Privacy Policy

Welcome to Pantryx ("Pantryx", "Company", "we", "our", or "us").

Pantryx is operated by Volodymyr Mendyk. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Pantryx mobile application and related services (the "App" or "Services"). It also explains your privacy rights and choices under the General Data Protection Regulation ("GDPR") and other applicable data protection laws.

Pantryx is a pantry-scanning and recipe recommendation app. The App uses artificial intelligence to recognise items from photos and to extract recipes from links to social media posts and videos that you submit. It allows you to confirm or edit your pantry inventory, and recommends recipes from Pantryx's curated recipe database based on confirmed ingredients and selected preferences.

Pantryx does not currently provide an AI cooking chat assistant. Recipes in Pantryx's curated recipe database are not generated by AI. Recipes you import from a link are extracted by AI from third-party content (see "Recipe Import from Links and AI Extraction" below). Pantryx is not a medical, nutritional, dietary, or allergen-management tool.

Privacy Policy URL: https://pantryx.org/privacy

Pantryx includes the following features:

• AI Pantry Scanning via Camera: Capture or upload photos of your pantry, fridge, shopping bag, or individual items so Pantryx can suggest recognised items for your confirmation.
• Pantry Confirmation: Review, confirm, edit, or delete recognised items before they are added to your pantry inventory.
• Manual Inventory Management: Add, edit, categorise, and track pantry items manually.
• Recipe Recommendations: Receive recipe suggestions from Pantryx's curated recipe database based on your confirmed pantry inventory and selected preferences.
• Recipe Import from Links: Paste or share a link to a YouTube, TikTok, Instagram, or Threads post or video so Pantryx can use AI to extract ingredients and steps into a private recipe in your account. Imports are limited to 10 per day and 30 per week.
• Recipe Selection and Cooking Steps: Select a recommended recipe and follow structured cooking steps.
• Ratings, Saved Recipes, and Meal Planner: Rate, save, and mark recipes as cooked, and plan meals by date.
• Recipe Sharing: Share a link to a recipe from Pantryx's curated recipe database. Imported recipes are private and cannot be opened by others.
• Dietary Preferences: Optionally enter allergies, intolerances, dietary preferences, or health-related dietary information to help personalise recipe recommendations.
• Cross-Device Access: Access your inventory and saved recipes across your devices when signed in.
• Account Deletion: Delete your account through the in-app account deletion feature or by contacting us.

Where we rely on legitimate interest, we balance our interests against your rights and freedoms.

Allergy, intolerance, medical diet, and health-related dietary information may qualify as special-category personal data under applicable data protection laws.

Pantryx processes this information only if you choose to provide it and give explicit consent for Pantryx to use it for the specific purpose of personalising, filtering, or adjusting recipe recommendations.

Before you enter allergy, intolerance, or health-related dietary information, the App will request explicit consent using wording substantially similar to:

I consent to Pantryx processing my allergy, intolerance, and health-related dietary information to personalise recipe recommendations. I understand that Pantryx is not a medical, nutritional, or allergen-management tool and that I must always verify product labels, ingredients, and suitability myself.

This consent must be given actively and will not be pre-selected. You may withdraw this consent at any time by deleting the relevant information, disabling dietary personalisation where available, or contacting us at communication.pantryx@gmail.com. Withdrawing consent does not affect processing that occurred before withdrawal.

Pantryx is not a medical, nutritional, or allergen-management tool. Dietary personalisation is not a guarantee that recipes are allergen-free, medically appropriate, or safe for your individual circumstances. You must always verify product labels, ingredients, allergens, warnings, and recipe suitability yourself.

Because Pantryx relies on visual recognition of items, we want to be clear about how photos and device permissions are handled.

When the camera is used

The camera is used only when you actively initiate a scan or upload a photo for item recognition.

iOS camera permission notice

The App may display a camera permission notice such as: "Pantryx uses your camera to scan pantry, fridge, or grocery items so you can confirm your inventory and get recipe recommendations."

iOS photo library permission notice

The App may display a photo library permission notice such as: "Pantryx lets you choose photos of pantry or grocery items for item recognition."

Where photos go

Photos are uploaded to Pantryx's backend for temporary processing and are transmitted from there to our third-party AI recognition provider, OpenAI, to identify items. The App never contacts OpenAI directly and never holds any OpenAI credentials; all recognition requests pass through Pantryx's own backend and are authorised using your Pantryx account token.

How long photos are stored

Original uploaded photos are retained on Pantryx's backend for up to 24 hours for recognition, debugging, security, abuse prevention, and service reliability purposes. After that period, original photos are automatically deleted.

AI item recognition model

Pantryx uses a third-party artificial intelligence model provided by OpenAI (currently OpenAI's GPT-4o-mini vision model) to analyse submitted photos and suggest recognised items for your confirmation. The model is accessed through Pantryx's own backend, which sends the photo to OpenAI, receives a list of suggested ingredient names, and returns them to the App. Item recognition returns ingredient names only. AI is also used to extract recipes from links you submit, as described in "Recipe Import from Links and AI Extraction" below.

What is sent to OpenAI for recognition

A downscaled copy of the submitted photo and a limit on the number of results to return. This is the only information sent to OpenAI for item recognition.

What is not sent to OpenAI

Pantryx does not send your name, email address, password, account profile, pantry inventory, dietary or health-related data, location, or payment information to OpenAI. Recognition requests are authorised using your Pantryx account token only, never any OpenAI credentials.

How OpenAI handles the photos

OpenAI processes the photo only to generate the ingredient suggestions Pantryx requests, acting as a data processor on Pantryx's behalf. Under OpenAI's applicable API terms, content submitted through the API is not used to train or improve OpenAI's models. OpenAI may retain API inputs and outputs for a limited period (generally up to 30 days) for abuse and misuse monitoring and then deletes them, unless longer retention is required by law.

International processing

OpenAI processes photos in the United States, so recognising an item involves transferring a downscaled copy of your photo outside the European Economic Area and the United Kingdom. Where required, this transfer is protected by appropriate safeguards such as Standard Contractual Clauses. See "International Data Transfers" below.

Human access to photos

During the temporary retention period, photos may be processed by automated systems and, in rare cases, accessed by authorised personnel only where necessary for debugging, security, abuse prevention, or support.

Limitations

Item recognition may be inaccurate, incomplete, or misleading. You must review and confirm recognised items before relying on them.

You can import a recipe by pasting a link into the App or by sharing a post or video to Pantryx from another app. Supported sources currently include YouTube, TikTok, Instagram posts and Reels, and Threads.

What we retrieve

Pantryx's backend retrieves only publicly available information from the link you submit: the title, caption or description, creator name or handle, and thumbnail. If the caption does not contain a recipe, we may also retrieve the post's images and, where available, a transcript of the video's spoken content. We do not download or analyse the video or audio itself, and we never access your accounts on these platforms.

Who helps us retrieve it

Depending on the platform, this information is retrieved through the YouTube Data API (Google), the platforms' public oEmbed services, or Supadata, a third-party content-retrieval provider that receives the link you submitted and returns the post's metadata or transcript. Only the link is sent to these services, never your account details.

AI extraction

The retrieved text, and post images where needed, are sent through Pantryx's backend to an AI model that extracts a structured recipe (ingredients, steps, and timings). We currently use OpenAI's GPT-4o-mini model; older versions of the App may use Anthropic's Claude Haiku model. Your name, email address, account identifiers, pantry inventory, and dietary or health-related data are not sent to these providers. Under their applicable API terms, this content is not used to train their models.

AI-generated content

Imported recipes are generated by artificial intelligence from third-party content. They may contain inaccurate, incomplete, or missing ingredients, quantities, steps, or allergens, and they are not reviewed by Pantryx. Always check them against the original source before cooking.

Third-party creators

Posts and videos you import may contain the name or handle of their creator. We process this only to show where an imported recipe came from and to link back to the original. If you are a creator and want to object to this processing, contact us at communication.pantryx@gmail.com.

Storage, privacy, and limits

Your submitted links and imported recipes are stored in your account, are private to you, are never shown on public recipe pages, and can be deleted at any time. Retrieved transcripts and images are processed in memory and are not stored. To avoid repeating AI processing, we keep a shared cache of recipes extracted from a given public post, keyed by the post's platform identifier; this cache contains no information about who imported the post. Your imports are counted to enforce the limit of 10 per day and 30 per week.

Some service providers may process personal data outside the European Economic Area (EEA), the United Kingdom, or your country of residence.

In particular, our AI item recognition provider, OpenAI, processes submitted photos in the United States. When you scan an item, a downscaled copy of your photo is therefore transferred to the United States for recognition. Similarly, when you import a recipe from a link, the publicly available post content is processed in the United States by OpenAI (or Anthropic for older App versions) and may be processed outside the EEA by Supadata and Google.

Where required, we use appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, contractual data protection obligations, and provider security commitments to protect transferred data.

You may request more information about these safeguards by contacting communication.pantryx@gmail.com.

The App itself may use local storage, device identifiers, or similar technologies to keep you signed in, remember preferences, maintain security, and support analytics.

Our website, if available, may use cookies or similar technologies for:

• Essential functionality.
• Authentication and session security.
• Preference storage.
• Analytics, where permitted.
• Marketing, only with consent where required.

You can manage browser cookies through your browser settings. You can manage App permissions through your device settings.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

When you request account deletion, we delete or anonymise personal data unless retention is required for legal compliance, security, fraud prevention, dispute resolution, or legitimate business records.

Depending on your location, you may have the following rights:

• Access: Request a copy of personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Withdraw consent where processing is based on consent, including explicit consent for dietary or health-related data.
• Complaint: Lodge a complaint with your local data protection authority.

To exercise your rights, contact us at communication.pantryx@gmail.com. We may need to verify your identity before processing your request.

We aim to respond to privacy requests within 30 days. For complex requests, this period may be extended where permitted by law, and we will notify you if this happens.

You can control your data in the following ways:

• Edit or delete pantry inventory items inside the App.
• Edit or delete dietary and allergy preferences inside the App where available.
• Rename or delete imported recipes and the links you submitted inside the App.
• Withdraw consent for dietary personalisation by deleting relevant profile information or contacting us.
• Delete your account through the in-app account deletion feature or by contacting us.
• Manage camera and photo library permissions through your device settings.
• Unsubscribe from marketing emails through the link in the email, where applicable.

In-App Account Deletion

If you create an account, Pantryx provides an in-app account deletion option. The account deletion flow allows you to request deletion of your account and associated personal data from inside the App.

Deleting your account will remove or anonymise your pantry inventory, dietary preferences, recipe interaction data, account information, and associated personal data, except where retention is required for legal compliance, security, fraud prevention, dispute resolution, or legitimate business records. Original uploaded photos are retained only for up to 24 hours and then automatically deleted.

We use reasonable technical and organisational measures to protect personal data, including:

• TLS encryption for data in transit.
• Password hashing using industry-standard methods such as bcrypt or argon2.
• Access controls for backend and database systems.
• Restricted administrative access.
• Logging and monitoring for security and operational issues.
• Separation of user data from analytics where possible.
• Temporary photo retention limited to up to 24 hours.
• Imported recipes are private to your account and are not exposed on public recipe pages or in our sitemap.

No system can guarantee 100% security. You should use a strong, unique password and keep your device and App updated.

Pantryx is not directed to children under 16. We do not knowingly collect personal data from children under 16.

If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take reasonable steps to delete it. If you believe this has happened, contact communication.pantryx@gmail.com.

If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know, access, delete, correct, and opt out of certain uses of personal information.

Pantryx does not sell personal information and does not share personal information for cross-context behavioural advertising.

To exercise California privacy rights, contact communication.pantryx@gmail.com. We may need to verify your identity before processing your request.

Pantryx is a small independent app and does not currently have a formally appointed Data Protection Officer (DPO). Privacy-related enquiries and data subject requests are handled directly by Pantryx at communication.pantryx@gmail.com.

If you are located in the EEA or UK and believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with your local data protection authority. We would appreciate the opportunity to address your concerns directly before you contact a supervisory authority.

We may update this Privacy Policy from time to time to reflect changes in the App, data practices, providers, legal requirements, or business operations.

Material changes may be communicated through in-app notifications, email, or policy update banners. The updated Privacy Policy will become effective on the date stated in the updated version.

If you do not agree with the updated Privacy Policy, you should stop using the App and may request account deletion.

For privacy questions, data requests, or complaints, contact:

Volodymyr Mendyk
Email: communication.pantryx@gmail.com