Effective 30 July 2026 · Applies to PantryRun for iOS and Android
This policy describes what the app actually does, checked line by line against the code that ships. Where something is imperfect, it says so.
The short version.
PantryRun is built by an independent developer based in Ontario, Canada, who is the data controller for the limited processing described here. For any privacy question or request, write to privacy@pantryrun.app.
Your grocery lists are stored in a database on your phone. Sensitive text is encrypted field by field before it is written:
Two honest caveats. Your in-app notification history stores item and list names unencrypted, so a name encrypted in your list may appear in cleartext in that history. And the database file itself is not separately encrypted — it relies on your device's own storage protection, which is why a device passcode matters.
Encryption keys and your recovery phrase are held in your operating system's secure credential storage (Keychain on iOS, Keystore-backed encrypted storage on Android) rather than in ordinary app files. They are never transmitted anywhere. The app does not require biometrics or a passcode to unlock them.
Content is encrypted with XChaCha20-Poly1305 (authenticated, with a random 24-byte nonce, bound to the field it belongs to). Passphrase-derived keys use Argon2id. Family invitations are signed with Ed25519, and the family key is delivered to a joining device inside an X25519 sealed box. A single family master key protects both stored content and sync traffic — the app does not currently derive separate keys for those two purposes.
Your 12-word recovery phrase uses the standard BIP39 wordlist, but its checksum and key derivation deliberately differ from the BIP39 specification. It is not a cryptocurrency wallet phrase and should not be imported into wallet software.
This is the complete list for the released app.
| What | When | Goes to | Readable there? |
|---|---|---|---|
| Encrypted list updates | You edit a list while paired with family | The relay server your family uses | No — sealed ciphertext |
| Routing metadata: family ID, device ID, list ID, timestamps, message sizes | Alongside every sync message | The relay server | Yes |
| A product barcode | You scan a barcode | Open Food Facts (openfoodfacts.org), a third party | Yes |
| A photographed store flyer | You scan a flyer for prices | The relay server | Yes — flyer images are not end-to-end encrypted |
| Product name, barcode, store, and the first 3 characters of your postal code | Price and weekly-deal lookups | The relay server | Yes |
| An anonymised price observation | Only if you switch on price sharing | The shared price pool | Yes, but not linked to you — see §7 |
| A store name and postal-code prefix | You tap "navigate to store" | Apple Maps or Google Maps | Yes |
These are structural facts about the app, not just promises. The app declares no location or contacts permission, so it cannot read them even if asked to.
Sharing a list between phones needs a small server — a "relay" — to pass messages. You may run it yourself, or your family may use one operated by us. Either way, what travels through it is sealed: the relay handles ciphertext and cannot read your item names, notes or quantities.
What the relay operator can see, because it needs it to route messages:
Retention — please read this one carefully.
Encrypted updates are kept on the relay so a device that was offline can catch up. They are deleted automatically 30 days after they arrive. Unpairing a device does not erase them: it removes that device's credentials locally and stops future syncing, but data already relayed remains for the rest of its 30 days — and if you re-pair within that window, it will sync back to you.
When you scan a product barcode, the app looks the number up so it can fill in a product name. If your family's relay has a catalogue it is asked first. Otherwise the barcode is sent to Open Food Facts (openfoodfacts.org), an independent open food database operated by a French non-profit and governed by its own privacy policy.
What is sent is the barcode number and, unavoidably, your IP address. No list contents, no identifiers of yours, and nothing tying the lookup to you or your family. We do not receive anything back about you. If you would rather this never happen, simply don't use the barcode scanner — everything else in the app works without it.
Price features are additions to a grocery list app, and they are the only part of PantryRun that routinely talks to a server. Typed-in prices stay on your device.
If you photograph a store flyer, the image is stripped of EXIF metadata on your device — removing camera details and any embedded location — before it is uploaded. If stripping fails for any reason, the upload is abandoned rather than sent. The image is then sent to your family's relay for automated price extraction and discarded after processing.
Unlike your lists, a flyer image is not end-to-end encrypted: whoever runs that relay can see the picture you took. Photograph the flyer, not your kitchen.
Looking up a price or this week's deals sends the product name or barcode, the
store, and the first three characters of your postal code (for example
M5V) to the relay. Three characters cover a wide area — typically
thousands of households — and a full postal code is never stored or sent.
This is off unless you turn it on. When enabled, a price you captured may be contributed to a shared pool so other shoppers benefit. Before it leaves, the record is reduced to the store, the item and its size, the price, and the week it was seen — no device ID, no family ID, no exact timestamp — and it is sent after a randomised delay so it cannot be correlated with what you were doing.
The app contains crash-reporting code (Sentry), but it is inert in released builds: no reporting endpoint is configured, so the reporter is never started and no crash data is transmitted. There is a switch for it in Settings → Privacy. If a future release ever enables crash reporting, this policy and the app stores' data disclosures will be updated in the same release, and the setting will remain yours to turn off.
Being straight about what each control really does:
| Action | What it actually does |
|---|---|
| Delete an item or list in the app | Marks it deleted and hides it. The row remains in the local database, with its name still encrypted, so the deletion can sync to other devices. |
| Clear Local Prices (Settings) | Genuinely erases stored price data on that device. |
| Leave Family / unpair (Settings) | Removes this device's sync credentials and stops syncing. Does not erase data already on the relay — see §5. |
| Uninstall the app | The complete removal: the local database and all keys go with it. If you have no recovery phrase saved, this is irreversible. |
To have data held on a relay we operate deleted sooner than its automatic 30-day expiry, email privacy@pantryrun.app. Because the contents are sealed, we can delete a family's stored blobs but cannot read them or tell you what they contained.
Depending on where you live, you have rights to access, correct, delete, port or restrict the processing of your personal data, to object to it, and to complain to a regulator — in Canada the Office of the Privacy Commissioner, in the EU/UK your national data protection authority.
PantryRun's design changes the practical shape of these rights: almost everything is already in your hands on your own device, and what we hold is sealed data we cannot read or link to a person. Where we do process data, the lawful basis is performing the service you asked for, and — for the optional price features and any future crash reporting — your consent, which you can withdraw in Settings at any time. Exercising a right will never cost you anything or degrade the app.
PantryRun is a household tool intended for people aged 13 and over. It is not directed at young children, and we do not knowingly collect personal information from them. Children in a family may of course use a shared list on a parent's device; nothing about that is transmitted to us in readable form.
If your family runs its own relay, your data goes only where you put it. If you use a relay we operate, sealed data may be processed on servers outside your country, including in Canada, the United States or the European Union. Because the contents are encrypted before they leave your device and we do not hold the keys, a change of jurisdiction does not expose them. Barcode lookups are answered by Open Food Facts in the European Union.
If this policy changes, the effective date above changes with it. Any change that widens what the app collects will be announced in the app before it takes effect, not applied quietly. Previous versions are available on request.
Privacy questions and requests:
privacy@pantryrun.app
Anything else: support@pantryrun.app
We aim to answer within 30 days, which is the deadline Canadian and European law sets.