Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data We Collect

When using ShelfLife, we collect and process the following personal data:

2.1 Account Data

• Name: Shown to the other members of your household, for example in the leaderboard and in notifications
• Email address: For registration, login, and communication
• Password: Stored encrypted for authentication
• Sign-in with Apple or Google: An identifier of your Apple or Google account, so that we recognise you the next time you sign in (see Sections 6.4 and 6.6)

2.2 Usage Data

• Household data: Storage locations and categories you create
• Inventory data: Information about your food items and supplies (name, quantity, expiry date, storage location)
• Household content: Shopping list, meal plan, household actions and points entered by you and the other members of your household
• Invitations: Name and, if provided, email address of the person you invite to your household
• Session data: Login times and device information for security purposes; for sign-ins on the website also IP address and browser identifier

2.3 Voice Processing

When you use the voice input feature – in the iPhone app or with the microphone on the website – your voice recordings are sent encrypted to our server and from there transmitted to OpenAI for transcription; the recognised text is then interpreted by a language model via OpenRouter. The recordings are only used for transcription and are not permanently stored: our server keeps a recording only for as long as the transcription takes, and the app deletes its copy on the iPhone after sending. A recording in the app lasts two minutes at most.

Exception: if you upload an audio file on the website through “Voice Import”, we store the file together with the import until your account or your household is deleted.

If the recognised or typed text becomes a suggestion by the Shelfy assistant, we store the text together with the suggestion in your household. If you add items through Siri, Apple recognises the speech; we only receive the recognised text. See Section 6 (Third-Party Services) for more details.

2.4 iPhone App

For the iPhone app, the following also applies:

• Device and sign-in: When you sign in, the app transmits a random device identifier that iOS assigns separately to each app vendor (not an advertising identifier), the device type, and the iOS and app versions. We use them to manage the signed-in devices of your account.
• Push notifications: If you allow notifications, we store the device token that Apple assigns to your iPhone and use it to send short messages when others in your household change something, such as “Sarah crossed off milk”. A message contains the member's name and the items concerned and is delivered through the Apple Push Notification service (APNs) (see Section 6.4). When you sign out in the app or delete your account, we delete the token; you can turn notifications off at any time in the iOS Settings.
• Data on the iPhone: So that the app works without an internet connection, it stores the shopping list, pantry, meal plan and changes not yet sent on the device. For troubleshooting it also writes a technical log (processes and crash causes, no content of your lists) to the device; the app does not transmit it. If you have allowed sharing analytics with app developers in the iOS Settings, Apple provides us with crash reports.
• Consent to voice and AI features: Before a voice recording goes from the app to OpenAI or a request goes to the Shelfy assistant via OpenRouter for the first time, the app asks once for your consent. You can withdraw it at any time in the app's settings; this does not affect the lawfulness of processing carried out before the withdrawal.
• No tracking: The app contains no tracking, no advertising and no analytics tools. It does not use an advertising identifier and does not pass any data to advertising networks or data brokers.
• Deleting your account: You can delete your account directly in the app (see Section 5).

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b) GDPR): To provide our service and manage your account
• Consent (Art. 6(1)(a) GDPR): For the use of voice input features, for the voice and AI features of the iPhone app (see Section 2.4) and for push notifications
• Legitimate interests (Art. 6(1)(f) GDPR): For the security and operation of our platform

4. Cookies and Session Management

We only use technically necessary cookies:

• Session cookie: Keeps you logged in and enables secure use of the application
• CSRF token: Protects against cross-site request forgery attacks
• Language cookie: Remembers for one year the language in which you use the website

We do not use tracking cookies, analytics tools, or advertising cookies.

5. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your stored data
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate data
• Right to erasure (Art. 17 GDPR): You can request deletion of your data
• Right to restriction (Art. 18 GDPR): You can request restriction of processing
• Right to data portability (Art. 20 GDPR): You can receive your data in a structured format
• Right to object (Art. 21 GDPR): You can object to the processing
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw given consent at any time

You can delete your account yourself at any time: in the iPhone app in the settings, on the website under Settings → “Delete Account”. If you created the household (or it was transferred to you), it is deleted with all its content, for the other members too; as a member of someone else's household, you leave it. More on our support page.

To exercise your rights, please contact us at: info@allonsygmbh.com

You also have the right to lodge a complaint with a data protection supervisory authority.

6. Third-Party Services

6.1 OpenAI (Transcription)

To transcribe voice recordings, we use services from OpenAI, L.L.C. (USA). The following data is transmitted:

• Voice recordings for transcription
• a list of words from your household (names of storage locations, your own categories and recently used items), so that the recognition spells them correctly

OpenAI processes this data according to their Privacy Policy. Data transfer to the USA is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6.2 OpenRouter (AI Features)

All other AI features – the Shelfy assistant, meal suggestions, understanding dictation and voice commands, sorting items into categories and storage locations, ingredient lists for dishes, the search for similar items recognising items in photos and the pictures for meal suggestions – run through OpenRouter, Inc. (USA). OpenRouter forwards each request to a provider that runs the respective model (currently GLM by Z.ai; for photos GPT-4o and for search an embedding model by OpenAI; the meal pictures are generated by an image model by Google, Gemini – it only receives the description of the dish). These providers may be located outside the EU. The following data is transmitted:

• Text inputs and transcribed voice commands, including sentences you dictate to Siri
• Photos you take to recognise items or storage locations
• Names, quantities and storage locations of items, as well as shopping list and meal plan entries, as far as the respective feature needs them
• for the Shelfy assistant and meal suggestions, your display name and the names of your household's members with their weekly points

OpenRouter processes this data according to their Privacy Policy.

6.3 Hosting

Our servers are located in Germany/EU and are operated by GDPR-compliant providers.

6.4 Apple

For the iPhone app we use services from Apple Inc. (USA):

• Apple Push Notification service (APNs): We deliver push notifications through APNs. Apple receives the device token and the content of the notification (the member's name and the items concerned).
• Sign in with Apple: If you sign in with Apple, Apple confirms your identity to us and transmits an identifier of your Apple ID, your email address and, the first time and if you share it, your name. If you choose “Hide My Email”, we only receive a forwarding address from Apple. So that we can revoke the sign-in with Apple when you delete your account, as Apple requires, we store a token from Apple in encrypted form and revoke it on deletion.
• Siri: If you add items through Siri, Apple processes your speech under its own terms; we only receive the recognised text.

Apple processes this data according to its Privacy Policy.

6.5 Resend (Email Delivery)

Emails from ShelfLife – confirmation of your email address, links to reset your password, invitations to a household and messages about your feedback – are sent through the email service Resend (USA). The recipient address and the content of the email are transmitted. Resend processes this data according to its Privacy Policy.

6.6 Google (Sign-in on the Website)

On the website you can sign up and sign in with your Google account. Google then transmits your basic profile (name, email address, profile picture); of this we store your name, your email address and an identifier of your Google account. The provider is Google Ireland Limited (Ireland). Google processes this data according to its Privacy Policy.

7. Data Security

We implement comprehensive technical and organizational measures to protect your data:

• Encrypted transmission: All data is transmitted via HTTPS/TLS
• Password hashing: Passwords are hashed using modern algorithms
• App access keys: The iPhone app keeps its access keys in the iOS Keychain
• Access control: Strict access controls for all systems
• Regular security updates: Continuous updates of our systems

8. Data Retention

We only store your data for as long as necessary for the respective purposes:

• Account data: Until deletion of your account
• Inventory data: Until deleted by you or account deletion
• Archived data: 90 days after archiving, then automatically deleted
• Session data: Until logout or automatic expiration
• Voice recordings: Only for as long as the transcription takes; audio files uploaded through Voice Import until your account or household is deleted
• Shelfy suggestions: The underlying text and the suggestion until the household is deleted
• Devices: The push token until you sign out on the device, the other device details until your account is deleted

When you delete your account, all personal data is permanently deleted.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to adapt it to changed legal requirements or changes to our service. The current version can always be found on this page. We will notify you by email of any significant changes.

10. Contact

For questions about data protection or to exercise your rights, please contact us at: