Privacy Policy

What we collect

Your account

• Email address and password. Used to sign in, confirm your email and reset your password. Passwords are stored only in scrambled (hashed) form; nobody can read them, including us.
• Username and display name. Shown to people in your groups, and used so people can invite you by username.
• Profile picture (optional). Only a picture you choose from your photos or take with the camera for it. It’s stored with a link that anyone who has the link can open.

What you add to the app

• Groups, inventories and their settings, and who has access to them.
• Items: names, quantities, units, notes, sections, barcode numbers and expiry dates.
• A history of changes in each group (for example “Max added Milk”), kept for 90 days.
• Each group’s list of scanned products (barcode number, name, unit, section, usual amount, how long it lasts, and who last updated it), so scanning the same product again fills these in. Items in private inventories aren’t added to it: each private inventory keeps its own list instead, which only the people who can open that inventory can see, and which is deleted with the inventory.
• Shared product suggestions: when groups owned by at least 2 different people have saved the same barcode under the same name in shared inventories (or a trusted contributor has saved it), that barcode’s name, brand, unit, usual amount and how long it lasts are suggested to anyone who scans it. Nothing else is shared: not who saved it, not notes, not group or inventory names, and nothing from private inventories. A group owner can turn this off for their group in Group settings → Product suggestions. Reports that details are wrong are kept with the reporter’s account and deleted with it.
• Each group’s shopping list: what’s on it, amounts, notes, who added each thing and who ticked it off. Ticked-off things are deleted after 30 days, or sooner when someone clears them.
• What receipt lines turned out to be: when you check a scanned receipt, each line’s printed text (for example “GV 2% MLK GAL”) and the name, unit, amount and shelf life you gave it are remembered for your group, so the next receipt fills in by itself. Lines added to private inventories aren’t remembered. Receipt photos and prices aren’t kept.
• Shared receipt-line names: when groups owned by at least 5 different people have given the same printed receipt line the same name (or a trusted contributor has), that line’s name, unit, usual amount and shelf life fill in for anyone who scans it. Names the AI suggests for a receipt line are kept the same way, with only the printed line, so the same line isn’t sent to the AI again. Names containing offensive words are never shared. Common receipt abbreviations (“CRTN” for croutons) are learned from these names too. Nothing else is shared: not who bought it, where or when, not group or inventory names, and nothing from private inventories or from groups that turned off Product suggestions (turning it off takes their lines back out).
• When each group scanned receipts, and who scanned them (to see how much the feature is used; deleted after 3 months).
• Invitations you send and receive.
• Reports you send about other people (who, the reason and any details you add), and the people you block.

Notifications

• Your notifications inside the app (invitations, plan changes, expiry reminders and so on).
• Your notification settings, including the hour you want reminders and your time zone, so reminders arrive at the right time. Reminders are sent only as alerts on your phone, never by email.
• A push token for each phone you sign in on, so we can send alerts to it. It’s removed when you sign out of that phone. If the phone is offline when you sign out, or you’re signed out automatically, it isn’t removed straight away: the phone can still get your alerts until someone signs in on it again (it then belongs to them) or you ask us to delete your account.

Plans and payments

• Payments are handled by Google Play. We never see or store your card or bank details.
• We receive and keep the status of your subscription: which plan, which group it’s for, when it started and renews, and whether it’s ending or has a payment problem. This is linked to your Shelf Life account.

Camera and photos

• Camera: used only while you’re scanning a barcode or a receipt, or taking a profile picture. Barcodes are read on your phone: no pictures or video of them are saved or sent anywhere, and only the barcode number is kept, if you save it on an item. A profile picture you take is uploaded only if you choose to use it, the same as one picked from your photos. A receipt photo is read on your phone and never uploaded or saved by Shelf Life; only the lines you choose to add are kept, as items.
• Photos: used only when you choose a profile picture or a receipt photo. We receive only the profile picture you pick; receipt photos stay on your phone.
• Both are optional. You can say no, or turn them off later in your phone’s settings.

Technical information

Like any online service, our hosting provider records basic technical information when the app connects, such as IP address, time and the request made. It’s used to run and secure the service.

• Security check. When you sign up, sign in, reset your password, ask for another confirmation email, or confirm your password (for example to change your email or delete your account), Cloudflare Turnstile checks that you’re a person and not an automated program. It looks at information about your phone and its connection to do this. It doesn’t use cookies for advertising.
• Leaked-password check. When you choose a password, the app checks it against Have I Been Pwned’s list of passwords exposed in data breaches. Your password is never sent: the app sends only the first 5 characters of a one-way scrambled version (a hash) and does the comparison on your phone.
• Crash reports. If the app crashes or hits an unexpected error, it sends a report so we can fix it: the error and where in the app’s code it happened, your phone’s model and Android version, and the app version. Crash reports don’t include your name, email, IP address or what’s in your inventories.

Saved on your phone

• Offline copies. So the app still opens without a connection, it keeps a copy of the screens you’ve opened (your profile, groups, inventories, items and notifications) on your phone. These copies stay on the phone, belong to your account only, and are deleted when you sign out.

Bug reports you send

If you use Report a bug in the app, it opens your email app with a report ready to send. Besides what you write, the report includes the app’s version, your phone’s make and model, its Android version, and your username, so we can find the problem. You see all of it before sending, and nothing is sent unless you send the email. We keep these emails only as long as we need them to fix the problem and reply to you.

Tester check-ins

The Daily check-in form on our testers page sends us what you write: the name you give, the date, how long you used the app, what you used it for, your comments and your star rating. It’s saved in our database and emailed to us, and only we read it. To stop floods of fake reports, Cloudflare Turnstile checks you’re a person, and we keep a one-way scrambled code made from your connection’s address (never the address itself) for 2 days to limit how many reports one connection can send. Check-ins aren’t linked to your account unless the name you give is your username.

Minimums and the waste log

If you set “Keep at least” for something, that minimum is kept with the inventory. If you mark something as gone bad, damaged, lost or given away, the name, amount, reason, an estimated cost (from receipt prices) and who logged it go in the group’s waste log, seen by the group (from a private inventory: only you). The waste log is deleted after 2 years.

Calendar link

If you turn on Add to your calendar, you get a private web address listing, for the next 90 days, the names, amounts and inventories of things that expire each day. Your calendar service (for example Google) fetches it every few hours under its own privacy policy. Anyone with the address can see that list, so keep it to your own calendar; you can get a new one or turn it off at any time in the app.

Prices and stores

When you add things from a scanned receipt, the price paid for each line is kept, but only when you give the store’s name and full address (street, city, state, ZIP) and the item’s brand (or choose “No brand”). The brand is also remembered with that receipt line for your group. You and the people in that group can see these prices; prices from a private inventory are only for you. Stores you used are remembered for you to pick again; the list of stores itself (names and addresses) can be seen by everyone, with nobody’s name on it.

Sharing prices is off unless you turn it on (“Share prices anonymously”). When it’s on, your prices help work out a typical price for something at a store. Others only ever see that typical price (the middle value), how many people it’s based on and the week, and only once at least 5 different people have shared one in the last 120 days: never your price, your name, or the day or time you shopped. The exception is a trusted contributor (someone who applied and was approved): their newest shared price is shown as the typical price until 5 people have shared one, labeled as coming from a trusted contributor, without their name. Turning it off, or a group turning off Product suggestions, takes your prices back out. Prices are deleted after 2 years, or with your account.

Finding stores and planning a trip

When you use Plan a shopping trip or Find it on the map, the address, city or ZIP code you type is sent once to a map service to find that place and the grocery stores near it. We don’t save that address, on your phone or on our servers, and we don’t log it. The stores shown come from our store list (grocery store locations published by All the Places and by the Overture Maps Foundation, and stores people added) and from the map service; the map service’s stores are shown, not saved. We count how many store searches each person makes per day, to keep within the map service’s limits, but not where. The plan itself (which stores, the route) is worked out on your phone. Opening the route sends the stops and your starting point to Google Maps, under Google’s privacy policy. Your phone remembers your distance, stops and priority choices, and the kinds and brands you picked, never the address.

Store locations include data from the Overture Maps Foundation (overturemaps.org), used under the Community Data License Agreement – Permissive 2.0 and the Apache License 2.0, and from All the Places (alltheplaces.xyz, CC0).

Regional prices

Where no store nearby has a price for something, Shelf Life may show the U.S. Bureau of Labor Statistics’ average price for it in your region (for example, a gallon of milk in the Midwest). This is public government data; we only use which state your stores are in to pick the region.

Matching barcodes to receipt lines

To learn which barcode each receipt line is, without asking you, Shelf Life keeps for each household (group): when a receipt was added, the store’s chain and the lines printed on it; and when barcodes were added to its shared inventories. Lines that keep turning up with the same barcode are matched for that household. A match is shared with everyone (as “this line at this chain is this product”) once 3 households’ scans agree on their own, with no one’s name, trips or dates. Nothing from private inventories is used, groups that turned off Product suggestions keep their matches to themselves, and trips and scan times are deleted after 400 days. When you scan items while putting a receipt away and tap which line a barcode is, that choice is kept for your household (and counts toward sharing the match, the same way, once 2 households agree).

Keeping shared names honest

Shared product and receipt names, and typical prices, count only one vote per person. To check that, we use when your account was created, whether your email is confirmed, and how many items you and your groups have added. The app also sends Android’s app-specific ID for your phone (it can’t be used by other apps and changes after a factory reset); we keep only a scrambled code made from it with a secret, never the ID itself, so accounts made on the same phone count once. These codes are deleted with your account.

Trusted contributor applications

If you apply to become a trusted contributor in the app, we keep what you write, where you said you shop, and whether it was approved. To decide, we look at your username, when you created your account and how many items you’ve added. Approved contributors’ product and receipt names are shared with everyone straight away (still without saying who saved them). Applications are kept until you delete your account.

Our website

This website doesn’t use cookies, analytics or tracking. Its pages load their typefaces from Google Fonts, so your browser connects to Google, which receives your connection’s address and browser details to send the fonts. The testers page remembers the name you last used for a check-in, in your own browser only.

Ask Shelf Life and name fixing

These are optional. When you ask a question or tap Fix names / Tidy name, the text is sent to Anthropic, which runs the Claude AI that answers, as our service provider. To answer questions about your food, the assistant looks up items in the inventories you can open (never anyone else’s) and sends what it finds along with your question. Nothing is sent unless you use these features. We count how many times you use them each day, to apply the daily limit, and keep those counts for a month. Conversations aren’t saved: they’re gone when you leave the screen. Answers come from AI and can be wrong, so check anything important, especially dates.

What we don’t collect

We don’t collect your location, contacts, or anything for advertising. The app contains no ads, no usage analytics and no third-party tracking.

How we use it

• To provide the app: sign-in, syncing inventories between members, reminders and notifications.
• To provide paid plans: applying the right limits to each group, and telling you about renewals or payment problems.
• To keep the service secure, prevent abuse, and fix problems.
• To review reports and enforce our Terms of use, for example by resetting an offensive name or closing an account.
• To answer you when you contact us.

We don’t use your information for advertising, and we don’t sell it or share it for anyone else’s marketing.

Who can see your information

• People in your groups see your display name, username and profile picture, the shared inventories you add to, and the group’s change history.
• Private inventories are seen only by their owner and the people they choose.
• Anyone who knows your exact username can find your display name and profile picture in search and send you an invitation, unless you change this. You choose whether to join any group.
• Your choice: under Privacy in the app you can allow this for anyone with your exact username (the default), only people in your groups, or nobody (you then join groups with a code). People you’ve blocked can never find or invite you.
• Our service providers process information for us to run the app (below).
• The law: we may disclose information if required by law, or to protect people’s safety or the service.

Service providers

These companies process information only to provide their service to us:

These providers may process information in the United States and other countries.

How long we keep it

• Your account and content: until you delete them, or delete your account.
• Group change history: 90 days.
• A group’s list of scanned products: until the group is deleted.
• Push alerts: deleted 7 days after they’re sent.
• Offline copies on your phone: until you sign out, or uninstall the app.
• Notifications in the app: deleted 90 days after you’ve read them, and any after a year.
• Crash reports: up to 90 days.
• Tester check-ins: up to a year after Shelf Life launches publicly (email us to delete yours sooner). The scrambled connection code: 2 days.
• Reports: up to a year after we’ve reviewed them. The person reported is never told who reported them.
• Blocks: until you unblock the person, or either account is deleted.
• Profile pictures: deleted when you change or remove your picture, or ask to delete your account.

Deleting your account

You can delete your account in the app: Your profile → Account & security → Delete account. If you can’t use the app, email us. Full details of what’s deleted and what’s kept.

• Your profile picture is deleted right away.
• Your account is kept for 14 days in case you change your mind (sign in to cancel), then deleted for good.
• Inventories you own are handed to someone else in the group so they don’t lose their lists, or deleted if nobody else has access. Your name is removed from the group’s change history.
• Deleting your account doesn’t cancel a Google Play subscription. Cancel it in the Play Store first.

Your choices and rights

• See and change your details in the app (Your profile, and Account & security).
• Turn notifications and reminders off in Notifications & reminders, or in your phone’s settings.
• Ask us for a copy of your information, to correct it, or to delete it, by emailing us. We’ll reply within 30 days.

Depending on where you live, you may have further rights under local law. Email us to use them.

Security

Information is encrypted while it travels between the app and our servers. Access rules in our database make sure people can only reach groups and inventories they belong to. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you, as the law requires.

Children

Shelf Life isn’t meant for children under 13, and we don’t knowingly collect information from them. If you believe a child has given us information, email us and we’ll delete it.

Changes to this policy

If we change this policy, we’ll update the date at the top. For important changes we’ll also tell you in the app before they take effect.

Contact

Questions or requests: shelflife.software@gmail.com