governed by Apple's privacy terms.

Household sharing may store member display names, iCloud record identifiers, invitation status, owner/member roles, and whether a member has Pro access granted by the household owner. A Pro household can include one owner and up to four invited guests. A Free household supports an owner and one partner; this does not grant the partner Pro. If you invite someone to a shared household, that person can see the shared household's items, photos, locations, categories, shopping list entries, and activity that belong to that household. Public invitation links currently allow CloudKit read/write access. App-level view-only controls and member limits are not a guarantee of access restrictions for someone holding the link. Resetting a link removes guest access, but cannot take back copies already saved.

Photos, Barcode Scanning, Receipts, and OCR

If you use item photos, barcode scanning, or expiry date scanning, the app may process images or camera input to help identify products or read expiry dates. Camera and photo access is only used for app features you choose to use.

Expiry date and text recognition are processed on device using Apple's Vision technologies. Barcode product lookup is best-effort and may send the scanned barcode to the Open Food Facts service to retrieve a product name and brand. Item photos you attach are stored locally and, if iCloud sync or household sharing is active, in the relevant iCloud container.

If you use the receipt scanning feature ("Smart Add") to add several items at once, the photo of the receipt you capture is sent to our processing service to extract the list of items, prices, and dates printed on it. This request is routed through our own secure server, which forwards the image to a third-party AI provider (Google's Gemini API) solely to read the receipt and return the extracted items. The receipt image is used only to perform this extraction; Expiry does not keep a receipt-image archive or use it for advertising. Google's service may retain prompts and responses for abuse monitoring under its Gemini API terms. You always review and confirm the extracted items before anything is saved to your inventory. If you prefer not to send receipt images off your device, you can simply not use this feature and add items manually instead.

When local product matching cannot identify a scanned product, Expiry may send its name, brand and barcode through our service to Google's Gemini API to suggest a category, storage and timing. This is separate from Open Food Facts lookup. Check and adjust the suggestions before saving; user-entered product text can contain personal information.

Notifications

If you enable reminders, Expiry uses notification data such as item names and expiry dates to schedule local notifications on your device.

Recipes and AI Services

Recipe generation is optional and starts only after you review a separate send confirmation. The request can include recipe-relevant inventory item names, amounts, storage and freshness; whether an item is already on Shopping; servings and time; and your taste and cooking preferences. A shared household request can include item text entered by another household member.

Expiry does not add your name, email, Apple Account, household and member identifiers, stable inventory identifiers, activity history, and analytics identifiers to the recipe payload. Item names may still contain personal information you or another member entered. The payload is routed through Expiry's service on Cloudflare to OpenAI to generate the requested text recipe. OpenAI receives the request with response storage disabled; limited abuse-monitoring retention may still apply under OpenAI's API data controls. A pseudonymous installation proof and ordinary network and security data are processed to prevent abuse. The proof does not contain your name or account identifiers, but it can distinguish this app installation. Expiry therefore does not promise absolute anonymity.

To return the same result after an interrupted request and avoid duplicate generation, Expiry's service can retain a completed recipe response and its request identifiers for up to 24 hours. This temporary retry record is associated with the pseudonymous installation and is removed when the installation's server data is deleted. It is separate from recipes you choose to save in the app.

Expiry does not generate recipe images or handle allergies, intolerances or medical diets. Recipe content can be incomplete or inaccurate. Recipes are meal ideas, not medical advice, treatment, certification, or a guarantee of allergy safety. Always check product labels and use appropriate professional advice for medical needs.

Security and Abuse Prevention

Receipt extraction, product classification and recipe requests use Apple's App Attest. Expiry's service may process an opaque installation identifier, App Attest key material, short-lived challenges, assertion counters, accepted Recipe revision identifiers, and aggregate usage limits. These values are used to verify genuine app requests and prevent replay and service abuse, not for advertising or cross-app tracking.

Delete All My Data asks Expiry's service to delete this pseudonymous installation security record before its local credentials are cleared. If the service is temporarily unavailable, Expiry retains only those security credentials and a bounded retry marker; it does not retain an inventory or preference payload for the retry. Short-lived challenges, recipe retry records, and daily usage records expire automatically; registered security keys and counters expire after 90 days without a successfully verified registration or assertion. Existing registrations without a last-use timestamp receive one 90-day migration grace period. Cleanup retries if dependencies are unavailable and does not discard active usage limits or replay-protection records prematurely. An app returning after expiry can register a new key.

Optional Usage Analytics

Expiry can send content-free usage statistics, such as which screens and features are used and in what rough quantities, and basic purchase information, such as the selected plan, whether a purchase succeeded, failed, was cancelled or is pending, and whether restoring purchases found an entitlement. Analytics can also include rough response-time ranges for recipes and suggestions, and basic sync status, such as whether sync is waiting, offline or needs attention and a rough range for how many changes failed. They can also include rough freshness ranges for shared-household data and whether a refresh recovered; no household name or identifier is sent. Sharing is off by default. After your first week and at least three saved items, Expiry may offer a one-time choice on Home once onboarding and other prompts have finished. Choosing Share usage enables sharing; No thanks keeps it off without asking again. You can also change your choice in Settings > Help & privacy > Share usage analytics. Turning sharing off deletes any statistics not yet sent. The statistics never include item names, photos, notes, household or member details, your name, email, or Apple Account. Event times are rounded to the hour. They are sent to Expiry's own service on Cloudflare and are used only to understand and improve the app, not for advertising or tracking. Each batch carries a pseudonymous identifier derived from the app's installation identity. It is not an Apple Account or advertising identifier, but Expiry can correlate it with the installation identifier used for recipe requests. Because that identifier is stable for an installation, Expiry does not promise absolute anonymity. Turning sharing off removes unsent events; it does not delete previously accepted statistics or the installation's separate abuse-prevention records.

Expiry also keeps a bounded usage-diagnostic history on your device. This local history is separate from optional sharing and is not uploaded retrospectively when you enable sharing.

Diagnostics and Feedback

If you send feedback or an error report, the information you choose to include may be used to diagnose bugs and improve the app. Feedback and error reports are sent by email from your chosen mail app. Error reports may include app version, iOS version, device model, and recent app error log entries if you choose to include them. Expiry does not use this information for advertising.

Payments and Subscriptions

Purchases, subscriptions, renewals, cancellations, and refunds are handled by Apple through the App Store. Expiry receives transaction information from StoreKit to determine whether Pro features should be unlocked, but it does not receive your full payment card details.

Pro access may come from your own App Store purchase or subscription, or from being an invited member of a Pro household. Expiry stores only the entitlement information needed to unlock app features.

Data Sale and Advertising

Expiry does not sell your personal data, does not track you across apps or websites, and does not use your inventory data for third-party advertising.

Data Deletion

You can use Settings > iCloud & Data > Delete All My Data in Expiry to delete app data stored by Expiry on your device, including items, households, categories, locations, shopping list entries, app settings, diagnostics, pending reminders, Recipe preferences, saved Recipe snapshots. This action cannot be undone. When iCloud sync is available, Expiry also attempts to delete CloudKit data zones owned by your iCloud account, including your personal household data and shared households you created. Data in shared households owned by another person is controlled by that household owner and by Apple's iCloud sharing controls. Deleting a shared household or removing a member may affect access for other household members. You can also manage or remove app data associated with iCloud using Apple's iCloud settings. App Store purchases and subscriptions are managed separately through your App Store account. Some short-lived or security-related records held by service providers may remain for fraud, abuse-prevention, legal, or operational retention periods.

Contact

For privacy questions, contact: danielboutrup@gmail.com