Privacy

This page says exactly what does leave, when, and how to stop it. It is short because there genuinely isn't much.

What stays on your device

Your items, how much of each you have, what you've bought and when, your shopping list, your household name, and your settings. All of it is stored locally and read locally. The predictions are arithmetic that runs on your phone.

Everything that sends data off your device

Nine things, and seven of them wait for you to choose. The two that do not are marked, because a list like this is only useful if it is complete. Each one is separate.

• Backing up. If you attach an email address so your pantry survives a lost phone, we store that address and upload a copy of your shelf.
• Sharing a household. If you share your shelf with the people you live with, it is uploaded so their phones can read it and write to it.
• Which version is asking. Every upload above says which version of the app sent it, so we can tell when an old one is still in use and avoid changing the server in a way that would break it. We count versions, not people: no account, no device and no part of your shelf is attached to that count. It names the app, not you.
• Usage statistics. Off unless you switch it on in Settings. Off is the default, and staying off changes nothing about how the app works.
• Reading a receipt. If you say yes when the scanner asks — the keen read — the shopping lines are sent to be named: the ones that carry a name and a price, and nothing else the till printed. The shop, the date and time and the card row are dropped here on your phone before anything leaves it. The lines go to an AI model reached through a company called OpenRouter, and we store none of it. The photograph itself never leaves. Say no, or leave it off in Settings, and the scanner is put away: nothing is sent, and nothing you have already scanned is touched. Your household's id goes with the lines so the reading can be counted against it — no email and no account are needed for that, and the id is all the server is told about who you are.
• Notes you send us. If you write to us from Settings, we receive the note and what rides with it. Described in full below.
• Looking up a barcode — the iPhone and Android apps only. When you scan a product, the barcode is sent to Open Food Facts, a public food database, which answers with the product's name and size. The request also says which app is asking — “Ullage”, its version, and our support address — because they ask every client to identify itself; that names us, not you. Nothing else goes: they learn that somebody looked up that product, they are not told who, and no part of your shelf goes with it. The web app has no scanner and never asks them anything. Nothing is sent if you add the item by hand instead.
• Opening a shop's website. Tapping Search online — or a shop you have set as a favourite — hands your phone's browser a search address at that shop with the item's name in it, and the browser goes there. From then on it is an ordinary visit to their site: they see the word that was searched for, and everything any website sees when you arrive, including whatever your browser already had for them. Nothing else of your shelf goes, we are not told that you went, and there is no referral or affiliate code in the address. Nothing happens at all unless you tap.
• Crash reports — the exception. The app reports its own crashes without asking, because a crash is the one moment it cannot ask. That is true of all three — the web, iPhone and Android. Your email and IP address are stripped before the report leaves.

What the backup or a shared household contains

• Your household's name, and the name, colour and avatar each member picked
• Your items: what they are, and the size and variety
• Purchase events: which item, when, which member logged it, how many, the brand if a receipt named one, which of your shops it came from, and what it cost
• The shops you've named, and the barcodes you've scanned onto an item
• Corrections: when you told us a prediction was wrong, and what it had predicted
• Your shopping list, and the invite code if you're sharing

No location, no contacts, no payment details: we never ask for them, and the app has no code that reads them. Nor your photo library — Ullage never scans it, never indexes it, and never sees a picture you have not handed it yourself. Payment details means how you pay — a card, an account — and not what a tin of tomatoes cost: prices are listed above because your shelf records them, and none of them is a way to take money from you. The one exception to all of it is a receipt you choose to scan, whether you photograph it or pick it out of your library, which is printed with whatever the till printed on it — that is why the scanner asks first, why it says what it is about to send, and why the photograph itself never leaves the device.

Your email address

Only collected if you attach one, and only used to send you the confirmation code and to let you restore your shelf on a new phone. It is never used for marketing, never sold, and never attached to usage statistics.

Usage statistics, if you turn them on

Each record is one line: which screen or milestone, the platform, the app version, your account id, and the time.

It never includes what's in your pantry, what you bought, your email address, or your location. It is used to see which parts of the app work and which are ignored — nothing else, and it goes to nobody else.

Notes you send us

If you send a note from Settings, we receive what you wrote, which of the four kinds you picked, and — only if you filled it in — an email address to reply to. Alongside it goes your app version, platform, language, whether you have an account, sync status, when it last synced, and how many items and people are on your shelf.

Never the shelf itself: no item names, no shops, no prices. A note is kept until we have dealt with it. Delete all data does not remove one, because that button only clears this device — Delete account does, along with everything else of yours we hold.

Error reports

The web, iPhone and Android versions all report crashes to Sentry so we can fix them, with your email address and IP address stripped out before the report is sent. Each app reports into its own project, so a failure on one is never mixed with a failure on another.

No tracking, no advertising

We do not track you across other apps or websites. There is no advertising identifier, no ad network, no third-party analytics kit, and no data broker. Nothing you do here is joined with data about you from anywhere else. This is why iOS never shows you a tracking permission prompt — there is nothing to ask about.

Who processes it

When data is uploaded it is held in a Postgres database and authentication service operated by Supabase on our behalf, protected by row-level rules so that only members of your household can read your household. They process it for us and for nothing of their own.

Two others are involved, and your phone reaches them differently. Open Food Facts answers barcode lookups, and your phone asks it directly — so their servers see the request arriving from your connection, along with the barcode and the app's own name and version. Nothing of yours. OpenRouter passes a scanned receipt's text to the model that names the items, and it is called by our server rather than by your phone, so it never sees where the receipt came from. Neither is told who you are, and neither is sent anything from your shelf.

How long we keep it

For as long as your account exists. Delete the account and the server copy goes with it, except for a household somebody else is still a member of — that one stays theirs, and your name comes off it.

What you can do about it

• Save a copy of your shelf — Settings. Writes everything on this phone to a file you keep. You can read it back into the app, on any phone, with Import a backup file.
• Delete your account — Settings. Erases the server copy. Your pantry stays on your phone unless you ask for that to go too.
• Delete all data — Settings. Erases everything on this device.
• Stop sharing — Settings. The household stops syncing and the invite code stops working.
• Turn off usage statistics — Settings. They start off, and switching them back off stops new records immediately.

If you are in the EU or UK you also have the right to ask for a copy of your data, to have it corrected, to have it erased, and to object to how it is handled. The first control above gives you the copy of your household — the shelf, the history, the list, everything in the section above. Correcting it is the app itself: every name, size and date is yours to edit. Deleting and objecting are the other controls. What the file does not contain is anything that lives only on our side: the usage statistics, any note you sent us, and the small counters the server keeps to run the thing — how many receipt readings your household has used, and whether it is paying. Write to us and we will send you all of it; deleting your account erases all of it. Settings has a button for it — Ask for everything on the server, beside the one that saves your shelf.

Children

Ullage is a household tool for adults and is not directed at children under 13. We do not knowingly collect anything from them.

Changes

If this policy changes in a way that affects what we collect, the date at the top changes and the app will tell you before the change takes effect.

Contact

Questions about any of this, or a request about your data: privacy@ullage.app.