Pantry Ally Privacy Policy

Effective date: November 4, 2026
Who we are: Pantry Ally, a Canadian service for households.
Privacy Officer (person in charge of the protection of personal information): Privacy Officer, Pantry Ally, [email protected]. Send any privacy request or question here: access, correction, deletion, withdrawing consent, or a complaint. The Privacy Officer is accountable for Pantry Ally's compliance with this policy.
Developer name on Google Play: PantryAlly.

Pantry Ally helps Canadian households track their pantry, grocery budget and calories. This policy explains in plain language what we collect, why, where it goes, and your choices. We follow Canada's federal private-sector privacy law (PIPEDA) and its 10 fair information principles.

1. What we collect

Account: your email address.
Household: the household you create and the family members you add.
Pantry: the food items you add, with quantities and estimated best-by dates.
Budget: your grocery budget and what you record spending.
Calories and meals: the meals and calories you log, and your daily calorie goal.
Shopping list and cuisine picks: the items on your shared list and the cuisines you choose.
Sage usage counts: monthly and daily counts of how often Sage is used (counters only). We don't store your Sage chats, except replies you choose to report (section 7).
Receipt photos, only when you choose to have Sage read them: the photo is sent for reading and is not stored by us (section 5). We keep a monthly count of receipts read, for plan limits. The items and totals you confirm are saved as pantry and budget entries.
Drinks and supplements you add: the names of drinks (My Bar) and supplements (My Supplements) you add, with the place, amount and dates you choose to enter. We store them with your household like pantry items. Supplement names can reveal health information, so we treat them as sensitive.
Names we don't recognise: if you tap "Ask us to add it" on a name that isn't in our lists, the name is saved on your phone only. It is not sent to us or to Sage.

We collect only what we need for the purposes below.

2. How receipts and voice are handled

Receipts, by default, are read on your phone. If you don't switch on "Let Sage read this receipt", the phone reads the text itself and the photo is not uploaded.
When you switch on "Let Sage read this receipt" (signed in) and tap Take photo or Choose photo:
- The app sends one copy of the photo through our server function in Canada (ca-central-1) to Google Gemini, which reads the items, prices and totals. That Gemini processing happens in the United States.
- We don't keep the photo or the text Gemini returns in our database. They may be kept in our Google Gemini project logs for up to 7 days for debugging, in the United States, then deleted (section 5). The copy on your phone is deleted after reading. Nothing is saved until you tap Confirm.
- Google's own handling is in section 5.
Voice is turned into text on your phone. The app is built so speech is recognised on your device and we don't upload audio. The app asks your phone for on-device recognition only, with no cloud fallback: if on-device recognition isn't available or fails, the mic turns off and you type instead. Voice audio stays on your phone; only the recognised text goes to Sage.
When Sage listens. If you have agreed to voice, Sage is on and your phone has a working mic, Sage starts listening when you open Sage's screen. It stops after about 10 seconds without speech, or when you leave the screen or the app. Without your agreement it never listens; it shows the consent screen instead.
Sage chat has no photo feature and is not built to receive images or audio. We use receipt photos only for receipt reading.

3. Why we use it (purposes)

To run your account and shared household.
To show your pantry, expiry estimates, budget and calorie totals.
To read a receipt you choose to scan, so you can check the items and add them to your pantry and budget, and to count receipt reads for plan limits.
To answer your questions through Sage (Premium), and to count Sage usage for plan limits.
To send account emails (sign-in, security, important notices).
To keep the service secure and fix problems.

We do not sell your personal information. We use it only for these purposes unless you agree otherwise or the law requires it.

4. Consent

By creating an account you agree to the uses in this policy. We ask before any new purpose. Receipt reading by Sage needs your separate, express consent. Only users 18 or older can use it (section 6). Before your first receipt photo is sent, the app shows a one-time notice: the photo is sent to and processed by a service in the United States that works for Pantry Ally, Pantry Ally doesn't store the photo, and the notice links to this policy, which names the provider (Google Gemini) and explains how long it keeps the photo (sections 5 and 7). No photo is sent unless you tap "I agree"; if you tap "Not now", nothing is sent and you can add the items by hand. After that, each scan has a "Let Sage read this receipt" switch: turn it off and that receipt is read on your phone only. You can withdraw consent at any time by deleting data in the app or requesting account deletion (section 9); some features will then stop working. The account holder who adds family members should have their agreement to do so.

5. Where your data is stored and processed (cross-border)

Some of your information is processed outside Canada and outside Quebec, by the service providers named below. By using these features you are told of this in advance, and for receipt photos you give separate consent (section 4).

Database: Supabase, hosted in Canada (Central; AWS ca-central-1).
Server functions: Our server function (for Sage chat and receipt reading) runs in Canada (ca-central-1), next to our database. Google Gemini processing happens in the United States.
AI, Sage chat: When a Premium user uses Sage, the app sends, as text only: your chat message; the last 4 turns of that conversation (shortened); if you speak, the text options your phone's speech recognition produced; your pantry item names, amounts and days left; your shopping list; today's meals and calories against your goal; your cuisine picks; and matching recipes. It never sends prices, your budget, stores, names or account ids. Audio is not sent. This goes to our server function in Canada (ca-central-1), which passes it to Google Gemini, acting as our service provider, to generate the reply. That Gemini processing happens in the United States. We don't store your Sage chats in our database, except replies you choose to report (kept 1 year, section 7); otherwise we keep only monthly and daily usage counts. The text sent may be kept in our Google Gemini project logs for up to 7 days for debugging, in the United States, then deleted.
Drinks and supplements in Sage: names of drinks and supplements you add or say may be sent to Sage's service (Google Gemini, through our server function in Canada; processed in the United States) only to carry out your request. They are sent as the item name only: no dose, no dates. Our server function does not log the text of your request. Google, our Sage service provider, may keep requests for up to 7 days in our project's logs, and separately for abuse monitoring as described below. Because we use Google's paid Gemini API tier, Google does not use this data to train its models (Gemini API Additional Terms of Service, https://ai.google.dev/gemini-api/terms; logging: https://ai.google.dev/gemini-api/docs/logs-policy; accessed 1 Nov 2026). We don't use these names for ads or to give you health or medical advice. Sage does not give advice about doses, medicines or drinking. If you report a Sage reply, the saved report can include drink or supplement names (section 7).
AI, receipt reading: when you choose it, one receipt photo goes through our server function in Canada (ca-central-1) to Google Gemini, acting as our service provider, and is processed in the United States. We don't keep the photo or the result in our database. The receipt photo and the text extracted from it may be kept in our Google Gemini project logs for up to 7 days for debugging, in the United States, then deleted.
What Google does with it: Google retains prompts (including files such as images) and outputs for up to 55 days to detect and prevent abuse and for legal disclosures; it may store this data transiently or cache it in any country where it or its agents have facilities. Under Google's paid Gemini API terms, Google does not use this content to improve its products or train its models.
Email: sent through Resend, acting as our service provider. Resend stores email content, delivery logs and account records in the United States and keeps email data for 30 days (section 7).

When information is processed outside Canada, it is subject to the laws of that country and may be accessed by its courts, law enforcement and national security authorities. We remain responsible for your information while service providers process it for us, and we rely on their written terms (for Google, its Gemini API terms and Data Processing Addendum) to require protection. Before sending information outside Quebec we assess the risks, as Quebec law requires.

6. Children and family members under 18

Google's Gemini API terms do not permit use by people under 18, so Sage, including Sage reading receipts, is only for users 18 or older. The app asks for an age check before Sage or Sage receipt reading can be used. We don't knowingly send information about anyone under 18 to Gemini; if we learn that has happened, please tell the Privacy Officer and we will act on it. They can still use the pantry, budget and calorie features through the household, and the phone can still read receipts on its own.

7. How long we keep it (retention)

We keep your information while your account is active and only as long as needed for the purposes above.

Sage chats: not stored in our database, except replies you report (below); the text sent may sit in our Google Gemini project logs for up to 7 days (see section 5).
Receipt photos: not kept in our database. The phone copy is deleted after reading, and our server function does not keep the photo or the result. The photo and the text extracted from it may be kept in our Google Gemini project logs for up to 7 days for debugging, in the United States, then deleted. Separately, Google keeps abuse-monitoring logs for up to 55 days (section 5).
Receipt-read counts (how many receipts you had read each month): kept for 90 days, then deleted automatically, or sooner if you delete your account.
Sage usage counts: kept with your account and deleted with it.
Sage replies you report (the reply, your question if included, your reason and note; these can include drink or supplement names you mentioned): kept for 1 year so we can review them, then deleted automatically, or sooner if you delete your account.
Account emails: our email provider, Resend, keeps email content, delivery records and logs for 30 days, in the United States, then deletes them.
Account and household data: kept until your account or household is deleted (see section 9). Deleting either permanently removes the related pantry, budget, and calorie records.

8. How we protect it (safeguards)

We use safeguards suited to the sensitivity of the data:

Household walls: database row-level security limits each household's data to that household's members.
Encryption: our database provider, Supabase, encrypts data in transit (TLS) and at rest (AES-256). Receipt photos travel only over encrypted (HTTPS/TLS) connections.
Limited access: only the company's founders can access the database, through a single company administrator account.

No system is perfectly secure, and we can't guarantee that information will never be accessed without permission.

9. Your rights: access, correction, deletion

See and fix: most of your data is visible and editable in the app. You can also ask us for a copy of your personal information and how it has been used and shared, and ask us to correct it.
Delete: you can delete individual items in the app. To delete your whole account, use the in-app deletion in the app, the delete-account page (https://pantryally.ca/delete-account), or email [email protected]. Deleting your account permanently removes your account and its related data from our database. If you are the last member of a household, the household and its data are removed too.
How to ask: write to the Privacy Officer at [email protected]. We may ask you to confirm your identity. Access is free. We reply in writing within 30 days. If we refuse, we tell you why and what you can do next. Quebec residents can also ask for information they gave us in a structured, commonly used format.
Withdraw consent: switch off receipt reading, stop using Sage, or delete your account; some features then stop working.
Complain: contact the Privacy Officer. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information (cai.gouv.qc.ca).

Report an AI reply: if a Sage reply is wrong, harmful or inappropriate, tap "Report this reply" on that answer to send it to us for review (this arrives in the next app update).

10. If there is a data breach

If a breach of our safeguards involving your information creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada (and, for Quebec residents where there is a risk of serious injury, the Commission d'accès à l'information) and notify you as soon as feasible, explaining what happened, what information was involved, what we did, and steps you can take. We keep a record of every breach of security safeguards.

11. Open Food Facts and other data sources

Product information comes partly from Open Food Facts (openfoodfacts.org), available under the Open Database Licence (ODbL). © Open Food Facts contributors. This is product data, not your personal information.

Drink names and types in My Bar come partly from the BC Liquor Distribution Branch product price list (BC Data Catalogue). Contains information licensed under the Open Government Licence – British Columbia. Supplement names in My Supplements come partly from Health Canada's Licensed Natural Health Products Database. Contains information licensed under the Open Government Licence – Canada. Neither government endorses Pantry Ally. This is product data, not your personal information.

12. Quebec

Quebec's private-sector privacy law (as amended by Law 25) applies to Quebec residents. Our person in charge of the protection of personal information is the Privacy Officer ([email protected]). You can ask what information we hold about you, who in Pantry Ally can access it, how long we keep it, and to have it corrected or communicated to you. Your information may be communicated outside Quebec (section 5). The highest privacy setting applies by default: no receipt photo is sent until you agree (section 4).

13. Changes to this policy

We will post updates here with a new effective date. For important changes, especially any new kind of data (such as photos or audio) or new places it is processed, we will tell you in the app or by email before the change takes effect. This update adds receipt photos sent to Google Gemini. We will tell existing users in the app or by email before v12's receipt reading is switched on for them. It also adds drink and supplement names (section 1), which may be sent to Sage by name only (section 5).

14. Limitation of liability

Expiry dates, calorie totals and Sage answers are estimates to help you plan, not guarantees of food safety or nutrition advice; check food before eating it. To the extent the law allows, Pantry Ally's liability is limited. Nothing in this policy limits your rights under privacy law.