Privacy Policy

Last updated and effective: September 27, 2026

Maksim Yaromau, Individual Entrepreneur, Georgia IP No. 302239897, 70 M. Tsinamdzgvrishvili street, Georgia, is responsible for In My Fridge (we/us). Contact us about privacy or support at Yaromaum@gmail.com.

This policy covers the iOS app, inmyfridge.app, its recipes and guides, legal and support pages, and supporting services. The public website can be browsed without an account. The app offers Sign in with Apple and, where available, Continue as Guest. Guest use creates a device-local identifier and does not make analytics or network requests anonymous. Account-dependent features may require Sign in with Apple. Terms: https://inmyfridge.app/terms

Plus dictation can add ingredients, equipment and shopping items. The current app uses Apple's on-device speech recognition and local interpretation. You review and edit suggestions before saving. Microphone and speech permissions are optional and can be revoked in iOS Settings.

When local interpretation is uncertain or finds no usable catalog match, the app asks for your permission before sending text through our authenticated backend to OpenAI. This applies to voice transcripts and text you type when searching for an equipment model. The request contains the text, language and a request identifier where applicable, not your email, Apple identifier, push token, complete inventory or dietary preferences. Choose On-device only to keep these features local; declining does not send the text to OpenAI. You can change this choice in Settings > AI assistance. The app does not send microphone audio to our backend or OpenAI. We do not persist or log audio or raw transcripts.

The backend requests that OpenAI not store the response as application state. Separate provider security and abuse-monitoring retention may still apply; we do not promise zero retention. Provider information: https://developers.openai.com/api/docs/guides/your-data

The current app has no camera, photo-library, receipt or barcode input feature. Recipe nutrition values are estimates, not a personal health record.

Our website serves public recipes, guides and product information. Hosting and security providers process IP addresses, user agents, requested URLs, timestamps, response status and related diagnostics to deliver and protect pages. Avoid putting private information into URLs. With your permission, a separate PostHog project measures website visits, public pages viewed, reading engagement, navigation, search result counts, filters, app-button impressions and clicks, support-link clicks, generic errors and page performance. It uses a pseudonymous browser identifier in local storage and a session identifier, campaign labels and broad referral categories. We do not send raw search text, email contents, account credentials, URL query strings or full referrer URLs. Session recording, advertising pixels and automatic form-content capture are disabled. IP location enrichment is disabled for website analytics; providers still process network addresses to receive requests.

Analytics remain off until you choose Allow analytics. You can decline or withdraw through Privacy choices in the footer. Withdrawal stops collection and clears the analytics identifier on that browser. Your choice is remembered for up to 180 days. Do Not Track and Global Privacy Control signals keep analytics off. Optional website analytics rely on consent; declining does not restrict site access. Hosting may use necessary security cookies, and browsers may cache assets. External links follow destination policies.

Optional notifications and Live Activities use Apple services. For server-assisted delivery, our backend receives an account identifier, device or activity push token, language/app version and, for timers, a timer identifier and completion time. Timer information can appear on your Lock Screen. You can control notifications and Live Activities in iOS Settings. Opening legal pages inside the app makes an ordinary website request; app credentials and kitchen inventory are not included in that request.

Where a website email-request form is offered, we store the email address, selected purpose (launch notification or invitation to confirm a kitchen newsletter), language, source page and consent version/time. These choices are separate from app sign-in and website analytics. Submitting a request does not itself send a newsletter. Withdrawal and deletion requests can be sent to Yaromaum@gmail.com from the address used. Pending requests older than 180 days and expired hashed abuse counters are removed when the service next processes an accepted request; this is not an automatic daily deletion promise. Email addresses and form contents are excluded from analytics.

We use Apple for identity, on-device speech, notifications and App Store services; Adapty for subscription profiles, offers, purchases and entitlements; PostHog for app and optional website analytics; Sentry for crash and reliability diagnostics; and OpenAI for the limited text assistance described above. Hosting and delivery include Hetzner for the app backend and Cloudflare/OpenAI Sites and Vercel for website delivery; our email provider handles support correspondence. Older distributed builds may still use RevenueCat for purchases until updated; its historical purchase records are subject to the same purpose and retention limits. Relevant information may also be disclosed to advisers, authorities or successors where legally required or necessary to protect rights or complete a business transfer.

We do not sell personal data for money or use it for cross-company advertising tracking. We and our providers may process data outside your country, including in countries with different privacy laws. Applicable transfer safeguards are required where law demands them.

Local information remains until you, the app or iOS removes it. Server account data is retained while needed to operate your account. Operational request metadata, deletion-operation records, security logs and backups may remain for security, recovery and legal needs. We do not promise that every backup or operational log is erased immediately or on a fixed short schedule. Support correspondence and purchase records may remain as needed for support, accounting, fraud prevention and legal obligations.

Choose Settings > Delete account in the app and confirm to initiate deletion of your account, associated server data, credentials and app data on that device. Limited deletion-confirmation, security, billing and legally required records may remain. You can also contact us about deletion. Deleting an account or app does not cancel an Apple subscription; manage it through Apple.

Deleting an app account does not automatically cancel Apple billing or prove immediate deletion from every independent provider, operational log or backup. Provider-held analytics, diagnostics and purchase records are handled according to applicable duties, deletion requests and provider controls. A guest can remove device-local records through the available account/data controls or by removing the app; contact us about remaining provider records. We may need identifiers you can supply to locate pseudonymous records, but will not request your Apple password or verification codes.

Where applicable, we rely on performance of our agreement for requested features and purchases, legitimate interests for proportionate security and reliability work, consent when required for optional processing, and legal obligations for required records. Device permission is not a blanket consent to unrelated processing.

Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection, information about sharing, and withdrawal of consent without affecting earlier lawful processing. Under Brazil's LGPD, this may also include confirmation of processing, anonymization or blocking of unnecessary or unlawful data and review of qualifying solely automated decisions. Contact Yaromaum@gmail.com; we may proportionately verify identity and will handle requests within applicable legal deadlines. You can complain to your competent privacy authority, including Brazil's ANPD. Information: https://www.gov.br/anpd/pt-br/assuntos/titular-de-dados/direito-dos-titulares

For people in the EEA or UK, applicable rights include complaining to the supervisory authority where you live or work, and objecting to processing based on legitimate interests. For Brazil, rights include information about recipients and the consequences of refusing consent. Where applicable US state privacy laws apply, you may exercise access, correction, deletion and portability rights and request review of a denied request without unlawful discrimination. We do not use personal data for targeted advertising or make solely automated decisions producing legal or similarly significant effects. Contact us for information about the safeguards applicable to an international transfer; no particular certification or transfer agreement is represented as already verified by this policy.

We use safeguards including protected device storage, Keychain credentials, encryption in transit, access controls and log redaction. No system is completely secure. The service is intended for people aged at least 13 and meet any higher applicable local minimum age for independent use. Contact us if a child has provided data without required permission.

We may update this policy, publish a new effective date and provide additional notice when required. English, Russian and Brazilian Portuguese versions are provided for their respective audiences; mandatory local privacy rights always apply.