Privacy Policy

Effective date: May 12, 2026

1. Introduction

This Privacy Policy ("Policy") describes how Food Butler LLC, a Utah limited liability company doing business as "Food Butler" ("Food Butler," "we," "us," or "our"), collects, uses, discloses, and protects information about you when you access or use our mobile applications, our website at foodbutler.app and any related subdomains, and any other online services that link to this Policy (collectively, the "Service").

By creating an account, downloading our app, or otherwise using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with the practices described here, please do not use the Service.

This Policy is incorporated into and forms part of our Terms of Service, and is governed by the same agreement between you and Food Butler. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Scope

This Policy applies to information we collect:

• Through our mobile applications on iOS, Android, and any other platforms;
• Through our website and any associated web pages;
• In email, text, push notification, and other electronic communications between you and us;
• When you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this Policy.

This Policy does not apply to information collected by:

• Us offline or through any other means, except as expressly stated;
• Any third party, including through any application or content (including advertising) that may link to or be accessible from the Service.

We are not responsible for the privacy, security, or data practices of any third party, including grocery retailers you connect to or visit through the Service (such as Kroger), social media platforms, payment processors, or any third-party app, website, or service you access through the Service. We encourage you to review the privacy policies of any third-party services you interact with.

3. Information We Collect

We collect several categories of information about you, both directly from you and automatically through your use of the Service.

3.1 Information You Provide Directly

• Account information: name, email address, password (stored as a salted hash), profile photo, and authentication identifiers from third-party sign-in providers (Google, Apple).
• Profile and household information: dietary preferences, allergens, calorie and macronutrient targets, household size and members, default servings, preferred grocery providers, time zone, and language.
• User-generated content: recipes you import or enter (including ingredients, instructions, photos, source URLs, personal notes, and ratings); meal plans; grocery lists; pantry inventory; cooking notes; and any other content you upload, post, or transmit through the Service ("User Content").
• Receipt and grocery transaction data: images of grocery receipts you upload; the data extracted from those receipts (store name, line items, quantities, prices paid, dates); and grocery purchase confirmations you choose to share.
• Communications: messages you send to customer support, feedback, survey responses, and any other communications with us.
• Waitlist information: the email address and platforms (iOS, Android, or Web) you submit when you join our waitlist, which form you used, and whether you have confirmed your email address.
• Subscription and billing information: subscription tier, purchase history, and trial status. Payment card numbers and bank account details are processed by Apple, Google, or our subscription manager and are not stored by us.

3.2 Information Collected Automatically

• Device and technical data: device model, operating system and version, unique device identifiers, advertising identifiers (where you have not opted out), language and region settings, mobile network information, time zone, browser type, and screen resolution.
• Usage data: features used, pages and screens viewed, taps and clicks, search queries within the Service, time spent, session duration, crash reports, error logs, and referral source.
• Approximate location data: derived from your IP address (city or region level) for regional pricing baselines, seasonal produce data, and store availability. We do not collect precise GPS location unless you affirmatively grant permission for a feature that requires it.
• Website analytics: our marketing website at foodbutler.app, including the blog and recipe pages, uses Cloudflare Web Analytics to measure traffic and page performance. On each page view it collects the page you visited, the referring website, your browser, operating system, and device type, the country you are visiting from, and page-load performance measurements. Cloudflare processes this information as our service provider. Cloudflare Web Analytics does not use cookies or local storage.
• Cookies and similar technologies: see Section 8.

3.3 Information from Third Parties

• Authentication providers: when you sign in with Google or Apple, we receive the information you authorize them to share, typically your name, email address, and a unique user identifier. Apple Sign-In may provide a relay email address rather than your real address; we do not attempt to circumvent that.
• Connected Kroger account: if you choose to connect your Kroger account (including Kroger family stores such as Smith's), you sign in on Kroger's own website, and we never see or store your Kroger username or password. Kroger gives us an access token that lets the Service add items to your Kroger cart at your direction. We do not request access to your Kroger profile, so we do not receive your Kroger account name, email address, or home address from Kroger. See Section 7.2.
• Affiliate networks: when you follow an affiliate link from the Service to a retailer and make a purchase, the network that runs that retailer's affiliate program (currently CJ Affiliate, which runs Kroger's program) reports the purchase to us so we can be paid a commission. These reports may include an order identifier, the order amount, the commission, and, for some retailers, the products purchased. They do not include your name, contact details, retailer account credentials, or payment information.
• Subscription manager: RevenueCat provides us with subscription status, trial conversion, renewal, and churn data tied to your account.
• Analytics and crash-reporting providers: PostHog, Sentry, and similar providers send us aggregated and event-level usage data to help us understand and improve the Service.

3.4 Sensitive Information

Some information you provide may be considered "sensitive" under certain laws, including:

• Dietary restrictions, allergens, and health-adjacent information. You may voluntarily provide information about food allergies, medical dietary restrictions (e.g., gluten-free for celiac disease, low-sodium for hypertension), or weight and macro targets. We treat this information with heightened care, use it only to operate features you have requested, and do not sell it. Food Butler is not a medical service. The Service does not provide medical advice and is not a substitute for professional medical, dietary, or nutritional advice. See our Terms of Service.
• Precise geolocation, biometric data, and government identifiers. We do not collect these unless explicitly described in a specific feature you opt into.

If you are a resident of Washington, Nevada, or Connecticut, additional protections may apply to "consumer health data" under your state's laws. See Section 13.

4. How We Use Information

We use the information we collect for the purposes described in the table below. Where required by law (including the EU and UK GDPR), we identify the lawful basis for each purpose.

We do not use your information to make solely automated decisions that produce legal or similarly significant effects on you.

5. AI and Automated Processing

The Service uses artificial intelligence to power several features:

• Recipe import and parsing uses Anthropic's Claude API to convert URLs, social media links, and photographs into structured recipe data.
• Receipt processing uses Google Cloud Vision OCR followed by Anthropic's Claude API to extract line items and prices from receipts you upload.
• Meal plan generation uses Anthropic's Claude API to generate suggested weekly meal plans based on the constraints, pantry contents, and recipe collection you provide.
• Ingredient substitution uses Anthropic's Claude API to suggest alternatives.

When we send your data to these AI providers, we send only the minimum information necessary to perform the requested task. Anthropic has contracted with us not to train its general-purpose models on the content you submit through our Service through the API. Our AI providers act as service providers / processors for us and are bound by data processing agreements.

AI outputs are suggestions and estimates only and may contain errors. You are responsible for verifying ingredients, prices, allergens, nutritional information, and any other AI-generated output before relying on it. See the Terms of Service for the full disclaimer.

6. The Price Learning Engine

A core feature of the Service is the Price Learning Engine, which estimates the cost of recipes and meal plans. The data flow is:

1. Day one: every ingredient is initialized with a baseline estimate from public-domain government price data, such as the United States Department of Agriculture's Average Retail Food Prices dataset and the U.S. Bureau of Labor Statistics' Average Price Data.
2. Receipt scanning (premium): when you upload a photograph of a grocery receipt, the image is uploaded to our cloud storage, processed by Google Cloud Vision OCR, and parsed by Anthropic's Claude API into structured line items (product name, quantity, price, store).
3. Price database: extracted prices are stored in your account's price history. Going forward, cost estimates use your receipt-derived prices in preference to the baseline.
4. De-identified aggregation (optional): we may aggregate price data across users, stripped of any account, device, or contact identifiers, to compute regional average prices. You may opt out of contributing to the aggregated regional database in your privacy settings without losing access to your own personalized price history.

You may delete any individual receipt or your entire price history at any time from the Service.

Limitations: OCR and AI extraction are imperfect. Prices in the Service are estimates and should not be relied upon for budgeting decisions where accuracy is critical. See the Terms of Service.

7. How We Share Information

We do not sell your personal information for monetary consideration. We share information only as described below.

7.1 Service Providers and Subprocessors

We share information with vendors that perform services on our behalf and are contractually bound to use it only for those services. Our material subprocessors include:

We may update this list. The current list is available on request to [email protected].

7.2 Grocery Retailers and Affiliate Links

Connecting your Kroger account. Connecting a Kroger account is optional. When you send items to your Kroger cart, we share with Kroger the information needed to do that: the store you select (or the ZIP code you use to find one), product searches based on your grocery list, and the items and quantities you choose to add. Kroger handles this information under its own privacy policy. Product prices from Kroger are shown to you live and are not saved to your price history or used in your budget estimates. We may briefly cache product matches to speed up repeat searches; cached matches expire automatically. You can disconnect your Kroger account at any time in the app's settings, which deletes the access token we hold.

Affiliate links. Some links and buttons that take you to a retailer are affiliate links, and we may earn a commission if you make a purchase. When you follow one, the affiliate network and the retailer may use cookies or similar technologies on their own websites to credit the purchase to Food Butler. We use affiliate tracking only to receive commissions and to measure which features lead to purchases. We do not use it to target ads to you. See our Affiliate Disclosure.

Leaving the Service. When you continue to a retailer's website or app to shop or check out, you are dealing directly with that retailer, which collects your information under its own privacy policy. We receive only the information described in Section 3.3.

7.3 Household and Sharing Features

If you join a household within the Service, other household members may see shared recipes, meal plans, grocery lists, and pantry contents you contribute to the household. Members can see what other members add, edit, or remove. They cannot see your private receipts, payment information, or items you keep outside the household.

7.4 Legal and Safety Disclosures

We may disclose information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request;
• Enforce our Terms of Service or other agreements;
• Detect, prevent, or address fraud, security, or technical issues;
• Protect the rights, property, or safety of Food Butler, our users, or the public.

Where legally permitted, we will notify you of compelled disclosures of your information.

7.5 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you (e.g., by email and a notice on the Service) before your information becomes subject to a different privacy policy.

7.6 With Your Consent

We may share information for any other purpose with your consent or at your direction.

7.7 De-Identified or Aggregated Information

We may share de-identified, anonymized, or aggregated information that does not reasonably identify you for any business purpose, including reporting industry trends or improving the Service.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies (web beacons, local storage, SDKs) to operate, analyze, and improve the Service. Categories include:

• Strictly necessary (authentication, security, remembering your subscription status) — always on;
• Performance and analytics (PostHog, Sentry) — used to understand usage and fix bugs;
• Functional (preferences, language) — used to remember your choices.

We do not use cookies or SDKs for cross-context behavioral advertising and we do not allow third-party advertising networks to track you across the Service. The Service is permanently ad-free.

Affiliate tracking: when you follow an affiliate link from our website or app, the affiliate network that runs the retailer's program and the retailer may set cookies or use similar tracking technologies to credit the purchase to Food Butler. We currently work with one network: CJ Affiliate (Commission Junction LLC), which runs Kroger's affiliate program. See CJ's privacy policies.

These technologies are used to attribute purchases and pay commissions, not to target ads to you. To stop them, block or clear third-party cookies in your browser or device settings, or use your browser's private mode before following a retailer link. Doing so won't affect how Food Butler works for you; we just may not be credited for your purchase.

Forms on our website use Cloudflare Turnstile to tell people apart from automated bots. Turnstile evaluates technical signals from your browser and device for this purpose only; it is not used for advertising.

Our marketing website also uses Cloudflare Web Analytics to measure traffic and page performance. It does not use cookies or local storage. See Section 3.2.

You can control cookies through your browser settings and mobile OS privacy controls (including Apple's App Tracking Transparency framework on iOS, where we always indicate that we do not track you across other companies' apps and websites).

9. Push Notifications, Email, and SMS

If you enable push notifications, we may send you alerts for expiring pantry items, prep-ahead reminders, household activity, and security notices. You can disable push notifications at any time in your device settings.

If you opt into our newsletter or marketing emails, you can unsubscribe at any time using the link in any marketing email or by updating your account preferences. We will continue to send transactional and account-related communications even after you opt out of marketing.

If you join our waitlist, we send one email asking you to confirm your address. Once you confirm, we may email you about the beta and the launch of the Service, and we use your address to give you beta access when your spot opens. You can unsubscribe at any time.

We do not currently send SMS messages. If we do in the future, we will obtain your express consent in compliance with the Telephone Consumer Protection Act (TCPA) and applicable state laws.

10. Data Retention

We retain personal information only for as long as is reasonably necessary for the purposes described in this Policy, including to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Account data: retained while your account is active and for up to 90 days after deletion to allow account recovery and to prevent re-creation by banned users.
• User Content (recipes, meal plans, grocery lists, pantry): retained while your account is active. Upon account deletion, deleted within 90 days.
• Receipt images: retained for 12 months by default for OCR re-processing and dispute resolution; you may delete individual receipts at any time. Extracted line-item data is retained as part of your price history until you delete it.
• Price history: retained while your account is active.
• Connected Kroger account: the access and refresh tokens Kroger issues to us are kept while your account is connected and deleted when you disconnect or delete your Food Butler account. Cached Kroger product matches expire automatically and are never added to your price history.
• Subscription and billing records: retained for at least 7 years to comply with tax and accounting obligations.
• Logs and crash reports: retained for up to 90 days, except where needed for ongoing security investigation.
• Marketing preferences and unsubscribe records: retained indefinitely to honor your choice.
• Backups: deleted in accordance with our backup rotation (typically within 30 days of the deletion event).

When retention is no longer needed, we delete or de-identify the information.

11. Data Security

We use technical and organizational safeguards designed to protect your information, including encryption in transit (TLS), encryption at rest, Row Level Security on database tables, hashed passwords, secrets management, role-based access controls, and regular security review of our service providers.

No system is completely secure. We cannot guarantee that unauthorized third parties will never defeat our safeguards. You are responsible for maintaining the security of your account credentials. If you believe your account has been compromised or you have identified a security vulnerability, contact us immediately at [email protected].

In the event of a personal data breach affecting you, we will notify you and applicable regulators as required by law.

12. International Data Transfers

We are based in the United States, and our service providers are primarily located in the United States. If you access the Service from outside the United States, your information will be transferred to, processed in, and stored in the United States and other jurisdictions where our subprocessors operate.

For users in the European Economic Area, the United Kingdom, and Switzerland, we transfer personal data outside those regions only where:

• The destination jurisdiction has been recognized as providing an adequate level of protection;
• The transfer is governed by Standard Contractual Clauses approved by the European Commission (and the UK addendum, where applicable); or
• Another lawful transfer mechanism applies.

You may request a copy of the relevant transfer mechanism by contacting us at [email protected].

13. State-Specific Privacy Rights (United States)

This section supplements the rest of the Policy for residents of certain U.S. states. To exercise any right described below, contact us at [email protected]. We will verify your identity before responding (typically by confirming you control the email address on your account) and respond within the time required by law.

13.1 California (CCPA / CPRA)

California residents have the right to:

1. Know what categories of personal information we collect, the sources, the purposes, and the categories of third parties to whom we disclose it.
2. Access a copy of the specific pieces of personal information we have collected about you in the prior 12 months (or longer if requested).
3. Delete personal information, subject to exceptions.
4. Correct inaccurate personal information.
5. Opt out of "sale" or "sharing" of personal information. We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising. Accordingly, no opt-out is required, but you may submit a request and we will confirm.
6. Limit the use of sensitive personal information. We use sensitive personal information only for purposes permitted under the CCPA without a separate opt-out (i.e., to provide the Service you requested).
7. Non-discrimination for exercising your rights. We will not deny service, charge different prices, or provide a different level or quality of service because you exercised a privacy right. Our premium subscription is not a "financial incentive" tied to data collection.

Categories of personal information collected (in CCPA terms): identifiers; customer records; commercial information; internet/network activity; geolocation (approximate); audio/visual (recipe and receipt images); inferences; sensitive personal information (account credentials and limited dietary information).

You may submit requests through your authorized agent, in which case we may require proof of authorization.

13.2 Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Iowa, Tennessee, Indiana, Maryland, Minnesota, Rhode Island, and other states with comprehensive privacy laws

Residents of these states have rights similar to California's, including the right to access, correct, delete, and obtain a portable copy of personal data, and the right to opt out of sale, targeted advertising, and certain profiling. We do not engage in sale, targeted advertising, or profiling that produces legal or similarly significant effects. Several of these states (Colorado, Connecticut, Texas, Oregon) recognize universal opt-out mechanisms such as the Global Privacy Control; we honor recognized signals received from your browser.

You may appeal a denial of a privacy request by replying to our response or by contacting us at [email protected]. For Texas residents, you may also contact the Texas Attorney General. For other states, contact your state Attorney General.

13.3 Washington, Nevada, and Connecticut Consumer Health Data

If you are a Washington resident, the Washington My Health My Data Act may apply to certain dietary, allergen, and health-adjacent information you provide. We collect this information only with your consent or as necessary to provide a feature you specifically requested. We do not sell this information. You may request to access, delete, or withdraw consent at any time by contacting [email protected]. Similar rights are available to Nevada and Connecticut residents under their respective laws.

13.4 "Shine the Light" (California Civil Code § 1798.83)

California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

14. EU, UK, and Swiss Data Subject Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the GDPR and equivalent laws:

• Right of access to your personal data;
• Right to rectification of inaccurate or incomplete data;
• Right to erasure ("right to be forgotten");
• Right to restriction of processing;
• Right to data portability in a structured, machine-readable format;
• Right to object to processing based on legitimate interests, including profiling;
• Right to withdraw consent at any time, where processing is based on consent (without affecting prior processing);
• Right to lodge a complaint with your local data protection authority. A list is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise these rights, contact us at [email protected]. The data controller for your personal data is Food Butler LLC, West Jordan, Utah, United States.

15. Children's Privacy

The Service is not directed to children under 13 (or under 16 in jurisdictions where 16 is the relevant age, including the EU under GDPR). We do not knowingly collect personal information from children under those ages. If you are a parent or guardian and believe your child has provided personal information to us, contact us at [email protected] and we will delete the information.

If you are between 13 and 18 (or the age of majority in your jurisdiction), you may use the Service only with the involvement of a parent or guardian.

16. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Policy;
• Notify you through the Service or by email to the address associated with your account at least 30 days before the changes take effect, unless the changes are required by law to take effect sooner;
• Where required by law, request your renewed consent.

Your continued use of the Service after the effective date of the updated Policy constitutes acceptance of the changes.

17. Contact Us

If you have questions about this Policy or want to exercise your rights, email Food Butler LLC at the address below that fits your request.