Privacy & cookies
Updated October 24, 2026
Information used to run your pantry
Family Pantry uses your email address and account identifier to sign you in and connect you with your family. When you confirm that you are at least 13 years old, we store the confirmation and its timestamp with your user profile. We also store the version, document fingerprint, and server timestamp when you explicitly accept our Terms and Conditions. A confirmed agreement check may be cached in your browser for 24 hours, scoped to your account and the terms version. We clear that browser state on sign-out or when a protected request requires a new agreement. We store family memberships, invitations, recipes, favorites, ingredient prices, meal plans and shopping lists so your household can use them across devices. Family members can access their shared household information.
Google Firebase provides authentication. The site and its database run on infrastructure provided through OpenAI Sites and Cloudflare. These providers process information needed to deliver, secure and maintain the service, including technical request information. Authentication uses browser storage to keep you signed in.
Your cooking size, likes and dislikes are stored to personalize recipes and planning. Category preferences are private to your account; shopping portions are shared with your family. They are not used for advertising.
Family Pantry for Android
The Family Pantry Android app (us.familypantry.app) uses the same account and shared household as familypantry.us. It processes your email address, account identifier, any display name provided by your sign-in provider, household membership and invitations, recipes, favorites, meal schedules, shopping lists, preferences and an optional ZIP code. Google Firebase Authentication processes account credentials, IP addresses, user-agent and app information to sign you in, maintain the service and prevent abuse. Passwords are not stored in the pantry’s offline database.
After an online household download, the app saves a copy of your household, recipes, meal agenda and pending shopping changes in a local database so you can shop offline. Changes reconcile with your household when connectivity returns. Background retry timing depends on Android. Account caches are separate: signing in as another account does not open your previous account’s cache. Signing out keeps that account’s downloaded copy and unconfirmed edits on the device. Android cloud backup is disabled for the app. Clearing the app’s storage or uninstalling removes its local copy and any changes that have not reached the server.
The current Android app does not request GPS location, contacts, health sensors or Health Connect access. An optional typed ZIP code is used for preferences and may identify an approximate area. The packaged app screens contain no advertising SDK or advertising. If you open public website pages, the website advertising and cookie practices below apply to those pages.
Meal planning, recipes and any nutrition or price estimates are for general information and household organization. The app does not provide medical diagnosis or treatment, and it does not record body measurements or medical records.
You can begin account deletion from Household → Account settings & deletion, which opens the website’s account controls. You can also follow our account deletion instructions without installing the app. Remote account deletion cannot erase a copy on a device that is offline; clear the app’s storage on devices you control to remove downloaded information immediately.
Feedback on the website and Android app
You can send feedback while signed in or signed out. Feedback is anonymous by default: we do not attach your account ID, household, account email or device identifier. An optional email is included only if you explicitly select the option to include it. Signed-out visitors can enter a contact email only after opening Feedback; signed-in visitors can opt in to include their account email.
Messages and an email you choose to include are sent over HTTPS to the private, owner-only Family Pantry feedback inbox. We use them to investigate and correct problems and, when you provide an email, respond. We do not publish feedback, share it with advertisers or use it for advertising. Avoid sending passwords, payment information or other sensitive data.
Messages are saved in a separate outbox on your device before sending. Temporary failures retry automatically when connected with the website or app open. Closing, clearing site/app storage or uninstalling before a message is sent can prevent delivery. You can remove an unsent message in Feedback. Feedback sent anonymously cannot reliably be associated with an account deletion request.
We retain feedback until it has been reviewed and addressed. The owner then permanently deletes the message and optional email from the feedback inbox; there is no archive or restore option. Opaque delivery IDs without message content or contact details remain to prevent duplicate delivery after a lost response. Spam controls use short-lived signed checks, a small browser computation, a hidden bot field and connection limits. Daily-rotated keyed hashes are used for rate limits; raw IP addresses are not written to feedback tables. Rate-limit records expire within 48 hours and are removed on a subsequent feedback check. Hosting services process network requests under their operational and security practices.
Location and local prices
Pricing uses a supported store. When there is no nearby store, we resolve the closest supported store using public location references and Kroger’s live location service. You can enter a ZIP code or choose “Use my location.” Your ZIP entry overrides device location for personal pricing. We request location permission through your browser when you choose device location; if permission is already granted and you have no ZIP override, we may locate nearby stores automatically. Denying permission does not prevent ZIP entry or browsing recipes.
Device coordinates are rounded to about one-kilometer precision before our server sends them to the Kroger Locations API to find the closest supported stores. We use those coordinates transiently and do not save them to your account, household, browser storage, or request URLs. Current store choices and individual product-price responses are held temporarily in browser memory; product quotes expire after five minutes and are not written to our price research database by this customer feature. A typed ZIP may be kept in your browser or account preferences; an owner-set household ZIP is shared within that household. Your personal device coordinates are not shared with household members. You can clear your ZIP or revoke location permission in browser settings. Daily-rotated hashed network identifiers may be used briefly for abuse-prevention request limits; the pricing counters contain no coordinates or raw IP addresses.
Public recipes and advertising
Public recipe pages contain the starter recipe library. Your family’s custom recipes, shopping lists and account information are not published in that library. Popular recipes are ranked using aggregate selections of public starter recipes in current family meal plans; this ranking does not publish family names, member identities or custom recipe content. When you import a recipe URL, our server requests the public recipe page and lets you review it before saving a private family copy. We do not send family records or email addresses to advertising code.
We use Google AdSense on public recipe detail pages. Google and its advertising partners may use cookies, local storage, IP addresses and device or browsing information to deliver, personalize and measure ads and prevent fraud. Google may use advertising cookies to serve ads based on previous visits to this or other websites. Ad requests can include the public page URL and technical information. Advertising scripts are not loaded on sign-in or private family pages.
The consent banner lets you accept or decline optional advertising storage. Use “Privacy and cookie settings” in the footer to revisit your choice. A Global Privacy Control browser signal prevents the advertising script from loading on that device, even if you previously accepted. You can also manage personalized advertising in Google My Ad Center, learn how Google uses information from sites that use its services, or review industry opt-out choices. Blocking cookies or ads does not prevent access to recipes; blocking authentication storage may prevent sign-in.
Your information and requests
You can edit and remove meals, ingredients and shopping items within the app. Profile & settings lets you change your preferences, leave a family or delete your account. Family owners can delete their entire shared family. Deleting a family removes its shared data for all members, but does not delete other members’ accounts. Administrative audit references may be retained for security and catalog integrity. For access, correction, account or family data deletion requests, email [email protected]. We may need to verify your identity and whether shared family information belongs to other members. We retain account and family information while needed to provide the service; technical records and backups may remain for operational and security purposes.
Children
Family Pantry is intended for adults managing household groceries. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided personal information.
Terms of use
Our Terms and Conditions govern use of the entire service. Agreement to those terms is separate from optional cookie choices.
Changes
We update this page when our data practices change. The date above identifies the current notice.