Privacy policy

Who is responsible for your data

JMS Software & Consulting is the controller for Fridjo. If you have questions about your personal data, email privacy@fridjo.app.

In short

• We only process what the app needs to work.
• Your lists are stored in the EU (Frankfurt).
• We never sell data, show no ads and don't track you across apps or websites.
• None of our providers may use your data to train AI models.
• You can delete your account whenever you want at fridjo.app/delete.

What data we process

Account. Your email address, your name if you sign in with Apple or Google and choose to share it, a random user ID and the app's language. If you sign in with email, we send a one-time code to that address.

What you add. Lists, items and notes, household and occasion names, which households and occasions you belong to, the choices the app has learned (for example that you usually buy semi-skimmed milk) and who added or checked off an item and when.

Voice on iPhone. Speech recognition happens on the phone with Apple's built-in dictation. Fridjo never sends the audio anywhere.

Voice on Android. Speech recognition runs in the cloud, for every language in the app: the audio is streamed from the phone while you speak to Microsoft's speech service (Azure AI Speech) in Sweden, only to show the text as you speak. When you tap stop, the whole recording is sent once through our server to Google's speech recognition (Speech-to-Text) in the EU for the final text, which is then interpreted. The names of items your household often buys are sent along to improve recognition. We never store the audio, and neither Microsoft nor Google stores the audio or the text or uses them to train their models. You can always type instead of speaking.

Interpretation. What you say or type is sent as text, together with the current list and the household's or occasion's usual items, to Anthropic, which turns it into items. The text of voice entries is kept by us for 30 days so we can fix mistakes, then it is deleted. Pictures you choose to send – photos or screenshots of recipes and shopping lists, photos of receipts and shelf photos when you ask your household a question from the store – are also sent to Anthropic for interpretation. Recipe and list pictures are deleted by us right after the import, receipt photos are never stored by us, and shelf photos are kept for 7 days so your household can see them. Anthropic does not use what we send to train its models and deletes it within 30 days, unless it has to be kept longer to stop misuse or because the law requires it.

Interpretation in the free version. In the free version, what you type may instead be interpreted by Google Cloud in the EU. Only the text and its language are sent, not the list or your household's usual items. Under Google's terms the text is not used to train models and is not kept after the answer, unless Google's automated checks flag it as possible misuse – then it may be kept for up to 90 days within the EU for review. Voice and Premium are interpreted as described above.

Recipes. Recipes you save are kept in the household or occasion so everyone in it can see and use them: name, servings, time, type of dish, ingredients, where the recipe came from (written yourself, from the recipe library, a link – then the address is kept – a photo or a screenshot), who saved it and when. If you read in a recipe from a photo or a screenshot, the picture is sent to Anthropic and deleted by us as soon as the recipe has been interpreted. For a link, our server fetches the page and sends the recipe to Anthropic. We keep only the ingredients, never the picture or the method – that stays with whoever wrote the recipe. Which recipes each member has marked as a favourite is stored and shown to the other members. Your favourite marks are included when you download your data and are deleted when you delete your account.

The recipe library. We made the recipes in the app's library and their pictures ourselves with the help of AI (Anthropic for the recipes, Google for the pictures) and reviewed them. They contain no personal data. The free recipes and the pictures are downloaded without sending anything about you; the Premium recipes are downloaded with your sign-in so we can see that you have Premium, and are kept on the phone until you sign out.

Today. The suggestions on Today are worked out on the phone from the recipe library and the household's or occasion's saved recipes. Nothing new is stored or sent for them.

Planning the week. To suggest dinners, the app sends Anthropic: the names, tags (such as vegetarian or cooking time) and a few main ingredients of a selection of library recipes and your saved recipes, which days and how many you are, your wishes, what you type in the field for more wishes (at most 200 characters) and – if you choose “Use what we have” – which items you have at home. No names of people, households, occasions or lists and no items from your lists are sent. What you type in the field is not stored or logged by us; please don't write about health there – choose Lactose-free or Gluten-free instead. Anthropic handles it as described under Interpretation above. When you ask, the app suggests dinners for the coming days. The dinners shown and your choices are kept in the household or occasion for eight weeks. What is kept: the dish, the date, the servings, whether the app or you chose the day and whether it is skipped, whether its items were put on the list and who added the day. For Premium we count how many AI week plans each subscription uses per month (only the number and the cost), so we can keep a reasonable limit. If you photograph your fridge or pantry to show what you have at home today, the photo is sent to Anthropic, which reads out the foods it shows; we don't keep the photo. What you put in “At home now” (typed, said, from the photo or checked off the list) is kept in the household or occasion and shown to everyone in it, with who added or removed what. An item disappears after three days or after the day it is booked for, and removed items are deleted after three days. If you delete your account, the items stay with the household without your name.

The dictionary. Common item names that appear in many households may be used to improve the app's dictionary, without any link to you or your household. We only use names that at least 10 households have entered and that were interpreted the same way, and only the name and which product it is – never who, which household or when. The dictionary lets the app recognise more items right on your phone.

Device and notifications. Push token for notifications, platform, app version and language. The notification text (the household's or occasion's name, a first name and item names) goes through Apple or Google to your phone.

Invitations. If you invite someone by email, we store the address on the invitation. Only the owner of the household or occasion and the person who sent the invitation can see the address.

Purchases. Premium is bought in the App Store or Google Play. We never receive your card details. Our payments service RevenueCat receives your user ID and the receipt so we know Premium is active.

Support. If you email us, we process what you write and your email address so we can reply.

The website. fridjo.app uses no cookies and no analytics. Our host Vercel processes your IP address in technical logs. If you use the form to delete your account, we process the email address you enter and a hashed version of your IP address to stop abuse.

Usage statistics. Unless you turn it off in the app (Account → “Share anonymous usage statistics”), the app sends anonymous usage events to PostHog in the EU: for example that the app was opened, that items were added by voice (counted in ranges, such as 2–5), that a voice entry finished that the Premium page was shown, that a recipe was saved or that a week plan was suggested, with or without AI. The events are tied to a random ID that is created on the phone and replaced when you sign out – never your account, email address or name – and never contain what you type or say, item, list, household, occasion or store names, or your location. We have turned off IP-based location, session recording and automatic capture of screens and taps.

Location. If you search for stores with “Near you”, your phone's approximate location is sent for the search; it is not stored. If you turn on automatic store detection, the app uses your phone's location, also when the app is closed, to notice when you are at a store you have saved. The location itself stays on your phone: only the fact that you are at the store is sent to us and shown to your household or occasion while you are there. You can turn it off at any time in the app or in your phone's settings.

What we don't collect. Your contacts or any advertising ID. Your precise location is never stored by us.

Receipts and expenses

Receipts, prices and expenses are part of Premium.

The receipt photo or file. When you photograph a receipt, the picture is held only in your phone's memory and never saved to your photo library. You can also choose a receipt you have already saved, as a PDF or an image (a screenshot, for example). Fridjo then reads the file in your phone's memory and doesn't copy, change or delete it; an image is made smaller just like a photo. The picture or PDF is sent once through our server to Anthropic, which reads the lines. Fridjo never stores the picture or the file, not even in logs. Anthropic does not train on it and deletes it under its terms (see Interpretation above).

Receipt lines. We keep the store name, time, total and currency, who scanned the receipt, and the receipt's lines (the text, quantity, price, discount and deposit) with the item and list they belong to. Card numbers, payment details and VAT lines are never read in. The lines are kept in the household or occasion and visible to its members, but lines that belong to a list are visible only to those who see that list. When a purchase covers several households or occasions, each one gets only its own lines.

Prices and expenses. Price history and expenses are calculated from the household's or occasion's own receipt lines. Nothing extra is stored, and nothing is shared with other households or occasions or used for statistics.

Payment requests. When you ask someone to pay their share, we keep the amount, the list's item count and amounts, the store, date, message and status. Only the two of you see the request, never the other members. Fridjo never handles money: payment happens in Swish, Vipps or MobilePay, and the person who pays marks the request as paid.

Swish number. If you add your Swish number under Account, members of your households and occasions see it, in the Swish button when they pay you, and nobody else does. You can remove it at any time.

Why, and on what legal basis

• To provide the service – account, lists, sharing, interpretation, voice, recipes, week planning, notifications and sync. Legal basis: contract (Article 6(1)(b) GDPR).
• For security, troubleshooting and stopping abuse – for example technical logs, limits on attempts and keeping transcripts for 30 days. Legal basis: our legitimate interest in a secure, working service (Article 6(1)(f)).
• For purchases – knowing who has Premium. Legal basis: contract. Apple and Google sell the subscription and keep their own accounting records.
• For support – answering your questions. Legal basis: contract or legitimate interest.
• To improve the app – anonymous usage statistics (see above), which you can turn off in the app at any time. Legal basis: our legitimate interest in understanding which features are used and where the app fails (Article 6(1)(f)).
• To improve the dictionary – common item names from many households, without any link to you (see above). Legal basis: our legitimate interest in the app recognising more items right on the phone (Article 6(1)(f)).

The microphone and notifications are only used if you give the app permission on your phone. You can withdraw that permission at any time in the phone's settings.

Providers that process data for us

We use the following processors. They may only process the data to provide their service to us, under data processing agreements, and not for their own purposes.

Apple and Google are themselves responsible for Sign in with Apple or Google and for purchases in the App Store and Google Play. Other members of your households and occasions see your name, what you add to shared lists and who checked off what – but never lists you have marked “Only me”.

Transfers outside the EU

Anthropic is based in the USA and stores data there, but may process it in the USA, Europe, Asia and Australia. Vercel and the notification services operate globally. These transfers rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. For a copy of the safeguards, email privacy@fridjo.app.

How long we keep data

• Account, lists and habits: as long as you have your account.
• Text of voice entries: 30 days.
• Pictures: recipe and list pictures are deleted right after the import, shelf photos after 7 days. Receipt photos and files are never stored.
• Saved recipes: in the household or occasion until you delete them. Deleted recipes are kept as history until the household or occasion is deleted. If you delete your account, the recipes stay there without your name.
• Favourite marks (hearts): until you remove the heart, leave the household or occasion or delete your account. Removed marks are deleted after 30 days.
• Planned dinners: 8 weeks after the day they were planned for. If you delete your account, they stay in the household or occasion without your name.
• What you type as a wish when you plan the week: never stored.
• Number of AI week plans per subscription and month: 24 months.
• Receipt lines, prices and expenses: 24 months, and they are deleted with the household or occasion. If you delete your account, the lines stay there without your name.
• Payment requests: 12 months once paid or skipped, 24 months while still open. They are deleted with the household or occasion, and if you delete your account they stay without your name.
• Checked-off (bought) items: cleared from the list automatically 14 days after they were checked off, and then count as removed.
• Removed or cleared items and lists: kept as history (so the app learns what you usually buy) until the household or occasion is deleted. Then everything is deleted within 30 days.
• Invitations, including invited email addresses: deleted 30 days after they expire or are revoked.
• Notifications waiting to be sent: 7 days.
• Server logs: 7 days. We never log transcripts, item names, email addresses or locations.
• Account deletion requests made on the web: 24 hours at most.
• Support emails: until the matter is closed, 12 months at most.
• Anonymous usage statistics: 12 months.
• Backups: overwritten within 7 days.

Deleting your account

You can delete your account at fridjo.app/delete: enter your email address and we send a link that is valid for 30 minutes. You can also email support@fridjo.app from the address you sign in with. When the account is deleted:

• Households and occasions you own that have other members get a new owner – the member who has been there longest.
• Households and occasions where you are the only member are deleted, with all their lists, items and recipes.
• In other households and occasions you are removed as a member. Items you added to shared lists stay, shown as added by “Former member”.
• Recipes you saved and dinners you planned in households and occasions with other members stay for them, without your name.
• Your own “Only me” lists, your devices, your voice entries, your profile and your account are deleted.
• Households and occasions that have Premium through you lose it, unless another member pays for Premium. Your data at our payment service RevenueCat is deleted.

If you have Premium, the subscription continues until you cancel it in the App Store or Google Play – deleting the account does not cancel it.

Your rights

You have the right to know what data we hold about you and get a copy, to have incorrect data corrected (you change your name yourself in the app), to have your data deleted, to ask us to restrict processing, to object to processing based on legitimate interest and to receive your data in a machine-readable format. Email privacy@fridjo.app – we reply within one month.

Delete individual data. You don't have to delete your account to get rid of data. In the app you can delete items, lists, saved recipes, planned dinners, habits and your Swish number yourself, and you can leave a household or occasion. Voice input text is deleted automatically after 30 days and shelf photos after 7 days; recipe, list and receipt photos are never stored. If you want us to delete anything else, email privacy@fridjo.app from the address you sign in with – we delete it within one month, except what we are required by law to keep.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the data protection authority in the country where you live.

Children

Fridjo is not intended for children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

Security

All traffic is encrypted. The database only lets you see what you are entitled to see in your own households and occasions, and we log as little as possible.

Changes

If we change this policy, we update the date on this page. For larger changes we tell you in the app before they take effect.