App & website
Privacy notice
This translation is provided for convenience. The German privacy notice is legally authoritative.
1. Controller
TempArts – Pascal Barzewski
Breite Str. 23c
38268 Lengede
Germany
Email: support@whatsthefridge.com
2. App and account data
Registration and sign-in
Registration uses your name, email address, a password stored only as a hash, a verification code, timestamps and security-related failed attempts. Password resets use the email address and a one-time code stored only as a hash. Verification and reset codes expire after 15 minutes and are cleaned up no later than one additional day. Sign-in creates short-lived access tokens and hashed refresh tokens. Refresh tokens expire after no more than 30 days and are removed on sign-out, deletion or a successful password reset. This is necessary to provide and protect your account (Art. 6(1)(b) GDPR) and prevent abuse (Art. 6(1)(f) GDPR).
Google Login
If you choose Google Login, we receive a verified account ID, email address, verification status and potentially your name from Google. Google learns that you are using the sign-in flow for our app. Processing is necessary for your chosen sign-in method (Art. 6(1)(b) GDPR). Google's own privacy information also applies. You may use email sign-in instead.
Household, sync and content
For device and household synchronisation we process household membership, a device identifier, technical revision and operation identifiers, and the stock, storage locations, quantities, units, best-before dates, shopping lists, purchase history, recipes, ingredients, categories and recipe images you provide. Members of the same household can see and change shared content. The legal basis is contract performance (Art. 6(1)(b) GDPR).
Shared shopping activity temporarily contains the acting member's display name. On account deletion, the personal link is removed and names in retained activity are anonymised. Sync operation identifiers are retained temporarily to prevent duplicate updates and protect shared data (Art. 6(1)(b) and (f) GDPR).
Local data
The app is offline-first. Content and unsent changes are also held on your device. Authentication tokens use protected operating-system storage. Confirmed sign-out clears local household data; the app warns before removing unsynchronised changes.
3. Processors and recipients
STRATO
The API and database are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes stored app data and technical connection data as our processor under Art. 28 GDPR.
Resend
Verification and deletion emails are sent through Resend in the United States. Recipient address, message content and delivery metadata are processed to provide and secure the account (Art. 6(1)(b) and (f) GDPR). The processing agreement provides the safeguards required for US transfers, including Standard Contractual Clauses where necessary. Resend retains message and delivery logs for a limited period depending on the plan.
Spaceship Spacemail
Messages sent to support@whatsthefridge.com are handled through Spaceship Spacemail by Spaceship, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA. This includes sender address, content, attachments and message metadata. The basis is Art. 6(1)(b) GDPR for contractual requests and otherwise our legitimate interest in providing support under Art. 6(1)(f) GDPR. Contractual safeguards apply to US transfers.
Open Food Facts
Product and barcode data is requested only by our backend. Your device does not connect directly to Open Food Facts. Only the required barcode query, language and our server IP are sent, not your email or household identifier. Results may be stored in the separate OFF cache. The basis is Art. 6(1)(b) GDPR.
If a valid barcode remains unknown, we store the barcode, an HMAC of your internal account that is unique to that barcode, and optionally the product name you entered to improve catalogue quality. The HMAC contains no email, user or household identifier and cannot be linked across different barcodes. After reports by four distinct accounts, OFF is checked again and the entry may be moderated by an administrator. Incomplete reports are removed after no more than 180 days; HMAC records are deleted on moderation, rejection or a later OFF match. The basis is our legitimate interest in a reliable product catalogue under Art. 6(1)(f) GDPR.
A moderated product name may later be submitted to Open Food Facts only through a deliberate administrator action using a dedicated OFF account. Only the barcode, German product name and server IP are transmitted, never user, household or purchase data.
We do not sell personal data. Other disclosures occur only when needed for the service, legally required or authorised by you. Processing agreements with STRATO, Resend and Spaceship will be concluded and archived before launch.
4. Website and privacy-preserving measurement
The web server briefly processes IP address, time, requested file, status and browser identifier to deliver the website securely (Art. 6(1)(f) GDPR). Regular access logs are normally deleted after seven days; relevant extracts may be kept for up to 30 days to investigate a specific security incident.
The site uses no cookies, local-storage identifiers or third-party analytics. An in-house pixel at behind.whatsthefridge.com measures approximate reach. In memory, the backend creates an HMAC identifier from IP address, date and a secret. Raw IP, user agent and referrer are not stored in analytics. The identifier rotates daily. Daily identifiers are deleted after 31 days; aggregated daily page views and approximate visitor counts remain for 13 months. Access logging for the pixel route is disabled or IP-anonymised. The legal basis is our legitimate interest in measuring and improving public information with minimal data (Art. 6(1)(f) GDPR).
No external webfonts, advertisements, videos or analytics libraries are loaded. Store connections occur only after an official store link is enabled and you open it.
5. Retention and deletion
- Account and active household data: until account deletion or while required by other household members.
- Unconfirmed registrations: code expiry after 15 minutes and cleanup no later than one additional day.
- Refresh tokens: up to 30 days, replaced on rotation and removed on sign-out or deletion.
- Sync idempotency records: 30 days; shared shopping activity: 90 days.
- Recipe images: until replaced, the recipe is deleted or the final household account is deleted; orphaned files are cleaned regularly.
- Support messages: until resolved and normally no more than twelve months afterwards unless statutory duties require longer retention.
Delete your account in the app or through the external deletion page. Login data, tokens, device links and personal associations are removed. Shared data remains for other members but is disconnected from your identity. If you are the final member, the household and images are deleted. Mandatory legal retention duties remain unaffected.
6. Children
Personal accounts are intended for people aged 16 or older. Children under 16 may not create their own account. Supervised use of a household managed by a parent or guardian is possible. The app is not positioned as a children's app and currently contains no advertising.
7. Your rights
Subject to GDPR requirements, you have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent for the future. Contact support@whatsthefridge.com. You may also complain to a data protection supervisory authority. Where processing relies on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation.
8. Security and changes
Measures include transport encryption, hashed passwords and tokens, access control, request and storage limits and data-minimising logs. No system is entirely risk-free. This notice will be updated when features, providers or legal requirements change.