LeftoversPrivacy Policy & Terms of Service
The short version
- What Leftovers does. You point your phone camera at your fridge, pantry, or a food-bank box. AI names the items and the app suggests meals you can make from what you already have.
- There is an account, and you never had to make one. The first time you open Leftovers it quietly creates a private cloud account for your device. No email, no password, no sign-up.
- What we collect: the food in your kitchen and what you do with it, plus a little usage data. No name. No email address. No phone number. No location.
- Photos: a scan photo goes to AI providers to name the food and is not kept — unless you turn on “Help improve accuracy,” which keeps it up to 30 days and then deletes it.
- We do not sell personal information, and there are no ads. We may one day sell grouped, area-level food trends — described plainly below. It is not running today.
- You can delete your account and its data yourself, in two taps — or at grableftovers.com/delete-account if you've already uninstalled.
- Kids: Leftovers isn't built for children under 13 and we don't knowingly collect their data.
1. The account we make for you
The first time you open Leftovers, the app signs you in to an anonymous account on our backend. You don't create it, you don't see it, and it holds no name, no email address, and no password — it is a random identifier and nothing more.
We do it this way on purpose: it is what lets your kitchen come back after you close the app, follow you to a second phone, and be shared with the people you live with — without ever asking a family at a food bank to make an account.
Two things follow from an account with no email and no password:
- We cannot look you up. If you write to us, we can only find your data if you tell us your kitchen's 6-character join code.
- You cannot recover it. If you clear your browser storage or delete the account, it is gone. There is no “forgot password” for an account that never had one.
2. Your kitchen is shared — what a “household” means
A household is one shared kitchen. Anyone you give your 6-character join code to can join it, and everyone in it sees and edits the same food list, cooking history, and recipes. That matters in two directions:
- Inside a household there is no privacy between members. If you add food, everyone in the kitchen sees it. Only give your join code to people you'd hand your fridge to.
- Between households there is a hard fence. Every row carries a household id, and the database refuses to return a row to anyone who isn't a member of that household. That fence is enforced by the database itself, not by app code that could be bypassed.
3. What we collect
Everything below is tied to your anonymous account or to your household — never to a name.
| What | Specifically | Where it lives |
|---|---|---|
| Your food | Item name, category, where it's kept, quantity, unit, whether it came from a food box or a store, an expiration date if you type one, when it was added, and when/why it left (cooked, wasted, donated) | Your device and our database |
| Meals you logged | The meal's title, whether it was one of ours or one of yours, and the plain-text list of items it used | Your device and our database |
| Scan events | That a scan happened, how many items it found, whether it was a food-box scan. Not the photo, not the item names | Our database |
| Your household | The 6-character join code, who's in it, and — if you arrived through a food bank's coded card — which organization's card it was (the organization, never the family) | Our database |
| Kitchen profile | Cooking space, equipment, cultural food traditions, dietary restrictions and allergies you tell us about | Stored on your device. When you ask for meal ideas, these details are sent through our server to one or more of our AI providers — Google, OpenAI, or Anthropic — only to generate those meals under their no-training API terms. We do not store your kitchen profile in our database |
| Grocery list, cooking history, disliked meals and language | As you set them | Your device only |
| The US state you pick for help programs | Your two-letter state choice (for example, AZ) | The selection is stored on your device. A de-identified state code is also sent to GoatCounter for analytics; it is not sent with your account ID |
| Scan corrections (only if you opt in) | What the scan guessed vs. what you corrected it to, and the language | Our database |
| Scan photos (only if you opt in) | The photo itself, for up to 30 days | Private storage bucket |
| Notification setup (only if you opt in) | The push address your browser generates for that device, its keys, and which reminders you want | Our database |
| AI usage ledger | That your account made a scan or meal request, and when. Used to stop runaway costs and abuse. No content | Our database |
| Published recipes (only if you publish one) | Title, ingredient names, your optional note | Our database, and public |
| Usage analytics | Which screens and buttons, and counts | GoatCounter |
What we do NOT collect
No name. No email address (unless you email us). No phone number. No password. No GPS or precise location. No street address. No date of birth, age, income, or Social Security number. No contacts, no calendar, no access to your photo library beyond the picture you choose to scan. No advertising identifier. No tracking cookies.
ZIP code — optional, and only if you type it in. There is a ZIP field on the resources screen, next to where you pick your state. It is there so we can find deals and programs near you, and so we can understand what people in an area are actually eating and cooking. You can leave it blank — the app falls back to your state and everything still works. Five digits is as precise as it gets: we never ask for your street address, and a ZIP covers thousands of homes.
When we report on an area — to a food bank about its own program, or to a food brand about what a region eats — we never report a group smaller than 20 households. Below that we roll the number up to the county or the state instead. It is a rule in the code, not a promise in a policy: a number that small cannot be produced, so it cannot be shared. We never sell information that identifies you.
Sensitive information. Your dietary restrictions, allergies and food traditions are stored on your device. When you ask for meal ideas, they are sent through our server to Google, OpenAI, or Anthropic only to generate suggestions that fit your profile. The providers process them under their no-training API terms. We do not use these details to train models, store them in our database, sell them, or send them to analytics.
4. Scan photos, and the AI that reads them
When you scan, the photo is sent from your phone through our own server function to AI vision providers, which return a list of the food they can see. We use three providers and compare their answers, because one model alone invents items:
- Google (Gemini models)
- OpenAI (GPT models)
- Anthropic (Claude models)
The photo goes to them to answer that one question, and then it is gone. We do not write it to our database or our storage. What we keep is the resulting list of food names.
The one exception, and it's yours to make
If you turn on “Help improve accuracy” — off unless you switch it on, at the scan screen or in Settings — that scan's photo is saved to a private storage area, together with what the scan got wrong and what you corrected it to, so the app can be taught to recognize food better. Those photos:
- sit in a private bucket that no other user, and no public link, can read;
- are limited to 8 MB and to JPEG/PNG/WebP;
- are automatically and permanently deleted after 30 days by a job that runs every day — and the record is only marked deleted once the file is actually gone, never before;
- are deleted immediately, with everything else, if you delete your account and no one else is left in your household.
You can turn “Help improve accuracy” off at any time in Settings.
Scan photos should show food, not people. Please keep family members — especially children — out of the frame. If we find a person in a saved training photo, we delete that photo.
5. Voice input
Some screens let you speak instead of typing. That uses your browser's own speech recognition. On most Android browsers this means your browser sends the audio to its own vendor's speech service (for Chrome, Google's) under that vendor's privacy policy, not ours. Leftovers never receives or stores the audio — only the text your browser hands back, which you then confirm. If you'd rather not, don't use the microphone button; typing does the same job.
6. The Community Cookbook — the part that is public on purpose
If you tap “Share to community” on one of your own recipes, its title, ingredient names, and any note you wrote become publicly readable by anyone using the app.
What is not published: your account, your household, your join code, any photo, any name. The public feed is served by a database view that does not contain the household column at all, so there is no identity there to leak.
You can unpublish at any time. Published recipes belong to the household, not to the individual who tapped the button — which is why they follow the household rule below.
7. How we make money, and the data we might sell
We want to be straight with you, because most apps aren't.
Today: nothing. Leftovers is free. There are no ads in it, no coupons in it, and nothing is sold. The app links out to Instacart so you can order what you're missing; those are plain links with no affiliate or tracking code on them, and we earn nothing from them today. If that changes we will say so here before it goes live.
Later, maybe: grouped area trends. Leftovers may sell anonymized, area-level food-usage insights — things like “households in this area cooked a lot of beans this quarter” — to food brands, grocers, and researchers, to keep the app free. If we do:
- We will never sell information that identifies you — not a name, not an email, not a phone number, not a single household's kitchen, not a location more precise than an area.
- No area/month/item figure can be produced unless at least 20 separate households stand behind it. That threshold is written into the database view itself, not into a promise: a figure fewer than 20 households support does not exist to be sold.
- We will not sell dietary or allergy details (which never leave your phone anyway), nor household-level food-bank participation.
- We will never try to re-identify anyone from those figures, and anyone who receives them must promise the same in writing before they get them.
A fact worth stating plainly: as of the date at the top of this page, that insights report produces nothing at all, because it groups by area and the app has never collected an area from anyone. To run it we would have to start asking for something we don't ask for today — and we would tell you first.
8. Analytics
We use GoatCounter for basic usage counts — which screens people open, whether a scan finished, whether a meal got cooked. No cookies, no ad network, no cross-site tracking, no fingerprinting, which is why the app has no cookie banner.
Product telemetry is de-identified by an allowlist in the code: numbers and yes/no flags always go, and text is sent only for a short list of fixed options. That list includes a removal reason and the two-letter US state code selected for help programs. The state selection remains stored on your device, while the de-identified state code is sent to GoatCounter without your account ID. Food names, meal titles, profile details and notes are dropped before anything is sent to analytics.
9. Who we share data with
- AI providers (Google, OpenAI, Anthropic): the scan photo and your item list, to name food and suggest meals.
- Infrastructure: Supabase (database, accounts, storage) and Netlify (hosting, server functions), who process data on our behalf to run Leftovers.
- Your browser's push service (Google, Apple, Mozilla, depending on your device), if you turn on notifications — that is how a reminder physically reaches your phone.
- GoatCounter, for the de-identified counts above.
- Anyone, for a recipe you deliberately publish.
- Food banks, funders, and partners: grouped, anonymized impact numbers — meals made, what got used, what got wasted. Never one family's kitchen.
- Legal and safety: if the law requires it, or to protect people from harm.
- Business transfer: if Leftovers is acquired or merges, data may transfer as part of the deal, still subject to this policy.
We do not share your data with advertisers, data brokers, or anyone else not on this list.
10. Deleting your account and your data
In the app, two taps: the gear in the top-right → “Privacy — how your data works” → “Delete my account and data.” Type DELETE, confirm, and it happens immediately.
After you've uninstalled: grableftovers.com/delete-account (also in Spanish) explains how to get back in, and how to ask us to do it by email using your join code.
| What | What happens |
|---|---|
| Your cloud account | Deleted. Removed — not deactivated, not hidden |
| Your membership in the kitchen, and your devices' notification settings | Deleted |
| Your AI usage ledger rows | Deleted |
| Everything on your phone | Wiped — kitchen, cooking story, grocery list, profile, language, the lot |
| The kitchen's shared data — food, meals, scans, corrections, training photos, published recipes | Deleted if you are the last member. If other people are still in that household, it stays with them |
The shared-household exception, stated plainly
A household's food list is the property of everyone in it. If you leave a kitchen your family is still using, we sever your account from it and leave their food alone. Deleting a family's dinner plans because one member left would be the wrong answer, and leaving shared records with the remaining members is the standard treatment for shared data. If you want the whole kitchen gone, everyone in it has to leave it.
Timing. In-app deletion is immediate. Email requests are completed as soon as we can, and within 30 days.
Your other rights. You can ask what we hold about you, ask us to correct it, ask us to delete it, and — if there is ever anything to opt out of — opt out of the sale or sharing of personal information. We honor these for everyone, including residents of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, and other states with comparable laws, and we honor recognized opt-out preference signals such as Global Privacy Control where required. Email privacy@grableftovers.com with the subject “Privacy Request.” Because your account carries no name or email, we may only be able to act on a request that includes your join code; if we cannot reasonably link a request to data we hold, we will tell you so. You may use an authorized agent where the law allows.
We will never treat you worse for exercising any of these rights.
11. How long we keep things
| What | How long |
|---|---|
| Your account, your kitchen, your food and meals | Until you delete your account, or the last member of your household does |
| Scan photos (opt-in only) | Up to 30 days, then deleted automatically by a job that runs every day |
| Scan corrections (the text labels) | Kept after the photo goes, as de-identified training data |
| AI usage ledger | Short-lived operational telemetry, kept only as long as it is useful for cost and abuse control |
| Published recipes | Until you unpublish them, or the household is deleted |
| Anything on your phone | Until you delete it, clear your browser, or delete your account |
| Grouped, de-identified figures | Not personal information, and may be kept indefinitely |
12. Children's privacy
Leftovers is not directed to children under 13 and we do not knowingly collect personal information from them. Families use it together and a child may well be holding the phone — which is part of why the app asks for no name, no email, no phone number, and no location from anyone. If you believe a child under 13 has given us personal information, email us and we'll delete it.
13. How we protect data
Everything travels over HTTPS. Every table is fenced at the database level so one household's rows cannot be returned to another. The training-photo bucket is private, size-limited, type-limited, and writable only into your own household's folder. The keys that could bypass those fences live on our servers and are never shipped to a phone. No system is perfectly secure, so we can't promise absolute security — what we can do is hold as little as possible in the first place, and we do.
14. Where data is processed, and changes to this policy
Leftovers is operated from the United States and your information is processed here. If you use the app from outside the U.S., you understand your information is processed in the U.S.
We'll update the “Last updated” date whenever this changes, and for anything material — a new provider, ads, an affiliate program that actually earns money, or an area figure being collected — we will say so in the app before it takes effect.
Which language controls. This policy and our Terms are written in English and provided in Spanish so more families can read them. The two are meant to say exactly the same thing; if they ever differ, the English version controls.
Terms of Service
By using Leftovers you agree to these Terms. If you don't agree, please don't use the app. Each member of a household accepts these Terms for themselves the first time they use Leftovers on their own device.
1. What Leftovers is
A free tool that helps you make meals from food you already have, learn about unfamiliar items, and find ways to save money on food. It uses AI to identify items you scan and to suggest recipes.
2. The important one — meal and food suggestions are not professional advice
Please read this carefully, because it's about your health and safety.
- Leftovers' meal ideas, item identifications, freshness estimates, nutrition notes, and savings tips are for general informational purposes only. They are not medical, nutritional, dietary, or allergen advice, and they are not a substitute for a doctor, a dietitian, or your own judgment.
- AI makes mistakes. It may misidentify an item, miss an ingredient, or misjudge freshness or an allergen. Always check the actual food yourself — read the real label, check the date, look and smell — especially if you or anyone you're cooking for has a food allergy, an intolerance, or a medical dietary restriction.
- The freshness chip is an estimate, not a test. Unless you typed an exact date, it is a guess based on how long an item has been in your kitchen and what kind of food it is. It cannot tell whether food has actually spoiled.
- You are responsible for what you cook and eat. When in doubt, throw it out or ask a professional.
3. Acceptable use
Please use Leftovers for its purpose — helping you and your household eat and save. Don't:
- break the law, or use the app to harm, harass, or deceive others;
- publish content to the Community Cookbook that's illegal, hateful, threatening, or someone else's;
- scan or post images that aren't yours to share, or that show other people without their okay;
- try to break, overload, scrape, reverse-engineer, or bypass the security of the app;
- resell or commercially exploit the app, or abuse the AI features;
- share a household join code you weren't given, or join a kitchen you weren't invited to.
We may suspend or limit access if someone misuses the app.
4. Shopping links and money
Leftovers is free and shows no ads. It links out to Instacart so you can order what you're missing. Those links carry no affiliate or tracking code today, and we earn nothing from them. If that ever changes we will disclose it here and in the Privacy Policy first. Prices, availability, and delivery are Instacart's, not ours.
5. Your content
If you publish a recipe to the Community Cookbook, you keep ownership of it. You grant Leftovers a non-exclusive, worldwide, royalty-free license to host, store, display, reproduce, adapt (for formatting), and distribute it within the app and to promote the app, for as long as you keep it published and for a reasonable period after, for backups and records. You can unpublish at any time and we'll stop displaying it going forward.
You promise that what you publish is yours to share, doesn't break the law or these Terms, and doesn't violate anyone else's rights. We may remove content that violates these Terms, and we don't endorse or guarantee anything users publish.
6. Our intellectual property
Leftovers — including the name, logo, app, design, text, and features — is owned by Seed Our Legacy LLC, an Arizona limited liability company, and is protected by intellectual property laws. We grant you a limited, personal, non-transferable, revocable license to use the app for its intended purpose. You don't get ownership of our brand or software, and you may not copy, rebrand, or build a competing product from it.
7. Third-party services
Leftovers depends on third parties — the AI providers, our hosting and database providers, your browser's push and speech services, and the grocery and public-program sites it links to. We don't control them and we're not responsible for their content, products, prices, availability, or their own privacy practices.
8. “As-is,” no warranties
Leftovers is provided “as is” and “as available,” without warranties of any kind, express or implied. To the fullest extent the law allows, we disclaim all warranties, including merchantability, fitness for a particular purpose, non-infringement, and accuracy. We don't warrant that the app will be uninterrupted or error-free, or that any meal idea, item identification, freshness estimate, or program information is correct, current, safe, or right for you. This includes, without limitation, the food-safety and allergen matters in Section 2.
9. Limitation of liability
To the fullest extent permitted by law:
- Leftovers and Seed Our Legacy LLC, its members, and its team will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for lost data, lost savings, or lost profits, arising from your use of (or inability to use) the app.
- This includes any claim related to food you cooked, ate, served, or discarded based on the app, and to any allergen, spoilage, nutrition, or health outcome — see Section 2.
- Because Leftovers is free, our total liability to you for any and all claims will not exceed one hundred U.S. dollars ($100.00).
- Some states don't allow certain limitations, so parts of this may not apply to you; in that case our liability is limited to the smallest amount the law allows.
10. Indemnification
If your use of the app or what you publish causes a claim against us, you agree to reasonably defend and hold us harmless from that claim, to the extent the law allows.
11. Governing law and disputes
These Terms are governed by the laws of the State of Arizona, without regard to its conflict-of-laws rules. You and Leftovers agree that any dispute will be resolved in the state or federal courts located in Maricopa County, Arizona, and you consent to their jurisdiction. Before filing anything, please email us first so we can try to make it right.
12. Changes, and the rest
We may change, pause, or stop features, and we may update these Terms. For a material change we'll update the “Last updated” date and give reasonable notice. Continuing to use Leftovers after a change means you accept the updated Terms. If any part of these Terms is unenforceable, the rest still applies. Our not enforcing a term isn't a waiver of it. These Terms are the whole agreement between you and Leftovers about the app.
Which language controls. This policy and our Terms are written in English and provided in Spanish so more families can read them. The two are meant to say exactly the same thing; if they ever differ, the English version controls.
13. Contact
legal@grableftovers.com — Seed Our Legacy LLC, 15150 W Park Pl Ste 215, Goodyear, AZ 85395