Privacy

Ullage keeps your pantry on your phone. Not on our server, not in an account you have to make first — on the device in your hand. Most people can use the whole app without any data ever leaving it.

This page says exactly what does leave, when, and how to stop it. It is short because there genuinely isn't much.

What stays on your device

Your items, how much of each you have, what you've bought and when, your shopping list, your household name, and your settings. All of it is stored locally and read locally. The predictions are arithmetic that runs on your phone.

Everything that sends data off your device

Seven things, and six of them wait for you to choose. The seventh is marked, because a list like this is only useful if it is complete. Each one is separate.

• Backing up. If you attach an email address so your pantry survives a lost phone, we store that address and upload a copy of your shelf.
• Sharing a household. If you share your shelf with the people you live with, it is uploaded so their phones can read it and write to it.
• Usage statistics. Off unless you switch it on in Settings. Off is the default, and staying off changes nothing about how the app works.
• Reading a receipt. If you say yes when the scanner asks — the keen read — the shopping lines are sent to be named: the ones that carry a name and a price, and nothing else the till printed. The shop, the date and time and the card row are dropped here on your phone before anything leaves it. The lines go to an AI model reached through a company called OpenRouter, and we store none of it. The photograph itself never leaves. Say no, or leave it off in Settings, and the scanner is put away: nothing is sent, and nothing you have already scanned is touched. Your household's id goes with the lines so the reading can be counted against it — no email and no account are needed for that, and the id is all the server is told about who you are.
• Notes you send us. If you write to us from Settings, we receive the note and what rides with it. Described in full below.
• Looking up a barcode — the iPhone and Android apps only. When you scan a product, the barcode — and nothing else — is sent to Open Food Facts, a public food database, which answers with the product's name and size. They learn that somebody looked up that product; they are not told who, and no part of your shelf goes with it. The web app has no scanner and never asks them anything. Nothing is sent if you add the item by hand instead.
• Crash reports — the exception. The web app reports its own crashes without asking, because a crash is the one moment it cannot ask. Your email and IP address are stripped before the report leaves. The iOS and Android apps report to nobody.

What the backup or a shared household contains

• Your household's name, and the name, colour and avatar each member picked
• Your items: what they are, and the size and variety
• Purchase events: which item, when, which member logged it, how many, the brand if a receipt named one, which of your shops it came from, and what it cost
• The shops you've named, and the barcodes you've scanned onto an item
• Corrections: when you told us a prediction was wrong, and what it had predicted
• Your shopping list, and the invite code if you're sharing

No location, no contacts, no payment details: we never ask for them, and the app has no code that reads them. Nor your photo library — Ullage never scans it, never indexes it, and never sees a picture you have not handed it yourself. Payment details means how you pay — a card, an account — and not what a tin of tomatoes cost: prices are listed above because your shelf records them, and none of them is a way to take money from you. The one exception to all of it is a receipt you choose to scan, whether you photograph it or pick it out of your library, which is printed with whatever the till printed on it — that is why the scanner asks first, why it says what it is about to send, and why the photograph itself never leaves the device.

Your email address

Only collected if you attach one, and only used to send you the confirmation code and to let you restore your shelf on a new phone. It is never used for marketing, never sold, and never attached to usage statistics.

Usage statistics, if you turn them on

Each record is one line: which screen or milestone, the platform, the app version, your account id, and the time.

It never includes what's in your pantry, what you bought, your email address, or your location. It is used to see which parts of the app work and which are ignored — nothing else, and it goes to nobody else.

Notes you send us

If you send a note from Settings, we receive what you wrote, which of the four kinds you picked, and — only if you filled it in — an email address to reply to. Alongside it goes your app version, platform, language, sync status, and how many items and people are on your shelf.

Never the shelf itself: no item names, no shops, no prices. A note is kept until we have dealt with it. Delete all data does not remove one, because that button only clears this device — Delete account does, along with everything else of yours we hold.

Error reports

The web version reports crashes to Sentry so we can fix them, with your email address and IP address stripped out before the report is sent. The iOS app reports crashes to nobody: failures are written to the device's own log and stay there.

No tracking, no advertising

We do not track you across other apps or websites. There is no advertising identifier, no ad network, no third-party analytics kit, and no data broker. Nothing you do here is joined with data about you from anywhere else. This is why iOS never shows you a tracking permission prompt — there is nothing to ask about.

Who processes it

When data is uploaded it is held in a Postgres database and authentication service operated by Supabase on our behalf, protected by row-level rules so that only members of your household can read your household. They process it for us and for nothing of their own.

Two others are involved, and your phone reaches them differently. Open Food Facts answers barcode lookups, and your phone asks it directly — so their servers see the request arriving from your connection, along with the barcode and nothing else. OpenRouter passes a scanned receipt's text to the model that names the items, and it is called by our server rather than by your phone, so it never sees where the receipt came from. Neither is told who you are, and neither is sent anything from your shelf.

How long we keep it

For as long as your account exists. Delete the account and the server copy goes with it, except for a household somebody else is still a member of — that one stays theirs, and your name comes off it.

What you can do about it

• Delete your account — Settings. Erases the server copy. Your pantry stays on your phone unless you ask for that to go too.
• Delete all data — Settings. Erases everything on this device.
• Stop sharing — Settings. The household stops syncing and the invite code stops working.
• Turn off usage statistics — Settings. They start off, and switching them back off stops new records immediately.

If you are in the EU or UK you also have the right to ask for a copy of your data, to have it corrected, to have it erased, and to object to how it is handled. The controls above do most of this instantly; for anything they don't cover, write to us.

Children

Ullage is a household tool for adults and is not directed at children under 13. We do not knowingly collect anything from them.

Changes

If this policy changes in a way that affects what we collect, the date at the top changes and the app will tell you before the change takes effect.

Contact

Questions about any of this, or a request about your data: privacy@ullage.app.