Privacy Policy — Hungry Shelf
Effective date: 2 September 2026 Last updated: 12 October 2026 Version: 1.4
The short version
Hungry Shelf is a personal recipe organiser. Your recipe library and cookbooks live on your phone (local database). You can use the app without an account ("guest mode").
If you sign in, your recipes, cookbooks and grocery list are copied to our servers (via Supabase) when you sign in and again after you change them, so they survive a phone change. Meal Planner logs stay on your phone.
Link import (Instagram, TikTok, Pinterest) works as a guest or signed-in; it sends the URL you shared to our servers and AI providers. Photo scan and hands-free cook mode require a signed-in account. Photo scan sends a resized image to OpenAI vision (we do not store the image). Cook mode streams microphone audio live to OpenAI Realtime over WebRTC (we do not keep that audio). The Meal Planner sends the meal you type or say to OpenAI for a calorie and macro estimate (we do not store it). Subscriptions are bought through the App Store or Google Play and managed with RevenueCat.
Hungry Shelf shows no advertising on any tier. We collect email (and name / avatar URL if Google or Apple supplies them) only when you create an account. We do not use an advertising, analytics or crash-reporting SDK, and we do not send marketing push notifications.
Please read this Policy together with our Terms of Use.
1. Who we are
This Privacy Policy explains how Udaya Shree Donthula, an individual / sole proprietor trading as Hungry Shelf ("Hungry Shelf", "the app", "we", "us", "our"), collects, uses, stores, shares and protects your personal data when you use the Hungry Shelf mobile application and related services.
We are the Data Fiduciary in respect of the personal data described in this Policy, as that term is defined under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
| Data Fiduciary | Udaya Shree Donthula (individual / sole proprietor), trading as Hungry Shelf |
| Address | H.No. 8-8-30, Nehru Nagar, Sircilla – 505301, India |
hungryshelfinfo@gmail.com |
There is no separate company, Data Protection Officer, or EU/UK representative. Privacy questions, data requests and grievances go to the email above (see also Section 11).
2. How the App is built — please read this
2.1 Guest mode — on your device
You can browse, save and organise recipes without an account. Guest mode means you are signed out. Your recipes, cookbooks and most settings are stored in the app's private database on your device.
Because that data lives on the device:
- If you uninstall the app, clear its data, reset the phone, or lose the device without signing in and merging, that library can be permanently lost and we cannot restore it.
- Guest link imports still hit our servers (see §3.4) because extraction runs in the cloud — but we do not create a cloud recipe library for guests.
2.2 Signed in — sync to our servers
When you sign in (email/password, Google, or Apple), the app runs a guest merge: it uploads your local recipes, cookbooks and grocery list to our backend and pulls down what is already linked to your account. The working copy you edit day to day is still the on-device database.
- Recipes, cookbooks and your grocery list are pushed to our servers in the background after you change them while signed in.
- Meal Planner logs (what you ate and the estimates) are stored on your device only.
2.3 Features that leave the device
| Feature | Account required? | What leaves the device |
|---|---|---|
| Link import | No (guest allowed) | Source URL; fetched captions/transcripts/page text sent to AI for extraction |
| Photo scan | Yes | Resized image (base64) → OpenAI vision; draft text returned |
| Hands-free cook mode | Yes | Live mic audio + recipe text → OpenAI Realtime via WebRTC |
| Onboarding quiz | No locally; cloud copy if signed in | Goals / sources you pick |
| Meal Planner estimate | No | The meal text you type or say (speech is turned into text by your phone's built-in Apple or Google speech recognition) → OpenAI; calorie and macro estimate returned |
| Ingredient pictures | No | Ingredient names → OpenAI, to find the English name that matches a bundled picture |
| Grocery list | Only for the cloud copy | List items and the dishes they belong to, when signed in |
| Subscriptions | No | Purchase receipts and an app user ID (your account ID when signed in) → RevenueCat |
3. Personal data we collect
We collect only what is listed below for running the app — not for advertising or profiling.
3.1 Account data — only if you create an account
| Data | Required? | Why we collect it |
|---|---|---|
| Email address | Yes, for account | Identify your account, sign you in, recover access, support and deletion |
| Password | Email sign-up only | Authentication — handled by Supabase Auth (hashed; we never store plain text) |
| Display name | If you or Google / Apple supply it | Shown in the app (from auth user_metadata) |
| Profile picture URL | If Google / Apple supply it | Shown as avatar. We do not upload or host the image file |
| Account ID | Automatic | Links server-side recipes, onboarding rows and import jobs to you |
We do not receive your Google or Apple password. Apple's "Hide My Email" is supported — we only see the relay address Apple gives us.
Our profiles table stores your account id and timestamps — not a separate copy of email/name/avatar columns.
3.2 Content you create
| Data | Where it is stored |
|---|---|
| Recipe fields (title, ingredients, steps, notes, ratings, cooked dates, timers, source links, cover URLs, etc.) | On device; a copy on our servers while you are signed in |
| Cookbooks and which recipes are in them | On device; a copy on our servers while you are signed in |
| Grocery list items | On device; a copy on our servers while you are signed in |
| Meal Planner logs (meals, portions, calorie and macro estimates) | On device only |
3.3 Onboarding answers
Goals and recipe sources you pick during setup are stored in on-device preferences. If you are signed in, they may also be upserted to our user_onboarding_responses table. Used to tailor the app; not for advertising.
3.4 Import data (link import)
When you import from a link, we create an import job on our servers containing the source URL, status, timing, error codes and an extracted recipe draft. Guests and signed-in users can create jobs (guests use the anonymous API key).
Rate limits (abuse prevention):
- Guest (no account): about 10 imports per hour per IP address
- Signed-in: about 60 imports per hour per user
We read the client IP from standard proxy headers for that counter. It is used for rate limiting, not for building a marketing profile.
Device free-tier caps (stored only on the device): limited full video/link extractions, daily caption-only imports, and photo scans — shown in the app.
3.5 Photos (recipe photo scan)
Photo scan requires a signed-in account. The app resizes the image and sends it to our Edge Function, which forwards it to OpenAI vision. We do not write the image to our database or file storage — only the returned recipe draft text (if you save it).
Camera and photo-library access are requested only for this feature. Server-side fair-use limit: about 20 photo scans per hour per user.
3.6 Microphone and voice (hands-free cook mode)
Cook mode requires a signed-in account. The app opens a WebRTC session to OpenAI Realtime (ephemeral credentials minted by our server). Microphone audio is streamed live; recipe title, ingredients and steps are sent as session context.
Hungry Shelf does not record cook-mode audio to files or keep it in our database. When you leave cook mode, the session ends and the mic track is released. Session minting is rate-limited (about 30 per hour per user). A Google STUN server may see connection metadata needed to set up the WebRTC link.
OpenAI processes the live stream under its API terms; we do not control their internal processing beyond using their API.
3.7 Purchases
Hungry Shelf Plus and Pro are sold through Google Play / Apple App Store. We use RevenueCat to validate purchases and know which plan is active. RevenueCat receives the store purchase receipts and an app user ID — your account ID when you are signed in, otherwise a random anonymous ID. We never see your card. The app also keeps a local copy of your subscription status (and related trial/prefs) in on-device preferences.
3.8 Device settings and quotas
Stored only on your device, for example: units, voice hints, keep-screen-on, language, onboarding completion, free-tier and monthly import counters, Meal Planner logs, and the cached subscription status.
3.9 What we do not collect or do
Hungry Shelf does not:
- Show advertising, or embed an advertising SDK, on any tier
- Collect or use an advertising identifier (Android Advertising ID, Apple IDFA)
- Use a separate analytics or crash-reporting SDK for product analytics
- Send marketing or promotional push notifications
- Collect contacts or calendar data, or read health data from Apple Health or Google Fit
- Store your Meal Planner logs on our servers
- Sell your personal data for money
- Train our own models on your content
AI calls go through provider API endpoints. Providers' default API policies typically disallow training on API data; their privacy terms still apply.
4. Why we process your data
- Create and secure your account when you sign in.
- Provide the on-device library and, while signed in, server-side backup of recipes, cookbooks and grocery list.
- Run link import, photo scan, cook mode and Meal Planner estimates when you use those features.
- Enforce free-tier, monthly import and abuse rate limits.
- Process subscriptions via the app stores and RevenueCat.
- Diagnose failed imports and keep the service secure.
- Respond to support, grievances and rights requests under the DPDP Act and other law.
- Comply with law and lawful requests from authorities.
We will not use personal data for a new purpose without telling you and, where required, asking for fresh consent.
5. Legal basis and your consent
Under the DPDP Act (India): consent for the features you use (Section 6), and where allowed legitimate uses under Section 7 (for example legal obligations).
Where GDPR / UK GDPR applies, we also rely on:
| Purpose | Legal basis |
|---|---|
| Provide the app, merge recipes when you sign in | Performance of a contract |
| Link import / photo scan / cook mode / Meal Planner estimates you start | Contract and/or consent (camera, mic) |
| Rate limits and abuse prevention | Legitimate interests |
| Diagnose failed imports | Legitimate interests |
| Store subscriptions | Performance of a contract |
| Comply with law | Legal obligation |
We do not make automated decisions with legal or similarly significant effect about you.
5.1 Consent is per feature
- Account — email / Google / Apple sign-in
- Cloud copy — recipes, cookbooks and grocery list, when you sign in
- Meal Planner — the meal you type or say, when you ask for an estimate (mic optional)
- Link import — URL you choose to import
- Photo scan — camera/photos + image upload (signed-in)
- Cook mode — microphone + live audio (signed-in)
- Purchases — via Google Play or the App Store
Guest mode works without an account. Refusing camera or mic in system settings disables those features.
5.2 Withdrawing consent
Revoke permissions in device settings, delete content in the app, or delete your account (§9). Withdrawal does not undo lawful processing already done; the related feature stops working.
6. Who we share your data with
We do not sell your personal data for money, and we do not share it with advertising networks — the app runs no ads.
6.1 Service providers
| Provider | What it receives | Purpose |
|---|---|---|
| Supabase | Auth, account id, synced recipes, cookbooks and grocery list, onboarding rows, import jobs, rate-limit buckets | Backend, auth, database, Edge Functions |
| OpenAI | Import text / transcripts / page content; scan images; live cook-mode audio + recipe context; meal descriptions; ingredient names | Extraction, Realtime voice, meal estimates, ingredient name matching |
| RevenueCat | Store purchase receipts, app user ID (account ID when signed in), subscription status | Purchase validation and subscription management |
| Supadata | Import URLs (metadata / transcripts / extract stages) | Social/video fetch for import |
| Jina Reader | Some web URLs (e.g. Pinterest article fetch) | Page text for import |
| Instagram / TikTok / Pinterest oEmbed | Public post URL | Public metadata for import |
| Google Sign-In / Apple Sign in with Apple | Auth tokens / profile fields they return | Sign-in |
| Google STUN | Connection metadata | WebRTC setup for cook mode |
| Google Play / Apple App Store | Purchase transaction | Billing |
6.2 Legal disclosures
We may disclose data where required by law or in good faith to comply with a lawful request, enforce our Terms, or protect users or Udaya Shree Donthula.
6.3 Business transfer
If Hungry Shelf is sold or transferred, personal data may move with it. We will notify you before a different privacy policy applies.
7. Where your data is stored
- On device: recipes, cookbooks and grocery list (working copies), Meal Planner logs, settings, usage counters, cached subscription status.
- Supabase: auth, synced recipes, cookbooks and grocery list, onboarding responses, import jobs, rate-limit buckets — infrastructure may be outside India (commonly including the United States).
- RevenueCat: purchase receipts and subscription status, often outside India.
- OpenAI / Supadata / Jina: processing for the features above, often outside India.
Under the DPDP Act, cross-border transfers are allowed except to countries restricted by notification. Your access, correction and erasure rights still apply to copies we control. Where GDPR/UK GDPR requires it, providers' Standard Contractual Clauses or equivalent safeguards may apply.
8. How long we keep your data
| Data | Retention |
|---|---|
| Account | Until you delete the account |
| Cloud recipes, cookbooks, grocery list / onboarding rows | Until you delete them or the account (cascade on account delete) |
| Purchase records at RevenueCat | As long as needed to manage your subscription and meet accounting obligations; email us to have them deleted |
| Meal descriptions sent for estimates | Not stored by us after the estimate is returned |
| On-device library, cookbooks, grocery list, Meal Planner logs, settings | Until you clear app data / uninstall, or delete account in-app (clears local recipes/cookbooks) |
| Import jobs (URL, status, draft) | On account delete, profile_id is set to null (detached, not instantly wiped). Guest import jobs are also stored with no profile. A scheduled job deletes rows with profile_id is null older than 90 days (purge_detached_import_jobs) |
| Rate-limit counters (IP / user) | Rolling one-hour windows for enforcement; bucket rows are operational data, not a profile |
| Scan images | Not stored by us after the request finishes |
| Cook-mode audio | Not stored by us |
| Support emails | As needed to resolve the request, then typically up to 24 months unless law requires longer |
Local free-tier / Plus preference flags may remain on the device after account deletion until you clear app data — they are not your cloud account.
9. Your rights
9.1 Under the DPDP Act (India)
Access, correction, erasure, withdraw consent, grievance redressal, nomination (email us to register a nominee), and complaint to the Data Protection Board of India. These cover data we hold on our servers. On-device-only data (including cookbooks) you control by editing the app or clearing app storage.
9.2 Delete your account
In the app: Profile → Settings → Delete account (calls our delete_own_account RPC, then clears local recipes/cookbooks).
Without the app: email hungryshelfinfo@gmail.com from your account email with subject "Delete my account". See delete-account. We respond within 30 days.
Deleting the account does not cancel a Plus or Pro subscription — cancel in Google Play or App Store settings.
9.3 Verifying it is you
We may require email from the address on the account (or Apple relay) before acting.
9.4 California (CCPA/CPRA)
We do not sell personal information for money, and we do not share it for cross-context behavioural advertising in the sense used by the CCPA/CPRA — the app carries no advertising. You may exercise rights to know, delete and correct using the contacts above; we will not discriminate against you for doing so.
9.5 EEA / UK
Where GDPR/UK GDPR applies, you may also request restriction or object to legitimate-interest processing, and complain to your local authority. Prefer contacting us first at hungryshelfinfo@gmail.com.
10. Security
Reasonable safeguards we use include:
- HTTPS/TLS to our backend and providers
- Passwords handled by Supabase Auth (hashed)
- Row-level security so one account cannot read another's server recipes
- Server rate limits on import, photo and voice session endpoints
- Not retaining scan images or cook-mode audio in our systems
No system is perfectly secure. Protect your device with a screen lock.
11. Grievances and how to contact us
| Grievance Officer | Udaya Shree Donthula |
hungryshelfinfo@gmail.com | |
| Address | H.No. 8-8-30, Nehru Nagar, Sircilla – 505301, India |
| Response time | Aim to acknowledge within 72–120 hours; resolve within the period required by law and no later than 90 days |
You may also complain to the Data Protection Board of India.
12. Personal data breaches
If a breach affects your data, we will tell you without undue delay in plain language, and report to authorities required by law (including, where required, the Data Protection Board of India and CERT-In) within applicable timelines.
13. Children
Hungry Shelf is not directed to children. Age rules are in our Terms of Use. We do not knowingly collect children's data. If you believe we have, email hungryshelfinfo@gmail.com and we will delete it. DPDP rules on children's data apply where relevant; we do not knowingly offer the service to children under that Act.
14. Changes to this Policy
Material changes (new data categories or purposes) will update the date above and be notified in the app or by email where practicable; fresh consent where required. The "Last updated" date shows the latest revision.
15. Language and territory
This Policy is published in English. Hungry Shelf is operated from India. The app may be available in other countries via Google Play and the App Store. Non-excludable local rights still apply. Other Eighth Schedule languages: email us and we will provide one where reasonably practicable.
Udaya Shree Donthula, trading as Hungry Shelf H.No. 8-8-30, Nehru Nagar, Sircilla – 505301, India hungryshelfinfo@gmail.com