Privacy policy

Controller: who we are

The data controller is Tom Worley. Contact: [email protected] or the report form.

The app

• Your stock data stays on your phone, on the other phones in your household if you pair them, and on your own server, if you run one. ShelfKeeper has no accounts, so there is nothing to sign up to.
• To look up a barcode, the barcode is sent to Open Food Facts. Without a server (Phone only, including phones paired to a household hub) the phone asks Open Food Facts directly. With a server, your server asks, and the phone asks directly only when your server cannot answer, and to fetch the picture of a product that is not in your household for the Nutrition scanner. The request identifies itself as ShelfKeeper/<version> ([email protected]). Product images come from Open Food Facts and, for non-food products, its sister sites Open Beauty Facts, Open Pet Food Facts and Open Products Facts. Each site sees the IP address of whichever device asks, and its own privacy policy applies.
• Every page, download and report sent to www.shelfkeeper.co.uk - including the product database and the report form – is served through Cloudflare. Cloudflare and our nginx server record your IP address and the time of each request in standard access logs; the report-form service behind that address stores no IP address itself.
• Sync goes only to your own devices: the household hub phone on your network, or a server you run yourself. We never see it.
• If you install the app from Google Play, Google handles the download and Google's own privacy policy applies. Google Play gives us total install numbers and, from phones set to share usage and diagnostics with Google, crash and performance reports that do not name you.
• If you buy ShelfKeeper Plus, Google Play takes the payment and tells the app whether this Google account bought it. We never see your payment details, name or purchase record. When you sync, the app tells your own household hub or server whether Plus is owned, so the other phones in your household can use it. That goes only to your own devices.
• Remote date reading, if you set it up, sends cropped pictures of the date only to a service on your own network that you configure.
• ShelfKeeper itself has no analytics or ads.
• Barcode and text reading, including reading a nutrition table or ingredients list from a photo you take, use Google's ML Kit, which runs on the phone. ML Kit normally reports usage diagnostics to Google (phone model, app version, a per-install ID, timings and error codes). ShelfKeeper switches that reporting off, so ML Kit sends Google nothing.

The report form

When you send a report we keep: what you wrote, your email if you give one, the time it arrived and, if you leave the "Send build number, Android version and phone model" box ticked, those three values. Untick it and none of them is kept. The form does not store your IP address.

"Report a problem" in the app's Settings opens the form with your build number, Android version and phone model in the web address, before you send anything. Cloudflare, which carries the site, sees that address like any other. Our own server logs leave those values out.

We use it only to find and fix bugs. The lawful basis is our legitimate interests in fixing the app. The email is optional. Giving it is your consent to a reply, and you can withdraw that consent at any time.

We keep reports for 12 months, then delete them.

Product contributions (optional)

In the app, sharing is on unless you turn it off: the first-run tour asks, and the switch is in Settings › Sharing. On a ShelfKeeper server it is off until you turn it on. When it is on, the app asks whether to share a product in two cases: when you add a product that no database knows, and when your product differs from what ShelfKeeper shows everyone for that barcode: its name, brand, pack size, front photo, nutrition per 100 g or ingredients. Your server asks only in the first case. Nothing is sent without a tap on Share.

A share sends: the barcode, the name, brand, pack size and category as they are in your app, which of them you changed (for a fix), the nutrition per 100 g and ingredients if you share them, the app version, whether it came from the app or a server, and the photos you add: a photo of the pack, and a photo of the nutrition table or ingredients list when you share those, so a person can check them. It also sends a random receipt id and a random status code, both made for that one share. It does not send anything that identifies you or your phone, your stock or where you are. Before a photo leaves your phone the app removes everything but the picture itself: location, phone make and model, date and time, thumbnails and other camera data. Our server removes it again. The form stores no IP address. Cloudflare and nginx log it as they do for every request (see The app).

While sharing is on, the app asks our server now and then what happened to your own shares, using the status code made for each share, which we never publish. The answer says whether each share was accepted or rejected, and why, and whether it went to Open Food Facts. These codes and answers are not logged, and we keep nothing that links one share to another. Your counts and badges are worked out on your phone and never sent to us.

An automated assistant checks each share first, then a person approves or rejects it. Nothing is published without that approval. We publish a monthly total of accepted products, photos and fixes from everyone, with no names. Approved text, fixes and photos join the product database we publish every week and are sent to Open Food Facts (or its sister sites for non-food), under the ShelfKeeper account, about a week after approval, so everyone gets them. Once sent, we can ask Open Food Facts to remove something, but can't guarantee it. An approved fix replaces the database's value in our copy only while that value is still the one you fixed. If Open Food Facts changes it, theirs is used. Photos are moved off our web server to our own computer and seen only by the people who check shares. Once a photo is approved, a copy with nothing but the picture (at most 1600 pixels across) is published with the product database under the CC-BY-SA 4.0 licence, on our website at www.shelfkeeper.co.uk/dump/photos/, credited "ShelfKeeper contributors", never by name. Rejected photos are never published. Label photos are published the same way, as the product's nutrition and ingredients pictures. The same approved copy is what we send to Open Food Facts; your private original never leaves our computer.

The lawful basis is your consent: tapping Share for that product. Sharing being on only means you are asked. You can turn sharing off at any time in Settings. Turning it off removes anything not yet sent.

We keep our private copy of each photo, and shares that were rejected or never approved, for 90 days, then delete them. A published photo stays published until you ask us to remove it. To have a share deleted sooner, or its published photo removed, email its receipt id (Settings › Shared products) to [email protected]. We delete the share, take its photo off our website and leave both out of the next weekly database. Text and photos that have already been published can't be recalled: copies of an open database are made by people we don't control. If yours was sent to Open Food Facts, we'll ask them to remove it, but they decide.

Contributor terms

By sharing a product you confirm that what you send is factual product information as printed on the pack, and that a photo you took yourself shows only the pack (no people, post or documents) and is yours to share. You license the text under the Open Database License (ODbL) 1.0 and the Database Contents License (DbCL) 1.0, and the photo under CC-BY-SA 4.0, the same licences Open Food Facts uses. Shared products are credited as "ShelfKeeper contributors", never by name. We may pass what you share to Open Food Facts on the same terms.

Discord

We run a ShelfKeeper server on Discord for questions and news. Discord is a separate company, and its own privacy policy applies to anything you post there. We only link to it: our pages and the app have no Discord widget or embed, so Discord learns nothing from our pages unless you open the link. Don't post receipt ids, email addresses or other personal data on Discord. To report a problem, use the report form; for anything private, email [email protected].

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or erase it, or object to how we use it. Email [email protected].

Complaints

You can complain to the Information Commissioner's Office (ICO): https://ico.org.uk.