Proviant — Privacy Policy

Who is responsible

Proviant is made by Patrik Lackström, an independent developer in Sweden. Questions about this policy: plackstrom@outlook.com.

Under the EU General Data Protection Regulation that makes him the data controller. As set out below, the app itself collects no personal data, so in practice the only thing this applies to is an email you choose to send.

What the app stores on your device

Everything you enter, and nothing more:

• the food you own — products, barcodes, quantities, expiry dates, where in the kitchen it is kept;
• product photos, whether you took them or the app downloaded them;
• your household — a name, and optionally sex, life stage or date of birth for each member, which the app uses only to work out how much energy the household needs per day;
• what has been eaten, wasted or given away, and when;
• your shopping list, meal plan, recipes, food tags and stockpile targets;
• your settings — language, units, theme, which optional features are on.

All of it lives in a database inside the app's own private storage area on your device, alongside the photos. None of it is sent to us. Deleting the app deletes all of it, and there is no copy anywhere else unless you made one yourself using Export or one of the sharing options below.

What the app sends over the internet

Three things, and nothing else.

1. Barcode lookups at Open Food Facts. When you scan a barcode, the app asks the Open Food Facts database what product it is. The request contains the barcode, the name of the app, the name of your device's operating system (for example “ios”), and a contact address for the app — not yours. It contains nothing else: not the rest of your pantry, not your location, and no identifier for you or your phone.

Open Food Facts is an independent non-profit association, not us. Like any web server, theirs records the requests it receives, which includes the IP address they came from. Their own privacy policy is at world.openfoodfacts.org/privacy. If you never scan a barcode, this request is never made — you can enter everything by hand.

2. Product photos from Open Food Facts. If a product you scanned has a picture in their database, the app downloads it and stores it on your device.

3. Importing a recipe from a web address — only if you turn it on. This is off when the app is installed. With it on, pasting a link makes the app fetch that page and read the recipe out of it. The site you pasted sees the request, much as it would if you had opened the page in a browser.

There is no analytics, no crash reporting, no advertising and no tracking of any kind — not in the app, and not in any library it is built on. Proviant does not track you across other apps or websites, which is why it never asks you for permission to.

Sharing a pantry between devices

This is optional and off until you set it up. When you do, the data is encrypted before it goes anywhere.

Pairing two devices by QR code creates an encryption key that stays on those devices. It is never sent to us — we have no server to send it to. Everything that then travels between them is sealed with that key, whether you carry it as an exported file, put it in a shared cloud folder, hand it straight to another phone on your Wi-Fi, or use iCloud. So the cloud provider holding the file holds bytes it cannot read, and so would we.

Nearby devices is a separate switch, off until you turn it on. With it on, the app looks for other phones in your household on the same Wi-Fi and sends your pantry to them directly — nothing goes through the internet or through anyone's server, ours included, and the phones exchange the same sealed bytes everything else does. Your device asks for permission the first time, because iOS requires it for anything that looks around the local network. Turning the switch off stops it, and the app also stops looking whenever it is not the app you are using.

Three things are deliberately outside the encryption, and they are the only three. A file placed in a shared folder is named with the sending device's identifier and the time it was written, so that another device can recognise and skip its own files without having to decrypt them first. And a phone looking for nearby devices announces that same identifier along with a short fingerprint of your household's key, so that two phones can tell whether they belong to the same household before they connect — the fingerprint is derived from the key and cannot be turned back into it, and it changes if the key does.

That identifier is a random value the app generated for itself — not your phone's serial number, not an advertising identifier, not anything the operating system supplies. Nothing about your food appears in a file name or in what a phone announces.

And if you share the pantry over iCloud, Apple knows who you shared it with. That is the third thing, and it is unavoidable: inviting someone is done through Apple's own sharing, so Apple holds the list of Apple IDs on the share in order to let them in at all. What it does not hold is anything about your food — every changeset in the shared area is sealed with your household's key before it is written, and that key never goes to iCloud. The share is labelled "Proviant" and nothing else: not your household's name, not a member's.

iCloud sharing is off until you turn it on, and it takes two steps on purpose. The invitation link lets another person's iCloud reach the sealed data; it does not contain the key that opens it. Pairing that phone by QR code is what carries the key, and until you do, an invited phone holds bytes it cannot read. The app says so before it makes the link.

Camera and photos

The camera is used for two things: reading barcodes, and taking a photo of a product. Reading a barcode happens entirely on your device — no picture is uploaded in order to decode one. A photo you take, or one you pick from your library, is scaled down and stored in the app's own storage. Proviant does not read your photo library for any other purpose.

Notifications

Expiry reminders are scheduled by your own device from the dates you entered. There is no push server, so nothing leaves the device to produce one.

Purchases

Proviant Plus is a one-time purchase, handled entirely by the App Store. The payment is between you and Apple; we never see your name, your card or your address. The app keeps a single local note that the purchase was made, so the features stay unlocked when you have no signal.

If you send feedback

“Send feedback” opens your own mail app with the subject line already filled in. Nothing is sent until you send it. If you do write, your message and your address arrive in an ordinary mailbox, and are used to reply to you and to fix what you reported — nothing else, and they are not passed to anyone. Ask, and they are deleted.

Children

Proviant is a tool for keeping track of a household's food. It collects no personal data from anyone, of any age.

Your rights

The GDPR gives you the right to ask what personal data is held about you, and to have it corrected or deleted. We hold none, so there is nothing to answer — except for an email you have sent us, which is deleted on request.

Your pantry data is a separate matter, because it is yours and already in your hands: Settings → Data & sync will export all of it, and deleting the app erases it.

Changes to this policy

Any change is published on this page with a new date at the top.