Effective 3 September 2026.(Previous version 23 August 2026. What changed:
Instagram (Meta) is now named as a service that reads a link you import a recipe
from; RevenueCat, a subscription-management SDK that is bundled but switched off
and sends nothing, is now disclosed; and Recipe ideas is described accurately —
it sends how soon each food expires as well as its name.)
Ambry is made by one person, Everett Yan. This policy says what the app stores,
what leaves your phone, and what you can delete. It is written to be read, not to
be survived — if something here is unclear, email me and I will fix the wording.
Contact: everettyan@gmail.com
The short version
Ambry keeps your kitchen inventory so you can share it with your household and
get told before food goes off. That is the whole point, and it is the whole
reason data is stored.
Photos of receipts and groceries are never stored. They pass through the
server to an AI provider, which reads the item names off them, and are gone the
moment the request finishes.
There is no analytics SDK, no advertising, and no tracking of any kind, and
nothing is ever sold or shared with data brokers.
You can delete your account, and everything that is only yours, from inside the
app.
What Ambry stores
Your account
The email address you sign up with. If you use a password, only a hash of
it is stored — never the password itself, and I never see it.
If you sign in with Apple or Google instead, there is no password to store:
the provider confirms it is you and hands Ambry an email address and an
identifier for your account with them. If you use Apple’s Hide My Email,
that relay address is the only address Ambry ever has, which is the point of
it.
A user id — a random identifier that ties your data to your account — and
the sign-in sessions that keep you signed in on your devices.
A display name, if you set one, so housemates can tell who is who. Signing
in with Apple can fill it in for you the first time, if you let it.
The date the account was created.
Since 23 August 2026 the sign-in system runs on Ambry’s own server rather
than a third-party sign-in service, and its records live in the same database as
everything else described here. No identity vendor holds your account.
What you put in the app
Everything you enter or capture into your kitchen: food items and where they are
stored, the storage locations and zones you create, expiry dates, stock status,
grocery list entries, notes, household names and invite codes, and your recipes —
titles, ingredients, steps, tags, and any recipe photo you add.
Two things about this data are worth being explicit about:
Household data is shared with your household. Everyone you invite to a
household can see and change its inventory, list, and locations. That is what a
shared household is.
Recipe photos are stored (unlike receipt photos — see below), because a
recipe without its photo is not much of a recipe. They live in Cloudflare R2
storage under an unguessable key. If you set a recipe to public, its photo
and contents become visible to every signed-in Ambry user in the community
feed. Private and household recipes are not.
Settings and housekeeping
Your notification preference, and — if you turn on reminders that arrive from
the server rather than from your own phone — a device push token so the
notification can reach you, and your phone’s time zone, which is the only
way the server can know when 8am is where you are. Turning reminders off
clears the token. Separately, when the app asks the server to fill in expiry
dates for items you just added (the shelf-life estimate), it sends your
phone’s time zone with that request so the dates are counted on your
calendar day; the server uses it for that one calculation and does not store
it.
Your plan (free or Ambry Plus) and, so the monthly AI allowance can be counted,
a ledger row per AI request holding your user id, the kind of request, a
timestamp, and — for the kinds that read a list, like a receipt scan or a
recipe import — how many items came back. The ledger never contains the
photo, the link, or the extracted text.
What Ambry does not store
Receipt, grocery, and cookbook photos. They travel from your phone through
the server to the AI provider and are discarded when the response comes back.
Nothing is written to storage, and no image is written to any log.
Prices, totals, store names, or card details from your receipts. The
extraction deliberately asks only for food names, categories, and (optionally)
the purchase date. Price tracking is not a feature, and if it ever becomes one
this policy changes first.
Your location. Ambry never asks for it.
Your contacts, calendar, or photo library at large. The photo picker hands
the app exactly the one image you choose, and nothing else.
Payment details. Nothing is for sale in this build. When subscriptions
arrive, Apple takes the payment and I receive a confirmation that you are
subscribed, never a card number. A subscription-management SDK (RevenueCat) is
bundled but is switched off and sends nothing; before that changes, this policy
and the table below will say what it receives.
Behavioural analytics. No analytics or advertising SDK is present. A
crash-reporting library is bundled but is switched off and sends nothing; if
that ever changes it will report diagnostics only, and this policy will say so
before it ships.
AI processing
Some Ambry features work by sending your input to an AI model. In every case:
The provider is Anthropic (Claude). Requests go through Anthropic’s
commercial API, whose terms state that inputs and outputs are not used to
train models.
The call is made by the server, never by the app — the API key never
reaches your phone.
Nothing about who you are travels with the content. The provider gets the photo
or the text, not your email or your household.
The features that do this:
Receipt and grocery photo scanning — the image is sent so item names can be
read off it, then discarded (see above).
Shelf-life estimates — the name of a food is sent so a typical shelf life
can be estimated, and the answer is saved to the shared food catalog so nobody
has to ask twice.
Recipe ideas — a summary of what is in your kitchen (food names and how
soon each one expires) is sent so recipes can be suggested.
Recipe import — a link you import is fetched by our server, and its text
may be sent to our AI provider to extract the recipe. A cookbook photo you
import is treated exactly like a receipt photo: sent, read, discarded.
Other services Ambry relies on
Service
What it does
What it gets
Neon
Hosts the database, including the sign-in records
Your account and everything you save
Cloudflare
Runs the API and the sign-in service itself, stores recipe photos, syncs households live
Requests you make; your sign-ins; recipe photos
Anthropic
The AI model behind the features above
Only the content described above
Open Food Facts
Looks up products you scan by barcode
Only the barcode digits — no user, household, or device information
Expo
Delivers the daily reminder to your phone, on to Apple’s push service
Only while server reminders are on: this device’s push token and the text of the notification, which names the food that is going off
Apple
Distributes the app, handles any subscription, and — only if you tap Sign in with Apple — confirms it is you
Whatever Apple’s own terms describe; I see no payment details. For sign-in: Apple learns you use Ambry, and returns an email address (or a Hide My Email relay) plus, on the first sign-in only, your name
Google
Confirms it is you — only if you tap Sign in with Google
That you signed in to Ambry; it returns your email address and profile name, and nothing about your kitchen goes the other way
RevenueCat
Would manage subscriptions — switched off today, because nothing is for sale in this build
Nothing at all today. When subscriptions go live it receives your Ambry user id and the App Store purchase receipt — never your card number, and nothing about your kitchen. This row changes before that build ships
YouTube (Google)
Reads the description of a YouTube link you import a recipe from
Only the video’s id, sent from our server — never your account, household, or device information
TikTok
Reads the public caption of a TikTok link you import a recipe from
Only the link you pasted, sent from our server — never your account, household, or device information
Instagram (Meta)
Reads the public caption of an Instagram link you import a recipe from
Only the link you pasted, sent from our server — never your account, household, or device information. You are never signed in to Instagram on our behalf
Ambry also uses public food data from Open Food Facts (product names, photos
and nutrition, under ODbL/CC-BY-SA — credited in the app wherever it is shown)
and from the USDA (FoodData Central and FoodKeeper, public domain). None of
that involves your data going anywhere.
Deleting your account and your data
Open Profile → Delete account in the app. It asks you to type DELETE, and
then it is immediate and permanent — there is no undo and no grace period.
What goes: your profile and sign-in, all of your recipes including any you
published, your recipe photos, and any household where you are the only member,
with everything in it.
What stays: households you share with other people — they keep the pantry, the
list, and the locations, and you are simply removed. Recipes other people wrote
are theirs and are untouched.
Two things worth knowing:
If you own a household that other people still use, Ambry asks you to transfer
ownership first, so their kitchen does not disappear with your account.
Deleting your account does not cancel an Apple subscription. Cancel it in
the App Store, or you will keep being billed. The app links you straight there.
If you would rather not do it in the app, email everettyan@gmail.com from the
address on the account and I will delete it by hand.
Security
Every table in the database denies access by default and opens only to the rows
you are entitled to — your household’s data, your own recipes, plus public
recipes. All traffic is HTTPS. AI provider keys live only as server secrets and
are never in the app you download.
No system is perfect, and I am one person. If you find something wrong, email me
before telling the internet and I will fix it quickly.
Children
Ambry is not directed at children under 13 and does not knowingly collect their
data. If you believe a child has created an account, email me and I will delete
it.
Changes
If this policy changes materially, the effective date at the top changes and the
new version is published here before the change takes effect. Its full history is
in the repository’s git log, which is public.
Contact
everettyan@gmail.com — questions, deletion requests, or corrections to this
page.