Privacy Policy

Last updated: March 31, 2026

1. Information We Collect

StockPot collects the following information when you use the app:

• Account information: email address (used for authentication), optional display name, and optional avatar URL.
• Authentication credentials: password hash or OAuth token managed via Supabase Auth.
• Household data: pantry items, recipes, meal plans, grocery lists, and cook logs (which recipes were cooked, when, and by whom within the household).
• Recipe source URLs: when you save a recipe from a website, the source URL is stored alongside the recipe.
• Device information: device type, operating system version, and app version for crash reporting.
• Usage analytics: anonymous, aggregated usage events (e.g., screens visited, features used) — only if you have not opted out in Settings. An analytics opt-out toggle is available in Settings > Privacy.

2. Push Notifications

If you enable push notifications, StockPot stores your Expo push token to deliver notifications about pantry item freshness and household activity. Push tokens are automatically cleaned from our servers when they become invalid (e.g., after you uninstall the app or revoke notification permissions).

3. Camera & Photo Library

StockPot can use your device camera and photo library for recipe OCR scanning. Images are processed entirely on-device using ML Kit for text recognition. No images are sent to external servers. Camera and photo library access requires your explicit permission via the operating system prompt.

4. Error Tracking

StockPot uses the Sentry SDK to collect crash reports for improving app stability. Sentry receives device information, OS version, app version, and stack traces when an error occurs. Authentication tokens and other sensitive values are automatically redacted before transmission to Sentry.

5. How We Use Your Information

• To provide and maintain the StockPot service, including syncing data across your household.
• To process subscription payments via Apple App Store or Google Play.
• To send transactional emails (account confirmation, password reset, household invites).
• To deliver push notifications about pantry freshness and household activity.
• To diagnose crashes and improve app stability via Sentry error reporting.
• To understand aggregate usage patterns and improve the product (analytics).

6. Data Storage and Security

Your data is stored securely using Supabase (hosted on AWS infrastructure) with row-level security policies. Local data on your device is stored in an encrypted SQLite database. All network communication uses TLS encryption.

7. Third-Party Services

StockPot uses the following third-party services:

• Supabase: authentication, database, and real-time sync.
• Sentry: crash reporting and error tracking (auth tokens redacted).
• PostHog: anonymous usage analytics (opt-out available in Settings > Privacy).
• Expo: push notification delivery.
• Google ML Kit: on-device text recognition for recipe OCR (no data sent to Google).
• Apple / Google: in-app purchase processing and subscription management.
• Cloudflare: website hosting and content delivery.

8. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. Data is shared only with the third-party services listed above, solely to operate the StockPot service.

9. Household Data

When you join a household, your pantry, recipe, meal plan, cook log, and grocery data is shared with all members of that household. The household owner controls membership. If you leave a household, your contributions remain accessible to other members.

10. Children's Privacy (COPPA)

StockPot is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@getstockpot.com and we will delete it promptly.

11. Your Rights

• Access: you can view all your data within the app at any time.
• Deletion: you can delete your account and all associated data from Settings > Delete Account.
• Analytics opt-out: you can disable anonymous analytics from Settings > Privacy.
• Push notification opt-out: you can disable push notifications from your device settings or within the app.

12. California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, contact us at support@getstockpot.com.

13. European Residents (GDPR)

If you are located in the European Economic Area, you have additional rights including the right to access, rectify, port, and erase your personal data. Our legal basis for processing is your consent (account creation) and legitimate interest (service operation). To exercise your rights, contact us at support@getstockpot.com.

14. Food Safety and Allergen Disclaimer

StockPot may display allergen information, "best by" dates, and ingredient data associated with pantry items and recipes. This information is user-provided or sourced from third-party databases and may not be complete or accurate. StockPot does not guarantee the accuracy of allergen data, freshness indicators, or recipe ingredients. Always verify food safety information independently, especially if you or a household member has a food allergy or dietary restriction.

15. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date above.

16. Contact Us

If you have questions about this privacy policy, contact us at support@getstockpot.com.