Version 1.0-draft · 2026-10-14
STRATEGIC DATA ARCHITECTS LLC, 1209 Mountain Road Place NE, Ste R, Albuquerque, NM 87110, United States, is responsible (the "controller") for the personal data processed through the Ingredo app and ingredo.net. Contact: privacy@ingredo.net.
Our representative in the EU (GDPR Article 27): not yet appointed. Their name and address will be added here before Ingredo is released.
Our representative in the UK (UK GDPR Article 27): not yet appointed. Their name and address will be added here before Ingredo is released.
When you sign in with Apple, Apple gives us a unique identifier for your Apple ID and, if you choose to share them, your name and email address (or an Apple private relay address). We create an Ingredo user ID from this. We use it so your meals, purchases and saved recipes belong to you and survive a reinstall.
For every meal you start, we record your user ID, the time, which plan paid for it (subscription, "Share your data", meal pack or free meal), a session ID and a request ID that stops the same meal being counted twice. We also keep the state of your plans: subscription status, meal-pack balance and whether you share your data, with the version and time of the agreement you accepted.
Apple takes payment. We never see your card or payment details. When you buy, the app sends us the purchase record that Apple signed, and Apple tells our server about renewals, expiry and refunds. Every purchase also carries your Ingredo user ID: the app gives it to Apple as the purchase's account token, Apple keeps it in the purchase record, and it comes back to us with the purchase and with Apple's later notifications (renewals, expiry, refunds), also after you delete your account. We use it only to add the purchase to the right account. We store the transaction ID, the original transaction ID, the product, the environment (real or test purchase), the purchase, expiry and refund dates, the refund status, and how many meals the purchase credited and how many a refund removed, to check each purchase with Apple and to credit it exactly once. We also keep each notification Apple sends us (its type, date, transaction ID and what we did with it).
Until our server has confirmed a purchase, it waits on your iPhone and is sent again when you open Ingredo or sign in. If another person signs in on the same iPhone while one of your purchases waits, the app sends your purchase record (including your user ID as its account token) to our server with their session; we keep the purchase for you and show them nothing about it, unless your account has been deleted, in which case it is added to theirs.
When you delete your account, we keep these purchase records and Apple's notifications, but remove your user ID from them, so the same purchase can never be credited twice. A subscription that is still active can be linked again: when any Ingredo account sends it to us, for example with "Restore purchases" on an iPhone signed in to the App Store account that paid for it, it is linked to that Ingredo account.
To suggest dishes, the app sends your photos, what you type, your diet settings, your taste profile and the picks and ratings it is built from to our server, which passes them to Google's Gemini models through OpenRouter. The app asks you first ("Agree and continue"), and nothing is sent before you agree. Before a photo leaves your phone, the app saves it again with only the picture, without hidden data such as location or camera details, and the app refuses to send a photo that still has such data. Our server does not keep the photos or the text of these requests. OpenRouter and Google process them to answer the request, under their own terms.
Your saved recipes, the ingredient lists from your fridge scans (not the photos) and your taste profile, including your diet settings, are stored with your account so they work after a reinstall. We use your diet settings only to tailor suggestions. They are never part of shared data.
For each AI request we keep your user ID, the model used, the estimated and actual cost, and the time. These records keep Ingredo affordable and stop abuse. We delete them after 7 days. If you delete your account, your user ID is removed from them straight away and the records are still deleted after 7 days.
To give the 5 free meals only once per Apple account, we keep a record keyed by a one-way code (a "hash") made from your Apple identifier and a secret key. With the code, the record holds how many of the 5 free meals have been used, when the record was created and last changed, and the total number of meals ever credited from test purchases (purchases made through TestFlight or Apple's App Review, which Apple does not charge for; we credit at most 25 such meals per Apple ID). It contains no name, no email and no Ingredo user ID, but we can recognise it if you sign in again with the same Apple ID. We keep it after you delete your account. That is its purpose: otherwise, deleting and re-creating an account would give new free meals and new test meals.
If you accept the Data Sharing Agreement, then each time you scan your fridge and pick a dish we store a "trace" (at most 6 a day): up to 4 fridge photos after redaction, the ingredients Ingredo found, your corrected list, the four dishes suggested, the dish you chose, your app language, your phone's region setting, the season and the day (UTC date). Before upload, your phone shrinks each photo to at most 1024 pixels, finds faces and text with Apple's Vision framework on the phone, pixelates and blurs them, and saves a JPEG of at most 300 KB without hidden data such as location or camera details. If detection is not available, fails or takes longer than 15 seconds, nothing is uploaded. Our server refuses any photo that still has hidden data or is too large.
Traces carry no user ID, name, email, Apple identifier, diet settings, time of day or device identifier. Our storage provider does record when each photo was uploaded, seconds after the meal it belongs to, whose time our meal records keep with your account, so the two could be matched while both exist. So that you can stop and have your traces deleted, your phone keeps a random contributor key and our server keeps a one-way code of that key with your account. The key is stored in Ingredo's files on your phone, which iOS includes in iCloud or device backups; deleting your account removes it from the phone. While your account exists, we can therefore find your traces. That makes them pseudonymous, not anonymous, and we treat them as personal data.
We use traces to improve Ingredo, to train and evaluate food-recognition models, and to license those models, and services built on them, to other companies. We never sell or hand over the photos, labels or traces themselves as a dataset, except to a buyer of our business as described in the agreement, and never anything that identifies you. The four dish titles in a trace, including the one you chose, are generated by Google's model: we use them only to improve Ingredo and leave them out of every model and dataset we license to other companies.
When you accept the agreement, we record its version, a fingerprint (sha256) of the agreement text, a one-way code of your contributor key, that you confirmed you are 18 or older, when you accepted and, later, when you stopped. The record has no user ID. This consent record has no link to your account once you stop sharing or delete your account, and we keep it as proof that the shared data was collected with your consent.
ingredo.net uses no cookies, analytics or trackers. Our web host, Google Firebase Hosting, processes technical data such as your IP address to deliver the pages. If you write to us, we receive your message and the address you wrote from. Our addresses at ingredo.net are forwarded by ImprovMX to our mailbox.
Our backend provider, Supabase, keeps short-lived technical logs of requests to our server, including IP addresses, your user ID and the time, to run and secure the service. For "Share your data" they show when you joined and stopped.
Companies that license our food-recognition models receive models and services, never your photos, labels, traces or anything that identifies you. We do not sell your personal data and do not share it for advertising.
We are a company in the United States. Your data is stored in the EU (Ireland), but we manage it from the United States, and OpenRouter, Google and Apple may process it in the United States and other countries. The safeguards for these transfers (EU Standard Contractual Clauses or the EU-US Data Privacy Framework) will be confirmed here before release.
You can ask to see, correct, delete or receive a copy of your data, to restrict or object to how we use it, and you can withdraw consent at any time. In the app you can delete your account (Profile > Delete account) and stop sharing your data (Profile > Plan > Stop sharing, available whenever anything you shared is still linked to your account). For everything else, write to privacy@ingredo.net. We may need to confirm that you own the account. We answer within one month.
If you are in the EU, the EEA or the UK, you can also complain to your data protection authority. If you live in a US state with a privacy law, you have the rights that law gives you, and you can use them the same way.
Ingredo is not meant for children under 16 in the EU and the UK, or under 13 elsewhere (or the higher age your local law sets). We do not knowingly collect their data. If you think a child has used Ingredo, write to us and we will delete the data. "Share your data" is only for people aged 18 or older.
Data travels encrypted (HTTPS). Access to stored data is restricted. Shared photos are kept in private storage. Payment data never reaches us. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the authorities where the law requires it.
When we change this policy, we publish the new version here with a new date and tell you about important changes before they take effect. If a change affects how shared data is used, we ask you to agree again.