Who We Are
Allotd is a Mobiiverse company ("Allotd," "we," "us," "our"). We are the controller of the personal data described in this policy.
Information We Collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, and your first name if you sign in with Apple (Apple Sign-In only ever gives us your first name, not your last name) | Apple Sign-In |
| Onboarding & preference data | Dietary preferences, household size, cooking friction points, recipe-style preferences, your primary reason for using Allotd | Onboarding questionnaire |
| Allergy data (optional, separately consented to) | Any allergies you choose to tell us about — kept only on your device (iOS Keychain), not stored on our servers | A dedicated, opt-in screen — see "The Allergy Field" below |
| Fridge/pantry photos | Photos you take within the app — passed through to OpenAI for ingredient identification and not stored on our servers | Your device camera |
| Recipe & usage data | Ingredients confirmed, recipes generated | Your use of the app |
| Crash/diagnostic data | Device type, OS version, crash logs, tied to a hashed identifier — never your name, email, or IP address | Sentry (see "AI Providers" and "Sharing" below) |
We do not collect biometric identifiers (such as facial geometry) from your photos — photos are processed only to identify food items, not people. Please avoid including identifiable people in your fridge/pantry photos.
We do not currently have any marketing-email, SMS, telephone, or push-notification infrastructure, so we do not contact you through those channels and do not collect data for that purpose.
The Allergy Field and the Allergy Safety Feature
Allergy information is health-adjacent data. Laws including Washington State's My Health My Data Act, the UK GDPR, and the Australian Privacy Act treat this kind of data as requiring its own clear, informed, opt-in consent — not something bundled into a general "I agree to the Terms" action.
For that reason, the allergy field is presented on its own screen, off by default, with a plain explanation of why we ask, before anything is collected. You can skip it entirely and still use the app — recipes just won't be filtered against allergens we don't know about.
If you do provide allergy information, here is exactly what happens to it:
- It's stored only on your device, in your iPhone's Keychain — not in Allotd's servers or database. It stays there, tied to your account, unless you edit or clear it, delete the app, or delete your account.
- When you generate recipes, your declared allergies are sent from your device to our backend as part of that one request, and included in the instructions sent to our AI recipe-generation provider, directing it to avoid those ingredients. This transmission is transient — it's used to generate that response and isn't written to a database on our end.
- Independently of that instruction, our own backend automatically checks every AI-generated recipe against your declared allergen list before responding to your device. Any recipe that appears to match a declared allergen is discarded before it's ever shown to you.
This two-layer process materially reduces, but does not eliminate, the chance that a suggested recipe contains something you're allergic to — an allergen described under an unusual name, or present in a sub-ingredient our filter doesn't recognize, could be missed. This feature is not a substitute for reading ingredient labels, using your own judgment, and consulting a doctor or allergist about your specific needs. You can withdraw your allergy-data consent and delete it at any time from within the app — see "Deleting Your Data" below.
AI Providers We Use
Allotd uses AI models provided by OpenAI to (1) identify ingredients from your fridge/pantry photos, and (2) generate recipe suggestions from your confirmed ingredients, preferences, and allergy information. This means your photos and, if you've provided it, your allergy data, are sent to OpenAI as part of those two functions.
Per OpenAI's published data-controls documentation, data sent through the API is not used to train OpenAI's models and is retained by OpenAI for a limited period (currently up to 30 days) for abuse-monitoring purposes.
How We Use Your Information
We use the information above to: operate and personalize the app; identify ingredients from your photos and generate recipes; apply the allergy-filtering feature; keep the app secure; diagnose and fix technical problems; and communicate with you about your account or material changes to this policy. We do not use your data for advertising, and we do not build advertising profiles about you.
Who We Share Information With
We share limited personal information only with the service providers below, each solely to help us operate the app. We do not share your data with affiliates, business partners, or other users — Allotd has no public/social features, and nothing you enter is visible to other users. We do not sell your personal information.
- OpenAI — receives your fridge/pantry photos and your confirmed ingredients, preferences, and allergy information, as described above, on a per-request basis.
- Supabase — stores your account data (email, first name if provided) and trial status, and handles authentication. Supabase does not receive or store your allergy data — that stays on your device.
- Railway — hosts our backend application servers.
- Sentry — receives crash and diagnostic data tied only to a hashed identifier, with your name, email, and IP address stripped before it's sent, to help us find and fix bugs.
- Apple — processes authentication (Sign in with Apple) and, once subscriptions launch, payment and subscription information as the operator of the App Store.
- RevenueCat (planned, not yet integrated) — will, once integrated, manage subscription status and receipts. We'll update this policy before that goes live.
We may also disclose information if required by law, to protect the rights and safety of Allotd or our users, or in connection with a merger, acquisition, or sale of assets — in which case we'll notify you before your data becomes subject to a different privacy policy.
Information Stored Only on Your Device
Your allergy and dietary-preference data, your name (if provided via Apple Sign-In), and your cook-tracking/recipe-dashboard history are all stored locally on your device — the first two in your iPhone's Keychain, the rest in standard app storage — and are not stored on Allotd's servers. They're sent to our backend only transiently, as part of the specific request that needs them (for example, a recipe-generation request). Because this data never comes to rest on our servers, it isn't subject to the server-side retention or international-transfer practices described below for the categories that are — deleting the app, clearing its data, or deleting your account (see "Deleting Your Data") removes it.
How Long We Keep Your Information
Account and trial data (email, first name if provided, trial status) is kept on our servers for as long as your account is active. When you delete your account, this data is deleted from our database immediately and permanently (see "Deleting Your Data" above for what that means in practice). Allergy, preference, and cook-history data never reaches our servers to begin with — see "Information Stored Only on Your Device" — so there's nothing server-side to retain for those categories. Your fridge/pantry photos pass through our backend to OpenAI for that one request and are not written to a database or file store on our end. Crash data is retained per Sentry's standard retention period. We don't apply a blanket retention schedule to categories of data we don't actually collect (for example, we don't operate a support-ticketing or live-chat system today).
International Data Transfers
Allotd is based in the UAE. Our service providers (OpenAI, Supabase, Railway, Sentry) currently process data primarily in the United States. If you're located in the UK, EU, or elsewhere with data-transfer restrictions, your information may be transferred to and processed in countries that haven't been formally recognized as providing an equivalent level of data protection. Where required, we rely on appropriate safeguards for these transfers, such as our providers' standard contractual clauses or equivalent mechanisms.
Your Rights
Depending on where you live, you generally have the right to access the personal information we hold about you, correct inaccurate information, delete your information, obtain a copy of it in a portable format, and object to or restrict certain processing. You can exercise most of these rights by contacting us — see "Contact Us" below.
We do not sell or share your personal information for money or other valuable consideration, and we do not engage in cross-context behavioral advertising. We honor Global Privacy Control signals as a request not to sell or share your data, though as noted above, we don't sell or share it regardless.
Additional disclosures for California and Washington residents
Allergy information, if you provide it, may be treated as "sensitive personal information" under California law and as "consumer health data" under Washington's My Health My Data Act. We collect it only with your separate, explicit opt-in consent as described above, use it solely to provide the allergy-filtering feature, and don't sell it or use it for advertising. This data is stored on your device rather than our servers (see "Information Stored Only on Your Device"), so deleting it from Settings or deleting the app removes it directly — you don't need to wait on us to process a separate request for that category.
Additional disclosures for UK and Australian residents
Where you provide allergy information, we process it on the basis of your explicit consent (Article 9(2)(a) UK GDPR, or the equivalent "sensitive information" consent requirement under the Australian Privacy Principles). You may withdraw this consent at any time. You have the rights available to you under the UK GDPR and Data Protection Act 2018, or the Australian Privacy Act 1988, as applicable, including the right to lodge a complaint with the ICO (UK) or the OAIC (Australia).
Deleting Your Data
You can delete your account directly in the app: go to Settings → Delete Account. This removes your account and trial record from our servers, and clears your allergy, preference, and cook-history data from your device.
Once you confirm account deletion, it cannot be undone. We cannot restore your account or the data tied to it after that point — your account record is deleted from our database immediately and permanently, not just deactivated.
You can also request deletion by contacting us — see "Contact Us" below — though in-app deletion is faster since it doesn't depend on us processing a manual request. We may need to retain certain information beyond deletion where we have a legal obligation to do so.
Security
We use industry-standard measures to protect your information, including encryption in transit and access controls limiting who can view your data. No system is completely secure, and we can't guarantee absolute security.
Children's Privacy
Allotd is not directed at children, and you must be at least 16 years old to use the app. We do not knowingly collect personal information from anyone under this age. If you believe a child has provided us with personal information, contact us and we'll delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the app before the changes take effect, and update the "Last updated" date above.
Contact Us
Questions about this Privacy Policy, or requests relating to your data, can be sent to us via our contact page.