AmbryAmbry — Privacy Policy
Effective 8 August 2026.
Ambry is made by one person, Everett Yan. This policy says what the app stores, what leaves your phone, and what you can delete. It is written to be read, not to be survived — if something here is unclear, email me and I will fix the wording.
Contact: everettyan@gmail.com
The short version
- Ambry keeps your kitchen inventory so you can share it with your household and get told before food goes off. That is the whole point, and it is the whole reason data is stored.
- Photos of receipts and groceries are never stored. They pass through the server to an AI provider, which reads the item names off them, and are gone the moment the request finishes.
- There is no analytics SDK, no advertising, and no tracking of any kind, and nothing is ever sold or shared with data brokers.
- You can delete your account, and everything that is only yours, from inside the app.
What Ambry stores
Your account
- The email address you sign up with, and your password (stored only as a hash by the authentication service — I never see it).
- A user id — a random identifier that ties your data to your account.
- A display name, if you set one, so housemates can tell who is who.
- The date the account was created.
What you put in the app
Everything you enter or capture into your kitchen: food items and where they are stored, the storage locations and zones you create, expiry dates, stock status, grocery list entries, notes, household names and invite codes, and your recipes — titles, ingredients, steps, tags, and any recipe photo you add.
Two things about this data are worth being explicit about:
- Household data is shared with your household. Everyone you invite to a household can see and change its inventory, list, and locations. That is what a shared household is.
- Recipe photos are stored (unlike receipt photos — see below), because a recipe without its photo is not much of a recipe. They live in Cloudflare R2 storage under an unguessable key. If you set a recipe to public, its photo and contents become visible to every signed-in Ambry user in the community feed. Private and household recipes are not.
Settings and housekeeping
- Your notification preference, and — if you turn on reminders that arrive from the server rather than from your own phone — a device push token so the notification can reach you, and your phone's time zone, which is the only way the server can know when 8am is where you are. Turning reminders off clears the token.
- Your plan (free or Ambry Plus) and, so the monthly AI allowance can be counted, a ledger row per AI scan holding your user id, the kind of scan, a timestamp, and how many items came back. The ledger never contains the photo or the extracted text.
What Ambry does not store
- Receipt, grocery, and cookbook photos. They travel from your phone through the server to the AI provider and are discarded when the response comes back. Nothing is written to storage, and no image is written to any log.
- Prices, totals, store names, or card details from your receipts. The extraction deliberately asks only for food names, categories, and (optionally) the purchase date. Price tracking is not a feature, and if it ever becomes one this policy changes first.
- Your location. Ambry never asks for it.
- Your contacts, calendar, or photo library at large. The photo picker hands the app exactly the one image you choose, and nothing else.
- Payment details. Subscriptions, when they exist, are handled entirely by Apple. I receive a confirmation that you are subscribed, never a card number.
- Behavioural analytics. No analytics or advertising SDK is present. A crash-reporting library is bundled but is switched off and sends nothing; if that ever changes it will report diagnostics only, and this policy will say so before it ships.
AI processing
Some Ambry features work by sending your input to an AI model. In every case:
- The provider is Anthropic (Claude). Requests go through Anthropic's commercial API, whose terms state that inputs and outputs are not used to train models.
- The call is made by the server, never by the app — the API key never reaches your phone.
- Nothing about who you are travels with the content. The provider gets the photo or the text, not your email or your household.
The features that do this:
- Receipt and grocery photo scanning — the image is sent so item names can be read off it, then discarded (see above).
- Shelf-life estimates — the name of a food is sent so a typical shelf life can be estimated, and the answer is saved to the shared food catalog so nobody has to ask twice.
- Recipe ideas — a summary of what is in your kitchen (food names only) is sent so recipes can be suggested.
- Recipe import — a link you import is fetched by our server, and its text may be sent to our AI provider to extract the recipe. A cookbook photo you import is treated exactly like a receipt photo: sent, read, discarded.
Other services Ambry relies on
| Service | What it does | What it gets |
|---|---|---|
| Neon | Hosts the database and the sign-in system | Your account and everything you save |
| Cloudflare | Runs the API, stores recipe photos, syncs households live | Requests you make; recipe photos |
| Anthropic | The AI model behind the features above | Only the content described above |
| Open Food Facts | Looks up products you scan by barcode | Only the barcode digits — no user, household, or device information |
| Expo | Delivers the daily reminder to your phone, on to Apple's push service | Only while server reminders are on: this device's push token and the text of the notification, which names the food that is going off |
| Apple | Distributes the app and handles any subscription | Whatever Apple's own terms describe; I see no payment details |
Ambry also uses public food data from Open Food Facts (product names, photos and nutrition, under ODbL/CC-BY-SA — credited in the app wherever it is shown) and from the USDA (FoodData Central and FoodKeeper, public domain). None of that involves your data going anywhere.
Deleting your account and your data
Open Profile → Delete account in the app. It asks you to type DELETE, and
then it is immediate and permanent — there is no undo and no grace period.
What goes: your profile and sign-in, all of your recipes including any you published, your recipe photos, and any household where you are the only member, with everything in it.
What stays: households you share with other people — they keep the pantry, the list, and the locations, and you are simply removed. Recipes other people wrote are theirs and are untouched.
Two things worth knowing:
- If you own a household that other people still use, Ambry asks you to transfer ownership first, so their kitchen does not disappear with your account.
- Deleting your account does not cancel an Apple subscription. Cancel it in the App Store, or you will keep being billed. The app links you straight there.
If you would rather not do it in the app, email everettyan@gmail.com from the address on the account and I will delete it by hand.
Security
Every table in the database denies access by default and opens only to the rows you are entitled to — your household's data, your own recipes, plus public recipes. All traffic is HTTPS. AI provider keys live only as server secrets and are never in the app you download.
No system is perfect, and I am one person. If you find something wrong, email me before telling the internet and I will fix it quickly.
Children
Ambry is not directed at children under 13 and does not knowingly collect their data. If you believe a child has created an account, email me and I will delete it.
Changes
If this policy changes materially, the effective date at the top changes and the new version is published here before the change takes effect. Its full history is in the repository's git log, which is public.
Contact
everettyan@gmail.com — questions, deletion requests, or corrections to this page.