Privacy Policy

FridgeFit (“we”, “us”) is operated by Pablo Álvarez García. We are the controller of the personal data described here. You can reach us at fridgefit@palvarezapps.com.

We only collect what the app needs to work:

• Account data: your email address and, if you sign in with Google or Apple, the name and profile picture those providers share with us. Passwords are handled by our authentication provider and stored only as a secure hash; we never see them.
• Profile and body data you enter: display name, gender, age, height, weight, goal (lose, maintain or build), diets, allergies or intolerances, cooking skill, preparation time, activity level and language. We use it to calculate your calorie and macro targets and to personalize recipes.
• Nutrition records: the meals you log (dish name, meal type, servings, calories, protein, carbs, fat, notes and date/time) and your calculated nutrition goals.
• Fridge photos and ingredient lists: the photos you scan and the ingredient lists you edit, sent to generate recipes (see the next section).
• Technical data: standard server logs (such as IP address, browser and request time) and aggregated, cookie-free usage statistics from Vercel Analytics. The app also keeps your settings and progress in your device’s local storage.

Some of this information (weight, allergies, goals) can relate to your health. We treat it as sensitive and use it only to provide the features you ask for.

Please don’t photograph people, documents or anything private. AI results can be wrong, so they are suggestions only (see our Terms). Scanning is optional: you can use the rest of the app without it.

To illustrate recipes we search Unsplash using dish keywords generated by the AI. No personal data or photos are sent to Unsplash.

• To create and secure your account, and to keep you signed in.
• To calculate your targets, generate recipes, and show your food log and weekly progress.
• To operate, protect and improve the service (fixing bugs, preventing abuse and excessive use of the AI features).
• To answer your support requests and to comply with legal obligations.

Legal bases (EU/EEA/UK): performing our contract with you (account, recipes, food log); your explicit consent for health-related data you choose to provide and for sending your photos to Gemini — you can withdraw it at any time by deleting the data or your account; and our legitimate interests in security and service improvement.

We do not sell your personal data, we do not show third-party ads, and we do not use your data for advertising profiles.

We use a small number of service providers who process data on our behalf:

• Supabase — authentication and database (your account, profile, nutrition goals and food log).
• Google — Gemini AI for photo and ingredient analysis, and Google Sign-In if you choose it.
• Apple — Sign in with Apple, if you choose it.
• Vercel — hosting and aggregated analytics.
• Unsplash — recipe images, using dish keywords only.

We may also disclose data when the law requires it or to protect the rights and safety of our users.

Our providers may process data outside your country, including in the United States. Where required, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.

We keep your account, profile, nutrition goals and food log while your account exists. When you delete your account, that data is removed from our servers right away (see Delete account). We keep only a minimal record of the request — your account ID and the date — as proof that the deletion happened, plus the number of free scans you used, linked only to a one-way hash of your email, to prevent abuse of the free scan allowance (legitimate interest). Encrypted provider backups may take a limited time to be overwritten.

Depending on where you live (for example under the GDPR or UK GDPR) you have the right to:

• access the data we hold about you and receive a copy;
• correct inaccurate data (most of it can be edited directly in the app’s Profile tab);
• delete your data or your whole account;
• object to or restrict certain processing, and withdraw consent at any time;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, email fridgefit@palvarezapps.com. We reply within 30 days. Account deletion is also available in the app under Profile → “Delete account & my data”.

Data is encrypted in transit (HTTPS) and protected in the database with row-level security, so each user can only read and change their own records. Our AI and admin keys live only on the server. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires it.

FridgeFit is not intended for people under 18, or under the minimum age required in your country to consent to data processing. If you believe a child has given us personal data, contact us and we will delete it.

If we make material changes we will update the date above and, where appropriate, notify you in the app or by email before they take effect.

Questions about privacy? Write to fridgefit@palvarezapps.com or visit our support page.