Last updated: October 6, 2026 Effective: September 25, 2026
This explains what Larderlee stores about you, why, who else sees it, and what you can do about it. It describes how the app actually works rather than trying to cover every eventuality.
Larderlee is operated by JS Venture Labs LLC ("Larderlee"), 9528 Miramar Rd, Unit 6294, San Diego, CA 92126. Contact: support@larderlee.com.
Larderlee is offered in the United States only. We do not market it outside the US, and our servers are in the US.
Dietary preferences have their own policy. If you tell Larderlee which ingredients you avoid, that is covered by our Consumer Health Data Policy, which sits alongside this one.
Your account Email address, password (stored only as a hash we cannot reverse), display name, optional avatar, subscription tier, and whether your account has been approved.
Your kitchen and cooking Pantry items and quantities, storage locations, purchase and expiry dates, notes, shopping lists, meal plans, collections, favourites, ratings, and a log of what you have cooked and what you threw away.
Prices and shops When you scan a receipt or type a price, the price you paid for an item, the name of the shop, and the date. We use this to show what an item usually costs you and what your shopping came to.
Receipts you email to us If you use receipts by email, you get a private address and can forward digital grocery receipts to it from your own email address. We receive the forwarded email through Postmark, turn its text into a list of items, and keep that list, the shop, the purchase date, the total, the subject line, the address it came from and a fingerprint of the message (so the same receipt is not added twice) for 60 days, waiting for you to review it. We do not keep the email itself, and we never open links or load images in it. Nothing reaches your pantry until you confirm it. Mail sent to your address from anyone other than you is thrown away unread.
A linked grocery account If you link a Kroger-family account (Kroger, Ralphs, Fred Meyer and the others), we store the access keys Kroger gives us, encrypted, along with the store and whether you prefer pickup or delivery, so that we can add items to that account's cart when you ask. We cannot see your Kroger purchases, your payment details or your password. Unlinking deletes the keys at once; you can also remove Larderlee from the connected apps in your Kroger account.
Recipes Recipes you import or write, including ingredients, steps, timings, servings, and the name of and link to the source. Photographs you add yourself.
Dietary preferences Ingredients you have chosen to avoid. See the Consumer Health Data Policy. We do not store any personal nutrition target.
Photos Photos you upload for scanning a shelf, a receipt, or a recipe. These are kept in private storage that only you and our servers can read.
Your ZIP code Only if you give one, to find offers at shops near you.
Household If you share a kitchen, the members of that household and any invitations. See section 4 for what the other members can see.
Subscription Whether you have Larderlee Plus, which plan, and when it renews or ends. We get this from Apple or Google through RevenueCat (see section 5). We do not receive or store any card or bank details.
Your Sous Chef The animal you choose as your Sous Chef, the name you give it and what it is wearing, and a record of the things that earned it points: cooking a recipe, saving a recipe, adding something to your kitchen or using it up, sharing a recipe and posting a meal - which kind, when, and which item it was, nothing more. Your friends see your Sous Chef's name, level, outfit, kitchen and badges (you can turn that off on its page); nobody else sees it, and nobody but you sees your points, your streak or what earned them - unless you join the weekly board, where friends who have also joined see each other's points for the week. Its name is checked by our moderation service before friends see it, like a post. Daily orders, your weekly streak and badges are worked out from the same record of what you did. When a friend leaves a treat in your Sous Chef's kitchen, we keep who left which treat and when (shown on your counter for three days). Your Sous Chef may send you a notification, at most once a day, when something in your kitchen is close to its estimated date; you can turn that off in notification settings. Dates are estimates, never a statement about whether food is safe.
Feedback you send The text of a bug report or idea you send us from the app, with the app version and the kind of device, so we can reproduce the problem.
Crash and diagnostic reports When the app crashes, freezes, or hits an error, it sends a report so we can fix it without you having to tell us: what went wrong and where in our code, which version of the app and which update, the kind of device and its operating system version, and the last screens you opened and requests the app made just before (addresses only, never their contents or search terms). The report is not linked to your account: it never includes your account, name, email address, IP address, screenshots, or anything from your kitchen, recipes or lists. Reports go to Sentry (see section 5), which keeps them for up to 90 days, and a short summary of a crash is kept on our own server for the same reason.
Your agreements When you agree to the Terms of Service, confirm you have read this policy, or give or withdraw consent for dietary preferences: which document and which version, the time our server recorded it, whether you were on the web, an iPhone or iPad, or Android, and which build of the app. This is how we can show what you agreed to and when. It is kept while your account exists and deleted with it.
Your conversations with Chef The questions you ask Chef and his answers, so a conversation is still there the next time you open him, on any device. Kept for 90 days, then deleted. "Start over" deletes a conversation straight away, and they are included when you export your data.
Technical and usage Server access logs including IP address, browser and time, kept for security and debugging. Records of AI requests made on your behalf: which feature, which model, how many tokens, and the estimated cost — not the content of the request.
How you use the app Which features you use and when — that a recipe was imported, that a scan found six items, that an import failed and why, how long something took, that the Plus screen was shown and for which feature. These are counts, durations and feature names: never a recipe title, an ingredient, a search term, a photo or anything you typed. We use them to find where the app is confusing or broken.
They are stored on our own server and go to no third party. You can ask us to delete them at any time, and deleting your account deletes them with it.
Friends and meal posts If you use Friends: the first name, username and (if you add one) profile picture you choose for Friends; who your friends are and the requests you sent and received (for a request to someone without an account yet, the email address you typed); the posts you write, their photos and the recipe you attach; your comments and "yums"; people you have blocked; reports you make; and whether you chose to show friends what you cook. Your friend link is a random code tied to your account. We also keep the notifications we show you in the app (who sent a request, said yum or commented, and when), and a count of the name searches you make, to stop the search being used to list members.
What we do not store: your voice. Cooking mode can listen for short commands such as "next step" while you have Listen turned on. The speech is turned into text by your device's or your browser's own speech service — Apple on an iPhone or iPad, Google on Android and in Chrome — which may process the audio on the device or on that company's servers under its own privacy policy. The app acts on the command and throws the text away. Larderlee never receives, records or stores audio, and nothing is listened to while Listen is off.
We use your data to run the Service: to show your kitchen, match recipes to what you have, apply your dietary filters, share a kitchen with the people you choose, send the emails the app needs to send, manage your subscription, keep the Service secure, and find and fix problems.
The emails we send. Sign-in links, password resets, approval, household and recipe-share invitations, friend requests and friend invitations, replies to your feedback, an occasional reminder, and a weekly kitchen email from Chef: what is about to go off, what you cooked, what you threw away, what your shopping came to, roughly what you saved, and one of your saved recipes that would use things up. It is sent only in a week when there is something to say, and you can turn it off in Profile.
We do not sell or share your personal information as those terms are defined under California law. We do not share it with advertisers, and we do not track you across other companies' apps or websites. We do not use your recipes or photos to train AI models.
If you create or join a household, the people in it share one kitchen with you. Each member can see and change:
These activity lines are kept for 30 days. Your dietary preferences, your feedback, your subscription and your email address are not shown to other members. You can leave a household at any time.
A friend is someone you both agreed to be friends with. Everyone on Friends is shown by the first name, username and optional profile picture they choose - never a last name, and never the display name or sign-in picture on the rest of your account. Your friends see that name, the meal posts you write (with their photos and the recipe you attach, which they can save a copy of), your comments and "yums" on posts they can see, and, only if you turn on "show friends what I cook", the name of each recipe you finish cooking and when. That is off until you say yes. Friends do not see your pantry, lists, other recipes, email address or anything else, except recipes you share with them (below).
Every recipe starts out seen only by you and your household. From a recipe's Share button you can share it with your friends or with everyone on Larderlee (anybody with an approved account). Sharing publishes a copy of the recipe as it is at that moment: its title, description, picture, ingredients, method, times and tags, with your first name, username and profile picture beside it, and how many people have saved it. Edits you make later are not shared until you share the recipe again. A recipe you imported from a website is shared with everyone as its title, ingredients and a link to the original, not its method or photo. Anybody in the recipe's kitchen can share it (they are the one shown beside it) and any of them can stop sharing it.
Anybody who can see a shared recipe can save their own copy; that copy is theirs, and stays theirs if you stop sharing. Stopping sharing, or deleting the recipe or your account, removes the shared copy and its picture (the picture within a day). Blocking someone hides your shared recipes from each other. Only share recipes you wrote or have the right to share.
Finding you. Other Larderlee members can search for your first name or your username (if you have picked one, even before you open Friends) and send you a request. They see only your first name, your username, your profile picture if you added one, and how many friends you have in common. You can switch this off on the Friends tab ("Let people find me by name"); people can then add you only with your email address or your friend link. Your email address is never searchable.
Somebody who asks to be your friend by email is never told whether that address has a Larderlee account. Blocking someone ends the friendship and hides you from each other; they are not told. Reports go to us, not to the person reported.
Checking posts. Before your friends see a post, a comment, a shared recipe and its picture, your Friends name and username, or your profile picture, it is sent to OpenAI's moderation service, which says whether it looks like it breaks our community rules. OpenAI does not keep that content to train its models. If a post is refused, nothing is stored.
Child safety. Photos shared with other people (meal post photos, profile pictures and the pictures on shared recipes) go through the moderation check above. We have also built a check against Microsoft PhotoDNA's list of known child sexual abuse material, which compares a digital fingerprint of the photo; it is switched on once Microsoft grants us access, and from then on every shared photo is checked. If a photo matches, or our moderation flags it as possible sexual content involving a minor, it is not shared; it is preserved, and the account details and the connection details of the upload are kept, so that we can report it to the National Center for Missing & Exploited Children as US law requires. That record is kept for at least a year after the report, even if the account is deleted, and the account may be suspended.
| Who | What they receive | Why |
|---|---|---|
| OpenAI | The text of a page you import, photos you upload for scanning, and the text of a receipt you email to us (and up to two photos attached to it). Questions you ask Chef, with what he needs from your kitchen to answer them: your saved recipes, what is in your kitchen and its dates, your leftovers, your shopping list, what you cooked recently, the prices and shops from your receipts, what you used up or threw away, your meal plan, the recipe you are cooking, and the conversation so far. A recipe's name, ingredients and method, when you ask for an AI picture of it. The words you type into Find recipes, which OpenAI searches the web for, plus up to eight things from your kitchen if you ask it to use what you have. An account identifier goes with each. And the words and photo of a meal post or comment you write, a recipe you share, and your Friends name, username and profile picture, for their moderation check | To read them and return a structured recipe, list of items, answer, picture or search results; and to check posts against the community rules |
| Apple | Your sign-in, if you choose Sign in with Apple. Your App Store purchase, if you subscribe on an iPhone or iPad. Voice commands, if you use Listen on an Apple device. Notifications to your iPhone, if you turn them on | Sign-in, payment, speech recognition, notifications |
| Your sign-in, if you choose to sign in with Google. Your Google Play purchase, if you subscribe on Android. Voice commands, if you use Listen on Android or in Chrome. Notifications to your Android phone, if you turn them on. The link of a public YouTube video you import on Larderlee Plus, when its description has no recipe, so Google's Gemini can watch it; nothing else about you goes with it | Sign-in, payment, speech recognition, notifications, and reading a recipe from a video | |
| RevenueCat | Your Larderlee user id, and the subscription records Apple or Google send it: which plan, when it started, renews or ends. No name, no email address, no card details | To tell us whether your subscription is active |
| Postmark (ActiveCampaign) | Your email address and the messages we send you from support@larderlee.com; and, if you use receipts by email, the receipts you forward to your private address | To deliver sign-in, reset, notification and weekly emails, and to receive forwarded receipts |
| Cloudflare | Runs our DNS, and forwards email sent to support@larderlee.com to our inbox, so it carries the messages you send us. Also stores the off-site copies of our backups, encrypted with a key Cloudflare does not have, so it cannot read them | Website addressing, receiving your email, and keeping a copy of our backups away from our server |
| Open Food Facts | A barcode number you scan | To look up the product. We send only the number |
| Kroger | Your ZIP code and the names of items on your shopping list, when you ask for offers or prices near you or to fill your Kroger cart, and anything you type into the price search. If you link your Kroger account: the products and quantities you choose to add to its cart, and whether you want pickup or delivery | To find nearby shops, match products and prices, and add what you chose to your cart. Larderlee never checks out or pays |
| Instacart | The names and amounts of the unchecked items on your shopping list, when you choose "Shop on Instacart", and your ZIP code to list stores near you | To build a page of matching products that you can add to your own Instacart cart. What you buy, and your Instacart account, stay between you and Instacart |
| Expo (650 Industries) | If you turn on notifications in the Larderlee app: your phone's push token, and the words of each notification ("Sam commented: looks great") | To deliver notifications to your phone through Apple or Google |
| Microsoft (PhotoDNA) | Once Microsoft grants us access: photos you share with other people (on Friends or on a shared recipe), to compare their fingerprint with known child sexual abuse material | Child safety |
| NCMEC | If a photo matches known child sexual abuse material: the photo, your account details, and the time and IP address of the upload | Required by US law (18 U.S.C. 2258A) |
| Sentry (Functional Software) | Crash, freeze and error reports from the app, as described in section 2: what went wrong, the app and device versions, and the screens and request addresses just before. Not linked to your account: no account id, name, email address, IP address, screenshots or kitchen data | To find and fix crashes and freezes |
| Hetzner | Everything, as our hosting provider | They operate the server the Service runs on |
Payment card details stay with Apple or Google. We never see them, and neither does RevenueCat.
We may also disclose data if the law requires it, or to protect the rights and safety of people using the Service.
This is worth being plain about. When you import a page, scan a shelf, photograph a receipt, ask Chef a question, ask for an AI picture of a recipe, or search for recipes on the web, that content leaves our servers and goes to OpenAI to be processed. A question to Chef takes the parts of your kitchen listed in the table above with it, because that is how he can answer "what can I make tonight".
We send the content and an account identifier. We do not send your email address or your name. Our agreement with them does not permit your content to be used to train their models.
If you would rather nothing left our servers, do not use the scan, import, Chef, AI picture or Find recipes features. Adding items by hand does not involve any AI provider.
To avoid paying twice for the same work, we keep the result of an AI request and reuse it if identical content is submitted again. That cache is shared across the Service, so if two people import the same public page, the second may be served the stored result rather than a fresh one. A result is reused only when the submitted content is identical. Cached results are not linked to any account and expire after 30 days.
On a server in Hillsboro, Oregon, operated by Hetzner Online GmbH. The companies in section 5 hold what they receive on their own systems, in the US.
What deleting your account removes is set out on our account deletion page.
Whatever state you live in, you can ask us to:
Email support@larderlee.com and we will respond within 45 days. Deleting your account removes your profile, pantry, recipes, lists, plans, photos, prices, usage records and household membership.
We will not treat you differently for exercising any of these rights.
If you are in California, the CCPA/CPRA gives you the rights above, plus the right to know the categories of information we collect and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. You may use an authorised agent to make a request.
If you are in Washington or Nevada, see the Consumer Health Data Policy for rights relating to dietary preferences specifically.
If you are in Colorado, Connecticut, Virginia, Texas, Oregon or another state with a comprehensive privacy law, you have broadly the same rights, and you may appeal a refused request by replying to our decision. We will respond to an appeal within 45 days.
Larderlee is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, write to support@larderlee.com and we will delete it.
Data is encrypted in transit. Passwords are hashed. Your photos are held in private storage requiring a signed, short-lived link. Access between accounts is enforced by the database itself, so one account cannot read another's data even if the app has a bug.
No system is perfectly secure. If a breach affects you we will tell you, and any regulator we are required to tell, as quickly as we can.
The app keeps your sign-in session on your device so you stay signed in, and remembers small preferences like which tab you had open. We do not use advertising or tracking cookies, and the app contains no advertising or tracking code.
We may update this policy. If a change is material we will tell you by email or in the app before it takes effect.
support@larderlee.com JS Venture Labs LLC 9528 Miramar Rd, Unit 6294 San Diego, CA 92126