This page explains the whole picture, because the whole picture is short.
What stays with you
Everything you put into the app: your food items, dates, prices, photos, notes, shopping list, stats, and achievements. It starts locally on your iPhone. If you choose Household Sharing when it becomes available in the beta, the shared kitchen and list use your own iCloud so invited household members can see them. We cannot see any of it.
What uses the internet today
When you scan a barcode, the app asks the Open Food Facts database (a non-profit, open food database) what product that barcode belongs to. The request contains the barcode number and nothing else: no name, no location, no list of what is in your kitchen. Like any internet request, Open Food Facts' servers can see the network address the request came from. The answer is saved on your device so scanning the same product again does not need the internet for that barcode again. Optional iCloud sharing and the Kitchen web companion also use the internet when you choose to use them.
Notifications
The daily digest notification is scheduled and delivered entirely on your phone. No notification service of ours is involved, because we do not have one.
Backups
If you export a backup, the app writes a single file and hands it to you. It goes wherever you choose to save it and nowhere else. Restoring reads a file you choose. That is the whole system.
Optional iCloud features
Household sharing is built but not available in the public beta yet. When enabled, invited members will keep one kitchen and shopping list in sync using their own iCloud accounts. The Kitchen web companion is available now for your personal kitchen: you sign in with your Apple ID, and the page reads your iCloud kitchen so you can check it while shopping online. It cannot edit your food. Neither feature requires a Fridge Forecast account or sends your kitchen through a custom server we run.
Household sharing is still in testing; the web companion is read-only and shows your personal kitchen.
Crash reports and TestFlight
If the app crashes, Apple's built-in reporting can share a technical crash log with us, but only if you have opted in to sharing analytics with developers in your iOS settings. Crash logs describe what the code was doing when it failed. They do not contain your food data.
Apple controls this setting. Fridge Forecast does not turn it on for you.
Support reports
If something goes wrong, Settings has Create Support Report. It writes a text file and hands it to you, the same way a backup does. The file describes your app version, device model, iOS version, settings, how many items you are tracking, and the app's recent activity (what kind of thing happened and how long it took). It never includes audio, photos, or notes, and it leaves out your item names and the words you dictated unless you switch them on first. Read it before you send it. Nothing is sent unless you send it yourself.
To make that file useful, the app keeps a small activity log on your phone, capped at about one megabyte, with the oldest entries removed first. It never leaves your phone except inside a support report you choose to send.
If you tap Send Feedback, your own mail app opens with our address filled in. Nothing is sent unless you send it.
Children
The app collects no data from anyone, and that includes children.
Changes
If this policy ever changes, the new version will be posted at this page with a new effective date. Given how the app is built, there is not much room for it to change.