Privacy policy
The short version
Kitchen stores your email address, the food items you add, who is in your household, and a log of actions taken in the app. It has no advertising, no analytics service, no tracking, and no cookies. We have never sold data and the app contains no code that would let us. The list below is written from the actual database and app source, not from a template — if something is not named here, Kitchen does not collect it.
Who we are
Better Branch Labs LLC, a Colorado limited liability company, is responsible for the data described here. Contact: support@betterbranchlabs.com.
What Kitchen stores about you
Your account
- Your email address and a hashed password. These are held by our authentication provider (Supabase, below). We use the address to identify your account and to send password-reset links. Email confirmation is switched off during the beta, so you will not get a welcome message, and we do not send marketing email at all.
- A record that you accepted the beta terms, with the version and a timestamp. Older acceptances are kept rather than overwritten.
- A display name you choose for yourself within a household, so other members can see who added what. It defaults to nothing and is yours to set.
We do not ask for and have no field for your real name, phone number, address, date of birth, or payment details. Kitchen requests no access to your location, contacts, photos, camera, microphone or health data.
Your household
- The household’s name and when it was created.
- Who belongs to it, each member’s role (owner or member), and when they joined.
- Invite codes — the six-character code, which household it is for, who created it, when, when it expires (seven days), and who redeemed it.
- Container labels, if you use them — a short code and a description you write, like “blue lid, medium”.
Everyone in a household can see everything in that household. Nobody outside it can: the database enforces this with row-level security, not just the app.
Your food items
- Exactly what you typed when you added the item, kept as you wrote it, plus the tidied name shown in the list. If you type something personal into that box, it is stored.
- Which food type Kitchen matched it to, whether it is in the fridge or the freezer, whether it was homemade, from a restaurant or shop-bought, and its current state (active, eaten, thrown out, or unknown).
- Timestamps: when it was added, frozen, and closed out. Any use-by date you set yourself.
- How many portions are left, if you use portions.
A log of what happened (the events log)
Kitchen keeps an append-only log, tied to your household, so the app can show recent activity and weekly totals, and so we can tell whether the app is working. Each entry has a type, a time, sometimes the item it refers to, sometimes who did it, and a small amount of structured detail. The types are:
- Things you did: an item added, eaten, thrown out, removed, returned, cooked, edited, moved to the freezer, thawed, part of it eaten, portions changed, marked still there, and the app being opened.
- Invites: an invite created, an invite redeemed.
- Notifications: one scheduled, one opened, and changes to your reminder preference and time.
- Shelf-life feedback. If you tap Shelf life look wrong?, we store what you originally typed, what Kitchen matched it to, and the date it had calculated. If you then answer What should it be?, the text you write is stored as well. This is the one place the app deliberately keeps a sentence you composed, and it is how the food list gets corrected.
Diagnostics in that same log
Five entry types exist only to tell us whether the app is broken. They are written sparingly — most launches write none of them. Like every entry, they are tied to your household, but their contents are built so that URLs, invite codes, passwords, authentication tokens, email addresses and account identifiers cannot get into them. That rule is enforced by tests, not by good intentions.
| Type | What it contains |
|---|---|
route_trail |
Which screens the app moved through on an abnormal launch, as names from a fixed list, with timings in milliseconds. Nothing else. An ordinary launch records none. |
membership_lookup |
Written only when the check of your household and terms had to be retried: how many attempts, what kind of failure, a database error code, whether the app believed it had a session, and timings. |
js_error |
If the app crashes, the error message and the first few lines of the stack, run through a scrubber that strips anything resembling an email address, URL, token or password, and any value quoted out of a database error, before it is stored. |
add_link |
That the Add screen was opened from the widget or the app icon rather than from inside the app, as a category only — never the link. |
widget_push |
Whether the home screen widget could be updated, how many rows were sent, and how many read back. On a failure it also stores the technical error message, put through the same scrubber as a crash. |
What stays on your phone and never reaches us
- Reminders. Kitchen’s daily reminder is scheduled by your phone, locally. There are no push notifications and no push token, so we cannot send you anything and the reminder’s text — which names your food — never leaves the device.
- The home screen widget. The widget runs as a separate process and reads a copy of a few item names, dates and portion counts from a shared storage area on your device (an Apple “App Group”). That copy lives on the phone only. Signing out clears it.
- Small settings: whether you have seen the intro, your reminder time, and a pending invite code waiting to be used. These sit in the app’s own storage on the device and expire or clear themselves.
Who else receives your data
| Who | What they get, and why |
|---|---|
| Supabase |
Everything described above: the database lives there, and so does account authentication. As the host of the service, Supabase also sees the network requests your app makes, which includes your IP address, and keeps short-term operational logs of them. Supabase also sends the password-reset emails, so it processes your email address to do that. |
| Apple |
Kitchen is distributed to beta testers through Apple TestFlight, so Apple knows which Apple ID installed it and gives us crash reports and install counts under its own terms. Apple does not receive your Kitchen account or your food items from us. |
| Expo / EAS |
We compile the app on Expo’s build service, which receives our source code and signing credentials. The app contains no Expo analytics, no crash reporting and no over-the-air update service, so no data about you is sent to Expo while you use Kitchen. |
| Amazon |
Only if the Alexa feature is used — see below. Amazon processes the spoken request and the transcription, under Amazon’s own privacy terms. |
| Cloudflare |
This website is served by Cloudflare, which sees the IP address and request of anyone who visits it, as any web host does. The site has no cookies, no analytics and no third-party scripts, and it does not turn on Cloudflare’s request logging. Cloudflare keeps its own short-term operational records in order to run and secure its network, under Cloudflare’s privacy policy. |
Your data is stored with Supabase in the United States.
That is the complete list. There is no advertising network, no analytics product, no crash-reporting SDK and no data broker involved at any point.
The Alexa feature
Kitchen can accept “add to my kitchen” through an Amazon Alexa skill. During the beta this is configured for a single household — the developer’s own — and is not available to testers, but because it exists in the code it is described here.
When it is used, Amazon handles the speech and sends our server the transcribed words. Our server ignores any account information in Amazon’s request: which household and user the item belongs to comes from our own server configuration, never from the request, so a forged request cannot write into somebody else’s household. We verify every request is genuinely from Amazon for our skill before acting on it, and we do not log request bodies, because those carry Amazon’s device and user identifiers. Items added this way are marked as having come from Alexa and are otherwise ordinary food items.
Invite links
An invite link contains a household invite code in its address. If you open one without Kitchen installed, you land on a page on this site that reads the code and offers to hand it to the app. That page sends the code nowhere. It has no analytics and no third-party scripts, and it is served with caching and referrer-sharing turned off. Because the code is part of the address, anything that carries the request sees it: your own browser history, and Cloudflare, which keeps short-term operational records to run and secure its network under its own privacy policy. We do not turn on request logging for this site. An invite code is single-use, expires after seven days, and only ever grants access to the one household it was made for.
How long we keep things
Your account, household and items are kept until you ask us to delete them. The events log is append-only and is kept for the life of the household, because the app’s own history and weekly figures are built from it. Deleting a household removes its items, containers and invites along with it. Diagnostic entries are not treated differently from any other entry in the log; they are simply very few.
Deleting your data
There is no in-app delete button yet — this is a beta, and we would rather do it by hand and confirm it than ship a half-finished one. Email support@betterbranchlabs.com and say what you want:
- Delete my account. We remove your login and your membership of any household. We will confirm by email before doing anything, and tell you when it is done.
- Delete my household and everything in it. We remove the household, its food items, its containers, its invites and its events log. If other people are in that household, we will check with them first.
- Just take me out of this household. We remove your membership and leave the household itself alone.
- Send me a copy of my data. We will export what is listed above and send it to you.
We aim to answer within a few days and to complete deletions within 30 days. Depending on where you live you may have rights to access, correct, export, restrict or delete your data, and to complain to a data protection authority; the address above is how to exercise any of them, and we will not ask you to justify the request.
Children
Kitchen is not designed for or directed at children, and we do not knowingly create accounts for anyone under 13. If you believe a child has an account, email us and we will remove it.
Security
Traffic between the app and our server is encrypted. Passwords are stored only as hashes, by our authentication provider. Access to a household is enforced in the database itself by row-level security rules — an app bug or a modified client cannot read another household’s data, because the database refuses regardless of who is asking. We cannot promise a system is unbreachable, and we will tell affected users promptly if we learn of a breach.
Changes to this policy
If what we collect changes, this page changes with it and the date at the top moves. For anything that materially affects testers, we will say so by email or in the app rather than quietly editing the page.
Contact
Better Branch Labs
support@betterbranchlabs.com