Your pantry. Your data.

1. Who we are

iGarde (“we”, “us”) is a UK-based pantry and meal-planning application available at igarde.app. We are the data controller for any personal data you give us under the UK GDPR and the Data Protection Act 2018.

You can reach us at hello@igarde.app for any privacy question. Plain-text emails are fine; we don't need a form.

2. What we collect, and why

We try to collect the bare minimum to make the app work. The categories below are exhaustive for the consumer product — if we ever add new ones, we'll update this page first.

2.1 Account data required to sign in

• Email address — used to send the magic-link you tap to log in. We don't store passwords; we don't have a password to lose.
• An anonymous user ID generated by Supabase Auth on first sign-in.
• Sign-in timestamps kept by Supabase for security (last login, refresh time).
• A session token stored in your device's secure local storage. It is bound to this device and is not copied to any other device or to iCloud / browser sync.

You can use iGarde without signing in — without an account, nothing leaves your device, and there's nothing on our servers to lose.

2.2 Pantry data your content

• Items you add (name, quantity, unit, expiry date, category).
• Meals, recipes and favourites you save or import.
• Shopping list entries.
• Optional notes you write yourself.

This lives in a local database on your device, protected by the operating system's standard at-rest encryption (accessible only after you unlock the device). When you're signed in, the same rows replicate to our Supabase database so they appear on your other devices and to anyone else in your household. Pantry, meals, shopping list, receipts and receipt line items are scoped to the household; recipes and favourites are scoped to you.

2.3 Receipts sensitive

• The photo you captured.
• The OCR text recognised from it.
• The parsed line items (name, quantity, price), the store name, and the total.
• A confidence score per line, used to decide whether to ask the server for enrichment.

OCR is on-device. The iOS app uses Apple's Vision framework; the web app uses Tesseract.js running in your browser. The raw receipt image is never sent to an OCR service — not ours, not Apple's, not anyone else's.

If you're signed in, two things travel to our backend after a scan:

• The captured JPEG is uploaded to a private Supabase Storage bucket at the path receipts/<your-user-id>/<receipt-id>.jpg. The bucket is never public; access is only via short-lived signed URLs issued to you. Objects are automatically deleted after 30 days; the structured line items stay in your pantry until you remove them.
• The reconstructed OCR text from your scan — the item lines, the store name and the prices, plus our best local guesses — is sent to our parse-receipt Edge Function, which passes it to Anthropic's Claude API to clean up and categorise the item names (for example, turning CHKN BRST 300G into “Chicken breast”). This happens for every receipt you scan while signed in — not only hard-to-read lines — because the cleanup pass is what makes the review screen accurate. We send text only: never the receipt image, never your email, never any device identifier beyond the request itself. The cleaned text is used solely to fill in your pantry — it is never used for advertising and never sold. If the cloud call is unavailable (you're offline, over your limit, or it fails), the app falls back to reading the lines entirely on your device.

If you're not signed in, neither of the above happens — the scan, the OCR and the parsed items stay on your device.

2.4 Notifications optional

Expiry reminders are scheduled locally by the app on your device — they fire from your device's own clock. We do not register a remote push token and we do not run a push server; nothing about your notifications touches our servers or any push relay. You can revoke notification permission from your device settings at any time.

2.5 Operational logs

We keep short-lived server logs (typically 30 days) of errors and rate-limited requests so the service stays up. Logs are minimised — no full request bodies, no receipt contents, no message bodies. Anthropic, as our processor, keeps its own short logs of API calls under its standard terms.

2.6 What we do not collect

• No third-party analytics, crash-reporting or A/B-testing SDKs of any kind — no Firebase, no Sentry, no Mixpanel, no Crashlytics, no PostHog. (Our own first-party diagnostics are described in 2.7.)
• No advertising or social-tracking pixels.
• No device fingerprinting.
• No background location, contacts, microphone, photo-library scanning, calendar or health data.
• No access to your camera or photo library except when you actively tap to scan a receipt or pick a receipt photo.

2.7 Anonymous usage & crash diagnostics first-party, opt-out

To see which features are used and catch crashes, the app records a small set of first-party events — things like “app opened”, “receipt scanned”, “paywall viewed”, plus crash breadcrumbs and request latency/status codes. They are tied to a random device ID, never to your pantry contents, and they go only to our own Supabase project — no analytics company ever sees them. Usage sharing is on by default and you can switch it off any time in Settings › Share anonymous usage data.

2.8 Permissions we ask for

Each one is requested only when you first use the related feature, and you can revoke it any time in your device settings:

• Camera — to scan receipts.
• Photo library — only if you pick an existing receipt photo from your library.
• Notifications — to send local expiry reminders.

The app does not request location, microphone, contacts, calendar, reminders, health, motion or cross-app tracking permissions.

3. Legal bases (UK GDPR Art. 6)

• Contract — to provide the app you've signed up to: storing your pantry, syncing across devices, processing receipts.
• Legitimate interests — keeping the service secure, preventing abuse (rate limiting), and aggregate, anonymised product analytics.
• Consent — push notifications, and the optional cloud features that come with signing in (cloud receipt storage and the Claude cleanup pass that runs on the text of each receipt you scan). You can stay signed out to keep everything on your device, and you can withdraw consent in Settings without losing access to the rest of the app.
• Legal obligation — responding to lawful requests from UK authorities, if and when they arise.

4. Third-party processors

We use a small set of vendors to run the service. Each is bound by a Data Processing Agreement and processes data only on our instructions.

• Supabase — database, authentication, file storage, Edge Functions. Hosted in their EU region. This is our main backend.
• Anthropic (Claude API) — our AI sub-processor, based in the United States. When you are signed in, the text read from each receipt you scan (item lines, store name, prices) is sent to Claude to clean up and categorise the item names; Claude is also used when you import a recipe from a URL or pasted text, or use “Snap your shelf”. We send only the text needed for that task; we do not send the receipt image, your email or any device identifier to Anthropic. Anthropic processes the request solely to return the cleaned result, does not train on API traffic under its commercial terms, and the text is never used for advertising or sold.
• Apple — provides the App Store, the on-device OCR engine (Apple Vision) on the iOS app, and the on-device notification scheduler. Apple Vision runs locally on your device; it does not send your receipt images to Apple servers.
• Vercel — static hosting and routing for the marketing site and the web app.

We do not use Google Analytics, Meta Pixel, TikTok Pixel, Firebase, Sentry, Mixpanel, Crashlytics, PostHog or any other third-party tracker or crash reporter. The only analytics traffic you'll ever see in a network capture goes to our own Supabase project (the first-party diagnostics in 2.7); anything else is a bug — please tell us.

5. International transfers

Our primary infrastructure (Supabase, Vercel edge) is configured to host data in the European Economic Area. Anthropic processes API requests in the United States under Standard Contractual Clauses (UK Addendum) and equivalent safeguards. Apple's notification and OS services run on-device and do not constitute a data transfer for the operations we use. We will update this section if any of that changes.

6. How long we keep things

• Account & pantry data on our servers — for the life of your account. Account deletion is immediate and cannot be undone: the account row is hard-deleted straight away and the cascade fires across every table (backup copies age out within 35 days, per below).
• Local data on your device — until you uninstall the app, delete the local data from Settings, or sign out (signing out only clears the session, not your pantry).
• Receipt images — uploaded only when you're signed in, and automatically deleted from the bucket after 30 days. The structured line items remain in your pantry unless you remove them.
• Server logs — typically 30 days, then purged.
• Backups — encrypted, rotated, fully purged within 35 days of the live deletion.

7. Your rights

Under UK GDPR you can:

• Access — Settings offers two exports: Export local data gives you a JSON dump of what's on this device, and Export cloud data calls our gdpr-export Edge Function for everything we hold server-side.
• Rectify — edit or correct any field directly in the app, or ask us to.
• Erase — Settings → Delete local data clears the device; Delete account and cloud data calls our gdpr-delete Edge Function, which cascades through every server table, purges the receipt-image bucket, and signs you out.
• Object & restrict — you can stay signed-out (no cloud sync, no server-side enrichment, no receipt upload), or sign in and use the features selectively.
• Portability — both exports are plain JSON you can take anywhere.
• Complain — to the UK Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to fix things first by emailing us at hello@igarde.app.

8. Sharing recipes with other users

When you share a recipe via a share-code, the recipe payload (title, description, ingredients, steps) is stored in a publicly readable table indexed only by that code. Anyone with the code can import it. Don't put anything in a recipe you wouldn't want a stranger to see. Share-codes can be revoked from the recipe screen.

9. Children

iGarde is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has signed up, email us and we'll delete the account.

10. Security

• All traffic is encrypted in transit (HTTPS, HSTS).
• Sign-in sessions are stored in your device's secure local storage, bound to this device only — they're not synced to iCloud Keychain, browser sync, or any other device.
• Database and storage encryption at rest is handled by Supabase.
• Row-level security policies ensure your data is only readable by you and your household members.
• Edge Function secrets (the Anthropic key, service-role keys) are never bundled into the app.
• We use rate limiting and per-user quotas on AI calls to prevent abuse.

No system is perfect. If you find a vulnerability, please report it to security@igarde.app.

11. Storage and cookies

We do not use cookies for anything. Your data lives in your device's local database (your pantry) and your device's secure local store (your sign-in session). We do not set tracking, advertising or analytics cookies, so no PECR consent banner is required.

12. Changes to this policy

We'll update this page when something material changes — a new processor, a new feature, a new region. Substantial changes will be flagged in-app and in your sign-in email at least 14 days before they take effect. The “Effective” date at the top of this page always reflects the current version.