Knowsy
Privacy policy
This policy explains what the Knowsy app collects, why, who helps us run it, how long things are kept and what you can do about it. Knowsy is made by oddhatch (“we”, “us”), which is responsible for your data (the “controller”). Questions or requests: privacy@oddhatch.com.
The short version. You need an account to use Knowsy. Your pantry, receipts and recipes are kept in your account and seen only by the people in your kitchen. Photos you take are read by an AI model on our server and then thrown away. Allergies and food rules are kept only if you say yes. Usage statistics are sent only if you agree; anonymous error reports are always sent so we can fix crashes. We don’t sell your data, show ads or track you across other apps. Deleting your account deletes all of it.
1. What we collect
Your account
- Email address and password (the password is stored only as a secure hash), or, where offered, the account details Google or Apple share when you sign in with them, or a phone number if you sign in with a text-message code.
- Your name as you enter it in setup, shown to the people in your kitchen.
- An account ID — a random identifier we create — and your app settings, such as language, reminders and household size.
What you put into your kitchen
- Pantry items: names, amounts, where they’re stored and use-by dates.
- Receipts: the store’s name, the date, the lines and their prices as read from the receipt — used for your pantry and your spending and price history.
- Recipes you save or import (including the link they came from), your cookbooks, shopping lists, leftovers, what you cooked and how you rated it.
- Food preferences: dislikes and, only with your consent, allergies and food rules (see section 2).
- Recipe problem reports you choose to send: what was wrong, an optional comment, the recipe as it was read and the link it came from.
Photos, links and text you ask Knowsy to read
When you scan a receipt, photograph products or a dish, import a recipe from a link, or paste recipe text, the photo, link or text is sent to our server, where an AI model reads it and sends the result back to your phone. Photos are not stored once they have been read. The result (for example the pantry items on a receipt) is saved only when you save it.
When you import from Instagram, TikTok or YouTube, your phone opens the public post itself, without signing in to your social accounts, much like a web browser would, and sends what it sees to our server. Recipe websites are fetched by our server.
Subscriptions
Your subscription is bought and paid for through Google Play or the App Store. We never see your card or payment details. We receive the state of your subscription (plan, trial, renewal, expiry) linked to your account ID.
Technical data
- Error reports (always on) and usage statistics (only with your consent) — see section 6.
- Usage counters: how many scans, imports and searches your account made each day and month, to apply fair-use limits.
- Security records: failed attempts to join a kitchen with a code, to stop people guessing codes. Our hosting providers also process IP addresses and request logs briefly to keep the service running and secure.
What we don’t collect
We don’t collect your location, contacts, or your activity in other apps, and we don’t use advertising IDs. Voice commands in cooking mode (“next”, “back”, timers) are turned into text on your phone; nothing is recorded or sent to us.
2. Allergies and food rules
Allergies are health information, and food rules such as halal or kosher can reveal religious beliefs. Both are special categories of data under data-protection law, so Knowsy stores them only after you agree on a clear consent screen, and records when you agreed. If you don’t agree, Knowsy works without them.
Once stored, they are used to hide recipes that aren’t safe or right for you, the people in your kitchen can see them so they can cook for you, and their names (for example “peanut” or “halal” — never your name or account) are sent as filters to our recipe-search provider. You can remove them, or withdraw your consent, at any time in Account; they are then deleted.
3. Why we use it (legal bases)
| Purpose | Legal basis |
|---|---|
| Your account, your kitchen and the app’s features (reading receipts, matching recipes, reminders, sharing a kitchen) | Performing our contract with you |
| Subscriptions and access to paid features | Performing our contract with you |
| Allergies and food rules | Your explicit consent |
| Usage statistics linked to your account | Your consent |
| Anonymous error reports, fair-use limits, abuse and fraud prevention, recipe problem reports | Our legitimate interest in a working, secure, affordable service |
| Emails needed to run your account (confirming your address, resetting your password) | Performing our contract with you |
| Keeping records the law requires | Legal obligation |
We don’t send marketing emails, sell or rent your data, use it for advertising, or make decisions about you that have legal or similarly significant effects based solely on automated processing.
4. Who helps us run Knowsy
We use the service providers below. They process data on our behalf and only for the purpose listed, under contracts that require them to protect it.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in and our server functions | Your account and everything in your kitchen | EU |
| Anthropic | The AI model (Claude) that reads receipts, products, dishes and recipes, and translates food names | The photos, links and text you ask it to read; food and ingredient names. Not used to train its models. | USA |
| Spoonacular | Recipe library and search | Ingredient names from your pantry, your search words, and the names of your allergy, food-rule and dislike filters — not your name, email or account | USA |
| RevenueCat | Manages subscriptions across Google Play and the App Store | Your account ID, purchase history and which kitchen your plan covers | USA |
| Google Play / Apple App Store | Sell the subscription and take payment; deliver the app | What you buy, under your store account, governed by their own privacy policies | Worldwide |
| PostHog | Error reports and, with consent, usage statistics | See section 6 | EU |
| Resend | Sends account emails from no-reply@mail.oddhatch.com | Your email address and the email’s content (for example a confirmation code) | USA |
| Expo | Delivers app updates | Your device type, the app version and your IP address when the app checks for an update | USA |
| Open Food Facts | Open product database used for barcodes | The barcode number you scan | France |
| open.er-api.com | Currency exchange rates for your spending view | Currency codes only | — |
To save cost and time, translations of food names and recipe search results are kept in a shared cache. Cached entries contain food words and recipes only, never who asked for them; a translation becomes shared only after two different people received the same answer.
We may also disclose data if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganisation of the studio, in which case this policy continues to apply to your data.
5. Shared kitchens
A kitchen can be shared with up to two other people by invite code. Everyone in a kitchen sees its pantry, recipes, shopping list and receipts, each member’s name, and — if they agreed to store them — each member’s allergies and food rules. Only invite people you trust. If you leave a kitchen, or delete your account, what you added to a shared kitchen stays there for the others.
6. Error reports and usage statistics
Error reports are always sent when the app hits an error or crashes. A report contains the phone model, operating system, the app version and the technical details of the error. It contains no names, food, receipts or text you typed, and while usage sharing is off it is not linked to your account (it carries a random ID that changes every time the app starts). We use them only to fix bugs.
Usage statistics — which features you open and use, as counts and kinds, never names, food, receipts or text — are sent only if you agree when the app asks. They are then linked to your account ID (never your name or email). You can change your answer at any time in Account › Privacy.
Both go to PostHog’s EU cloud with location lookup switched off. No session recordings are made.
7. What stays on your phone
Knowsy keeps a copy of your kitchen on your phone so it opens fast and works offline, and stores your sign-in session and settings there. Cover images of recipes saved from social media are kept only on your phone, never on our server. Reminders are scheduled on your phone. Signing out or deleting your account clears all of this from the phone; uninstalling the app removes it too.
8. How long we keep things
| Data | Kept for |
|---|---|
| Account and kitchen contents | Until you delete them or your account. A kitchen you share stays with its other members. |
| Allergies and food rules | Until you remove them, withdraw consent or delete your account. |
| Photos you ask Knowsy to read | Not stored by us after they are read. Anthropic processes them under its commercial API terms, which allow only limited retention (for example for abuse monitoring) and no model training. |
| Usage counters and recipe problem reports | Until you delete your account. |
| Failed invite-code attempts | 1 day. |
| Subscription records at RevenueCat | Deleted when you delete your account. Google and Apple keep their own purchase records under their policies. |
| Usage statistics (with consent) | Deleted when you delete your account. |
| Anonymous error reports | Up to 12 months. |
| Database backups and server logs | Deleted data may remain in encrypted backups and logs for up to 30 days before it is overwritten. |
9. Your rights
Depending on where you live (for example under the EU and UK GDPR, or US state laws such as the CCPA), you have the right to:
- access the data we hold about you and get a copy, including in a portable format;
- correct it — most of it you can edit in the app;
- delete it — delete your account in the app, or ask us;
- withdraw consent at any time (allergies and food rules, usage statistics), without affecting what happened before;
- object to or restrict processing based on our legitimate interests;
- complain to your local data-protection authority.
Email privacy@oddhatch.com from the address on your account. We will answer within one month and may need to confirm it’s you. We don’t sell or “share” personal information for cross-context behavioural advertising, as those terms are defined in California law.
10. Security
Data is encrypted in transit (HTTPS) and stored with our database provider, where access rules make sure each kitchen can only be read by its own members. API keys for paid services stay on our server, never in the app. Every sign-in ends the account’s sessions on other phones. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
11. Where your data is processed
Our database is in the EU. Some providers above are in the USA. Where data leaves the EU, UK or Switzerland, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.
12. Children
Knowsy is not directed at children and is not meant for anyone under 16. We don’t knowingly collect data from children. If you believe a child has given us data, email privacy@oddhatch.com and we will delete it.
13. This website
oddhatch.com sets no cookies and runs no analytics or trackers. It is hosted on Google Firebase Hosting, which processes your IP address and basic request details to deliver pages and protect the site.
14. Changes and contact
If we change this policy, we will update the date at the top, and tell you in the app before a significant change takes effect. Questions, requests or complaints: privacy@oddhatch.com. General help: support@oddhatch.com.