Privacy Policy

Effective date: October 23, 2026

FridgeSpot is operated by William McLaughlin, an individual based in New York, United States ("FridgeSpot," "we," "us"). This policy covers the FridgeSpot iOS app, its share extension, and fridgespot.com. Contact us about privacy at bill@fridgespot.com.

1. Information we collect

• Account information: your email address, username, account identifiers, signup and account status, verification/reset information, and a one-way password hash. We do not store your password as readable text.
• Content you provide: recipe links, recipe names, ingredients, instructions, privacy settings, uploaded recipe photos, Spot names, memberships and colors, favorites, meal plans, shopping lists, shared notes, and recipe reports.
• Technical information: authentication/session records, request times, IP addresses and related connection information available to our server, error and security logs, and records used to limit abusive login or signup attempts.
• Device storage: the app keeps authentication credentials in the iOS Keychain and stores settings and copies of recipes, Spots, plans and shopping lists on your device for faster loading, offline access and synchronization. The website uses an essential session cookie.

When you choose a photo, only the selected image is supplied to FridgeSpot; we do not collect your photo library. Selected photos are resized and converted to WebP for storage. When you share a recipe from Safari, the extension reads the recipe link and available recipe metadata from that page. It does not submit your browsing history or the page's unrelated account information.

2. How we use information

We use information to create and secure accounts, verify email addresses, reset passwords, import and display recipes, operate shared Spots and shopping lists, synchronize changes, provide offline features, process reports and account requests, troubleshoot failures, and prevent abuse. Email is used for account and service messages, including verification and password resets. Recipe reports notify the administrator and may include the reporter's username, email address and the reported recipe's details.

We currently use no advertising or analytics services, sell no personal information, and do not share personal information for cross-context behavioral advertising. We do not use your recipes or other content to train artificial-intelligence models.

3. Sharing and recipe visibility

Public recipes: recipes imported from websites are public in FridgeSpot by default and may appear in recipe libraries and Recently Imported. Manually created recipes can be marked private. Public means visible to other FridgeSpot users; you should avoid putting personal or sensitive information in public content.

Private recipes and Spots: private recipes are available to their creator and members of an active shared Spot under FridgeSpot's sharing rules. Spot members can see shared plans, lists, notes, member usernames and colors. A Spot owner can manage membership. Leaving or being removed from a Spot changes access, but cannot retrieve copies another person already saved. A join code is an invitation mechanism; share it only with people you intend to include.

Recipe images and acceptable content: all recipe images, whether uploaded or imported from a website, must be appropriate for a food-sharing community and relevant to food or recipes. Sexually explicit images, graphic violence, hateful or abusive material, illegal content, and images that violate another person's privacy are prohibited. You must have permission to use images you upload. Accounts found violating these rules will be banned, and offending recipes or images may be removed. Use Report Recipe to flag inappropriate content for administrator review, or contact bill@fridgespot.com.

Administration: the operator can access information as necessary to run and secure the service, respond to requests and review reported recipes, including reported private recipes. Administrators reviewing a report can see the recorded importer and reporters.

Service providers: infrastructure supporting the website, database, email delivery and static assets processes information needed to provide those services. We require providers handling personal information for us to protect it consistently with this policy and applicable law, and do not authorize independent advertising uses. The web interface loads some libraries, fonts or styling from third-party content-delivery services, including Google-hosted libraries, jsDelivr, cdnjs and esm.sh; those services receive the connection information needed to deliver their resources.

Recipe websites: importing or previewing a link can contact its publisher. Your device may contact publishers or image hosts directly to display an image or retrieve recipe metadata, which exposes connection information such as your IP address to them. FridgeSpot does not send its login token to recipe publishers. Their own privacy policies govern activity on their sites.

We may disclose information when legally required or reasonably necessary to protect rights, safety or security. If operation of the service transfers to another operator, affected information would remain subject to the disclosed privacy commitments, and we would notify users of material changes.

4. Retention

We keep account information and saved content while your account exists so the service can operate. Deactivation retains that information; permanent deletion removes the account and associated data as described below. Verification links expire after 24 hours, password-reset links after 30 minutes, mobile login tokens after 30 days, and temporary discovery previews after 12 hours. Temporary signup receipts and abuse-prevention counters also expire. Expired credentials stop working even if background database cleanup has not removed the stored record yet.

Operational logs and service correspondence are retained only as needed for troubleshooting, security, responding to requests or legal obligations. The applicable period depends on the purpose and any legal requirement; these records are not used for advertising or analytics. We currently maintain no server-database backups. If we introduce backups, we will update this policy with their retention and deletion handling before doing so.

5. Deactivation and permanent deletion

In the iOS app, open My Spots → Settings → Account. On the website, use the Settings icon on My Spots. Both provide account deactivation and permanent deletion with confirmation and your current password; you do not need to contact support to initiate deletion.

Deactivation signs you out on all devices and prevents account access while retaining your information. Signing in again with your password reactivates a self-deactivated account. It does not reactivate an account disabled by an administrator.

Delete Account permanently removes your account information, credentials, private recipes, their uploaded photos where not shared by another retained recipe, reports linking you as reporter, and recorded author attribution. Public recipes you created or imported, including website imports, remain available without your account attribution, together with their photos and original website credits. References to deleted private recipes are removed from favorites, meal plans and shopping lists.

You are removed from every Spot. A Spot you own transfers to its longest-standing remaining member, based on member join order. Other members keep the shared Spot, its favorites, meal plans, shopping lists and notes without your recorded account attribution. Only Spots with no members left, and their lists, plans, notes and mappings, are deleted.

Collaborative content, including shared notes and shopping items, remains available to the remaining Spot members. Removing account attribution does not remove personal information you may have written into retained public recipes or shared content. You can edit that content before deleting your account or contact us about removing specific personal information. Other members may already have saved independent copies of shared or public content; we cannot remove those copies from their devices.

Deletion is processed in the active service when the request succeeds. If processing fails, the app or website reports the failure and lets you retry; it does not represent an incomplete request as finished. Records legally required to be retained, and relevant security logs or correspondence, may remain only for the necessary purpose and period. If you cannot access your account, contact bill@fridgespot.com; we may need to verify your identity. Deleting or logging out of the account clears the current app's saved account data; copies on another offline device may remain until that device reconnects, logs out or removes the app.

6. Your choices and rights

You can choose whether to upload a photo, choose recipe visibility, manage your recipes, leave a Spot, clear saved app data, deactivate or delete your account, and change available display settings. Essential session/authentication storage is needed to sign in. There are currently no advertising or analytics tracking preferences to enable.

Depending on where you live, applicable law may give you rights to access, correct, obtain a copy of, delete, restrict or object to processing of personal information, withdraw consent where processing depends on it, or complain to a data-protection authority. Request help at bill@fridgespot.com. We will verify requests proportionately and respond within applicable legal deadlines without discriminating against you for exercising your rights.

Where European or UK data-protection law applies, we process core account and service information to provide the service you request, security and abuse-prevention information for our legitimate interests, information needed to meet legal duties under those duties, and optional processing that legally requires consent only with that consent. You may contact your local supervisory authority about a concern.

7. Security and location

The service is operated from the United States. Information may be processed there or where infrastructure providers operate, and those locations may have different privacy laws from your location. Where applicable law requires safeguards for an international transfer, those safeguards must be in place before that processing occurs. We use password hashing, encrypted HTTPS connections, authentication and access controls, but no service can guarantee absolute security. Keep your password and Spot join codes secure.

If a security incident requires notification, we will notify affected people and authorities as required by applicable law.

8. Children

FridgeSpot is not directed to children under 13, or under a higher age where applicable law requires it. We do not knowingly collect personal information from such children without legally required parental authorization. Contact us if you believe a child has provided information so we can investigate and remove it as appropriate.

9. Changes and contact

We will update this page and its effective date when our practices change, and provide additional notice of material changes where required. We will obtain any consent legally required before new processing begins. For privacy questions or requests, contact William McLaughlin at bill@fridgespot.com.