Privacy

You can use Spiso without signing up, and if you do, your kitchen never leaves your phone. Products, dates, quantities, notes and history live in a database on the device. Reminders are scheduled locally by the phone itself. No server is involved and no push token exists, so nobody, including us, can tell that you were reminded about anything.

Two exceptions worth naming. When you scan a barcode, that barcode is sent to Open Food Facts to look up the product name and picture. Your phone contacts them directly, so they see the barcode and your IP address. And when you type a product name, the search goes to Spiso’s own server, which returns matches from a product catalogue. The query is not stored against you.

An account exists so your kitchen can reach your other devices, and so you can share one with someone. It stores:

• Your email address, and a display name if you choose to set one.
• Your password, hashed with bcrypt. The plain password is never written down anywhere; we could not tell you what it is.
• When the account was created and when it last signed in.
• A session record per signed-in device, holding only a SHA-256 hash of the session token and its expiry date.
• For each shared kitchen: its name, who its members are, their role, and the email address of anyone invited but not yet joined.
• Two pieces of cryptographic material: a public key, and a copy of your kitchen key locked with your password. Both exist so a new device can unlock your data. Neither is usable by us.

Your inventory is encrypted on your phone before it is uploaded, with a key derived from your password. What sits in the database is a block of ciphertext. We can see how large it is and when it changed; we cannot see a single product in it.

A shared kitchen is the exception, and we would rather say so here than have you find out later: the server can read a shared kitchen. It travels over an encrypted connection and the database encrypts what it stores, but not with a key only your devices hold. An earlier design did seal each shared kitchen with a key that lived only on members’ phones, and it meant a new member saw an empty kitchen until someone else’s phone came online, and a household that lost its devices lost the kitchen for good. For a list of what is in a fridge, shared by people who chose to share it, that was the wrong trade. If you would rather we could not read a kitchen, keep it local instead of sharing it.

The encryption on your own backup has a consequence we would rather state plainly than bury. If you forget your password and have no device left with Spiso installed on it, that encrypted copy cannot be recovered, not by you and not by us. That is what makes it private.

Premium is handled by RevenueCat, which sits between the app store and Spiso and keeps track of whether a subscription is active. Along with the crash reporting described below, it is one of only two outside services the app itself sends anything to.

What it receives is deliberately thin:

• Spiso’s internal account identifier, which is a random string. Not your email address, not your name. We do not send either, and RevenueCat has no way to work them out.
• The details of the purchase, from the store: which product, when, whether it renewed, whether it lapsed. Along with it, the kind of device and the country the store reports.

Payment itself never touches Spiso or RevenueCat. Your card details go to Google or Apple and stay there; we are told only that a subscription exists. Nothing about your kitchen is sent. The encrypted inventory and the subscription are separate paths that never meet.

RevenueCat is a United States company, so this is the one place your data leaves Europe. It is an account identifier and a purchase record, and it is the price of taking payment without handling cards. If you never subscribe, nothing is ever sent to them.

When Spiso crashes, or a screen fails to draw, it sends a report to Sentry so the fault can be found and fixed. That is the only time anything is sent. There is no session recording, no performance tracing, and no log of what you do in the app.

A report contains the stack trace, the app version, the device model and operating system version, an identifier for the installation, and a short trail of the network requests that came before the failure. Before it leaves the phone, identifiers are stripped from web addresses, the contents of requests are discarded, messages the app logged are discarded whole, and anything shaped like an email address is removed. Your account, your email address and your kitchen are not attached.

Two things are worth stating plainly rather than leaving you to discover them. A report carries an approximate location: a city, not a street. The app never sends it; Sentry works it out from the network connection when the report arrives. We tried to switch that off and could not, so it is declared rather than denied. And the scrubbing described above runs in the app, which a crash of the phone’s own code bypasses on its way out, so those reports carry the per-installation identifier that ordinary ones do not.

Crash reporting cannot be turned off inside the app. Reports go to Sentry’s European region, so they stay within the European Economic Area, and they are kept separate from your account and your inventory. There is nothing in a crash report that leads back to who you are.

Spiso is run by one person, and uses as few outside services as it can:

• MongoDB Atlas: the database, hosted in Stockholm, Sweden (AWS eu-north-1).
• Hetzner: the server that runs Spiso’s API, in Nuremberg, Germany.
• Open Food Facts: a non-profit product database, contacted by your phone when you scan a barcode.
• RevenueCat: subscription records, in the United States. Only if you subscribe, and only what is listed above.
• Cloudflare R2: holds the nightly backup of the database. The backup is encrypted before it leaves the server with a key Cloudflare does not have, so what they store is unreadable to them, and your inventory inside it is encrypted a second time with your own key.
• Sentry: receives crash reports, described above. A United States company, but Spiso uses its European region, so the reports are stored in the EEA.
• Vercel: hosts this website. It has no access to your kitchen or your account.
• An email provider, used only to send a password reset link when you ask for one, and to receive mail sent to hello@spiso.app.

Your account and your kitchen stay within the European Economic Area. The single exception is the subscription record described above, which is held in the United States, and only if you subscribe. Nothing is sold, rented, or shared with anyone for advertising, because there is no advertising.

Account data is kept until you delete your account. Sessions expire on their own. Password reset links last one hour and stop working once used. Encrypted backups of the database are kept for up to seven days, plus four weekly and six monthly copies, and they are encrypted so that the storage provider holds nothing readable.

History inside the app, meaning what you used, froze or threw away, is kept for 180 days and then removed automatically.

Spiso can delete your account from inside the app, under Settings. It removes your account record, your sessions, and the encrypted copies belonging to you. If you own a shared kitchen with other people still in it, Spiso asks you to remove them first, so that nobody else’s kitchen disappears without warning.

You can also export everything as a JSON file at any time, with or without an account, from the same screen. It is your data in a format you can read.

If you are in the UK or the EU you have rights of access, correction, erasure, portability and objection under the GDPR. In practice the app already does access, erasure and portability without asking anyone. For anything else, email hello@spiso.app.

Spiso is not designed for or directed at children, and it is not marketed to them. It does not knowingly collect anything from a child under 13.

If what Spiso stores changes, this page changes with it and the date at the top moves. Anything that materially affects what is collected will be mentioned in the app as well, rather than quietly amended here.

hello@spiso.app. A real person reads it.