Privacy Policy

Last updated: 2026-10-30

This policy explains what Hello Pantry does with data: the Telegram bot (@hello_pantry_bot), its Mini App, the web app and the Android app.

The short version: there is no password. In Telegram, Telegram already knows who you are; the web app and the Android app sign you in with a code or a link sent to you, or with Google. What you write down is stored on one server so that it can be shown back to you, and it is used for nothing else. The one exception is what you choose to give the shared catalog: the facts of a packaged product, shown to whoever scans the same code, and, only if you tick it, a new product you send on to Open Food Facts or a correction to a product it already knows. There is no analytics, no advertising, no profiling and no third party with a copy of anything else, in the bot, the Mini App and the web app, except an AI assistant that you yourself connect: what it reads goes to the company that runs it. The one exception is the Google Play build of the Android app, which sends crash reports and usage statistics to Google, but only if you say yes.

Who is responsible

Gabriele Proietti Mattia (https://gpm.name), reachable at apps@gpm.name, is the data controller. The server is in Germany.

What is stored

Everything below is stored because the bot cannot do its job without it, and nothing is stored that it can do its job without.

Who you are on TelegramYour Telegram numeric id, first and last name, username and language code. The id is what ties your home to you; the name is what the bot greets you by, and what the other members of a shared home see; the language sets which of the two translations you read.
What you keep in your homeHomes, their places, and the products in them: name, brand, barcode, size, picture, category, amounts, expiry dates, the day something was frozen, the warning settings, and the shopping list. For a shared home, who the members are, their role, and who added or used up what. To propose the place, the number of packages and the expiry the next time you add a product, the home also remembers its recent adds of each product: the day, the kind of place, how many packages of which size and the expiry date given, without who added them.
Your notification settingsWhich homes and which people you have muted, whether you get a digest, when the last expiry warning for each product was sent, so that it is not sent twice, and whether expiry alerts reach you on your phone or on Telegram.
Where you are in the conversationThe screen you are on and the message the bot last sent you, so a button pressed tomorrow still knows what it refers to.
Whether you are a subscriberWhether Pro is active and until when, whether it renews, how it was paid (Telegram Stars or Google Play), and the payment identifier Telegram gives the bot so that a refund is possible. For Google Play, the purchase token Google gives the app, and whether Google reports a payment problem. See below.
Your Google account, if you use itOptional. If you sign in with Google or link it, Google's account identifier (the "sub") and the verified email address of that account, to recognise you the next time. When Google is what creates a new account, the first and last name Google gives are used as the account's name, which the other members of a shared home see, as with the Telegram name, and which goes when the account is deleted. See below.
What you keep in a wardrobeIf you make one: its spaces and categories, and each piece's name, brand, size, colour, notes, quantity and photos. For a shared wardrobe, the members and who added or removed what, as for a home.
Pictures you choose to attachA photo of a product's package, of a product without a barcode, or of a piece in a wardrobe, only when you attach one yourself. It is made smaller, and everything else in the file is removed, location included. Before your first package photo for the shared catalog you are asked to accept the rules for photos, and the day you accepted is kept. See the shared catalog below.
What you give the shared catalogFor a barcoded product that Open Food Facts does not know: its name, brand, size, category and package photo, which account added it, and the reports people make about it. See below.
What you send to Open Food FactsOnly if you tick "Send to the Open Food Facts databases too" for a new product: a record of the request (which catalog entry, when it was sent or why it was not, and which account asked, until you delete your data), and what the follow-up found on the public page of the product. What is sent, and what it means, is below.
What you correct on Open Food FactsOnly if you choose to correct a product that Open Food Facts already knows: a record of the correction (which product, what you proposed, what Open Food Facts held at that moment, the outcome for each detail, when it was sent or why it was not, and which account asked, until you delete your data). What is sent, and what it means, is below.
The AI assistants you connectOnly if you connect one: the app's name and the addresses it returns to, which account connected it and when, when it was last used, and its access keys, kept only as a hash. Never what the assistant asked or was answered. See AI assistants (MCP).
Your email, if you give oneOptional. See below.
Reports you sendThe text of a bug report or an idea, and a screenshot if you attach one. See below.

What is never stored

No payment details. Pro is paid in Telegram Stars or through Google Play. Telegram tells the bot that a payment happened and gives it an identifier for it; Google Play gives the app a purchase token. A card number, a name on a card or a billing address never reach the bot, because neither Telegram nor Google sends them.
No location. The bot never asks for it and has nowhere to put it.
No contacts, and no files.
No pictures you did not choose to keep. A photo of a barcode that you send to the bot is read for the number on it and is not stored. The live camera scan in the Mini App and the web app happens on your device and no video or picture leaves it. A picture is kept only when you attach one to a product yourself.
No analytics and no advertising identifiers in the bot, the Mini App and the web app. There is no third-party SDK in them: nothing measures how you use them and nothing reports on it. The one exception is the Google Play build of the Android app, and only if you agree: see The Android app.
No message history. The bot reads a message to act on it and keeps what that message was about — a product, an amount — not the message.
No record of what an AI assistant asks or is told. Hello Pantry keeps that an assistant is connected, not the content of its requests or of the answers.

Open Food Facts

When you scan or type a barcode, the number may be looked up on Open Food Facts, a free, open database of food products. If it does not have the code, the lookup is passed on to its sister projects, which hold what is not food: Open Products Facts (detergents and household goods), Open Beauty Facts (toiletries and cosmetics) and Open Pet Food Facts (pet food). They use the same open licence (ODbL). Looking a code up sends only the barcode: nothing that says who you are, which home it is for, or what else is in it. What comes back (name, brand, size, picture) is shown to you to confirm. Open Food Facts handles that request under its own privacy policy, not this one.

Searching by name. When you type a name to add a product, the bot and the apps look only in their own data, and nothing is sent out. The words you typed are sent to Open Food Facts only if you tap “Cerca su Open Food Facts”, and then only those words: nothing that says who you are. The results of that search are kept for 7 days so the same search is not sent twice; what is kept is the results, not who searched. Codes that a shop prints itself, such as the labels of the fruit, deli and cheese counters, mean something different in every shop, so they are never sent to Open Food Facts: the bot asks you for the name instead.

The shared catalog

When you add a product whose barcode Open Food Facts does not know, what you wrote about it — name, brand, size, category and, if you add one, a photo of the package — goes into Hello Pantry’s own catalog, so that the next person who scans that code finds it filled in. It is shared unless you say not to: before saving, the bot says so and offers “Do not share”, and the Mini App and the web app have a switch. Only products with a barcode are shared, and never the codes a shop prints itself.

What other people see is the product: never who added it, which home it is in, or anything else in that home. Which account added an entry is kept so that whoever added it can correct it and abuse can be stopped; only the administrators see it. A package photo is shown to other people once an automatic check has passed it: an image classifier that runs on the same server looks for nudity and sexual content, and the photo is not sent anywhere for it. A photo the check holds back is shown only after an administrator has approved it. Anybody can report an entry, and an entry reported by three people is hidden until an administrator looks at it. Nothing in the catalog is sent to Open Food Facts unless you ask for it, as described next.

Pictures. A picture is kept on the same server as the rest. It is made smaller, and everything else in the file is removed, the place it was taken included. A picture of a product without a barcode, and every photo in a wardrobe, is seen only by the members of that home or wardrobe, through links that stop working after a day. A photo of clothes can show the person wearing them: it stays inside the wardrobe, is never shared with the catalog or anybody else, and goes when the piece, the wardrobe or your data is deleted.

Sending a new product to Open Food Facts

When you add a product that Open Food Facts did not know and that goes into the shared catalog, the bot and the apps also ask whether to send it to the Open Food Facts databases, and what it is: food or drink, toiletries and cosmetics, pet food, or household and other. It goes to the project for that type: Open Food Facts, Open Beauty Facts, Open Pet Food Facts or Open Products Facts. It is off unless you tick it, it is asked every time, and it is not offered for anything that does not go into the catalog. If you do not tick it, nothing is sent.

If you tick it:

What is sent, and when. About an hour later, the product’s name, brand and package size, and its package photo if it passed the check or an administrator approved it, are sent to that project, where they become public. The hour is there so that a typo can be fixed.
In whose name. They are credited to the Hello Pantry account, not to you. Your name, your Telegram id and your home are not sent.
A pseudonymous identifier. With each contribution goes an identifier derived from your account. It cannot be traced back to you; it lets Open Food Facts’ moderators stop one person’s contributions without stopping the app.
Licences. The data is published under the Open Database Licence and the photos under CC BY-SA: anyone may reuse them on those terms.
Undoing it. Before it is sent, it can be undone: undoing the add cancels it, and Settings → Delete all data cancels anything not yet sent. Once it is sent, we cannot withdraw it from Open Food Facts: it is public there.
Looking at it afterwards. So that you can see what became of it, a day, a week and a month after it is sent Hello Pantry opens the product’s public page on Open Food Facts and notes whether it is online, has been improved by others or has been removed. This only reads a public page: nothing about you is sent. You can see your own contributions and their status in the Mini App (Settings), in the bot’s Settings and in the Android app (Contributions, under Settings). Delete all data detaches them from you, so you no longer see them, as before.
Open Food Facts’ part. Once there, it is covered by their privacy policy and terms of use, not by this page.

Correcting a product on Open Food Facts

When you add or open a product whose barcode Open Food Facts already knows, and your version of its name, brand, size or picture is better than theirs, the Mini App and the Android app offer to send the correction to Open Food Facts too. Nothing goes unless you choose it: the details that differ are listed, and you tick the ones to send. They start ticked, except the photo, which only you can tick.

What is sent, and when. Only the details you ticked: the name, the brand, the size, the category (only for food, and only when Open Food Facts has none) and the front photo. About an hour later they are written to the product’s page on Open Food Facts, where the changes are public. Before writing, Hello Pantry reads the product again, and a detail that somebody else has changed in the meantime is left alone.
In whose name. The changes are credited to the shared Hello Pantry account, not to you, with the same pseudonymous identifier as for new products. Your name, your Telegram id and your home are not sent.
The photo. It is off unless you tick it, next to the notice of the licence: a photo you send is published under CC BY-SA and replaces the front photo on Open Food Facts, once it has passed the same automatic check as the photos of the shared catalog. The text of the correction is published under the Open Database Licence.
Changing or cancelling it. During that hour you can change what is sent or cancel it, from the product’s page. Undoing the add, deleting the product or changing its barcode cancels it too, and so does Settings → Delete all data.
What we keep. A record of the correction: which product, what you asked and what you proposed, what Open Food Facts held at that moment (so that nothing newer is overwritten), and the outcome for each detail (written, already there, changed by someone else, not sent). It is what you see in the product’s page and in “Your contributions”. Nothing about you is sent to Open Food Facts beyond the identifier above.
Ten a day. You can send up to 10 corrections a day; past that, a correction waits for the next day, and the app tells you when it will go.
Once it is sent. A correction already sent stays on Open Food Facts: it is public there and we cannot withdraw it. What is cancelled is only what has not been sent yet.
Delete all data. It cancels the corrections that are still waiting and removes you from all the records of corrections, the sent ones too; what was sent stays public on Open Food Facts.
Open Food Facts’ part. Once there, it is covered by their privacy policy and terms of use, not by this page.

Email, licences and reports: apps-management

An email address is optional. The bot works, and Pro can be bought, without one.

If you choose to link one (you confirm it with a code sent to it), it is used with apps-management, the service that handles licences and feedback for the apps in this family. It is used for three things only: your licence, so that Pro can follow you to a new Telegram account (it is valid for one Telegram account at a time); the replies to the reports you send; and the votes you cast on the features still to be built. apps-management knows people only by a verified email and does not receive your Telegram id.

Two other things are recorded there whether or not you link an email:

Pro purchases. A purchase made with Telegram Stars is recorded in apps-management under the Telegram payment identifier, which is how a licence is checked and a refund traced. No card or billing details are involved, because there are none. For a subscription bought on Google Play, Hello Pantry’s server sends the purchase token to apps-management together with your verified email, if you have linked one, and apps-management checks it with Google. See Pro on Google Play.
Bug reports and ideas. What you send from the information section of the bot or of the app is forwarded to apps-management, together with the version you were using and the email, if you have linked one. A report without a linked email is anonymous.

Telegram’s part

You are talking to this bot through Telegram, and Telegram carries what you send. What Telegram does with that is covered by Telegram’s own privacy policy, not by this one.

Two consequences worth stating plainly:

Telegram knows you use this bot, and when.
A Telegram chat with a bot is not end-to-end encrypted. Telegram can read it, the same way it can read any cloud chat.

Shared homes

In a shared home the other members see its contents, your Telegram name, and who added or used up each thing. They are also sent a notification when you do, unless they have muted it. Only an owner can invite or remove people. Leaving a home, or being removed, ends your access to it.

AI assistants (MCP)

You can connect Hello Pantry to an AI assistant that supports connectors (MCP), such as Claude, by Anthropic, or ChatGPT, by OpenAI, or any other client that speaks the protocol. Nothing happens unless you add Hello Pantry in that assistant yourself and press Allow on Hello Pantry’s own page in the web app, signed in to your account. That page shows the app’s name and the address it returns to, warns you when the app is not one we recognise, lists the homes it will reach with your role in each, and says what it can never do. Anyone can connect; the assistant can use a home’s contents only while that home has Pro.

What it can do. From then on, when you ask it to, the assistant acts with your role in each of your homes. It can read the homes, their places, products, expiry dates, shopping lists, statistics and members (their name and Telegram username, nothing more). With the role of editor or owner it can add, move, change and use up or throw away packages, change the shopping list and the places; as an owner it can also change the home’s settings, and invite people, change their role or remove them. Every change is made as you: the other members of a shared home see it, and are notified, as your change. A viewer can only read. It can never delete, create or restore a home, transfer ownership, answer an invitation, change your notification settings other than your own expiry alerts, see anyone’s contact details, change the shared catalog, send anything to Open Food Facts, touch Pro or payments, export or delete your data or your account.

What goes where. What the assistant reads is sent to the company that runs it (for example Anthropic for Claude, OpenAI for ChatGPT) and is handled under that company’s own terms and privacy policy: it is a service you chose to connect, not one working for us, and Hello Pantry has no control over what it does with it. Look up a barcode or search by name through an assistant, and only the barcode or the words go to Open Food Facts, as described above. An assistant never sends a contribution or a correction to Open Food Facts or to the shared catalog.

What we keep. For each app: the name it gave itself, the addresses it returns to and, for an app that identifies itself by a document on its own website, the address of that document. For each connection: your account, which app, when it was approved and when it was last used. For the access keys: only a hash, never the key. Nothing else. We do not keep the content of what the assistant asks or is answered. Our server’s log records only that a request was made, from which account and connection, which tool, how long it took and whether it succeeded: no arguments and no results. We also count, per day, how many requests came from assistants and how many of them changed something, in total only; for each account we note just whether it used an assistant that day. The administrator sees how many apps are connected and, in a person’s details, which apps that person connected, when, and when each was last used.

For how long. An access key lasts 1 hour. A renewal key lasts 90 days from its last use, and is replaced each time it is used. However often it is renewed, a connection ends one year after you approved it, and the assistant has to be connected again. A pending request to connect lasts 30 minutes and its one-time code 2 minutes. Every hour the server deletes what has expired: requests and codes after a day, keys a month after they expired or were revoked, a revoked connection after a month, one not used for 120 days, and an app that never got a connection after a day.

Disconnecting. Settings → Connected apps, in the web app and the Mini App, lists every connection. Disconnect stops it at once: from the next request on, the assistant is refused. You can also remove the connector in the assistant. Deleting your account deletes every connection and its keys. Delete all data does not: it empties your homes, and a connected assistant stays connected, to an account with nothing in it, until you disconnect it.

A notice every time. Each time an app is connected you are told, on Telegram if you have it linked and by email if you have given one, with the app’s name and how to disconnect it, so that you hear of a connection you did not make.

The Mini App and the web app

The Mini App is a page served from https://hello-pantry-tg.gpm.name. It stores one thing in your browser: a note that you have seen the welcome screen. That note never leaves the device and is not readable by anyone else.

Inside Telegram, every request the Mini App makes carries the session Telegram signs for it, which is what proves the request is yours.

The web app at https://hello-pantry-app.gpm.name is the same page, opened in a browser, with a sign in of its own: a link sent to your email, Google, or the Telegram login button. It needs the same data, and keeps a session cookie in the browser so that you stay signed in until you sign out. Signing in with an email or with Google stores that address, or the Google account identifier, to recognise you the next time.

The page loads its fonts from Google Fonts, which means Google sees the request for those files. Nothing about you is sent with it beyond what any browser sends when it fetches a file.

The Android app

The Android app is another way into the same account and the same data as the bot: homes, places, products, the shopping list, the members of a shared home and the invitations, your notification settings and the statistics of a home. It talks to the same server, in Germany. You sign in with a 6-digit code sent to your email, with a code you get from the bot, or, in the Google Play build, with Google. What is stored about your home is what the sections above describe.

Scanning a barcode with the camera happens on your device: the Google Play build reads it with Google’s ML Kit library and the store-free build with ZXing, both working inside the app with nothing downloaded or sent. The camera images are looked at in memory and never stored or uploaded; only the digits of the code go to the server, to look the product up. The camera is asked for only when you open the scanner, read an expiry date or take a package photo, and typing works without it.

Reading an expiry date. In the Google Play build the app can read the expiry date printed on a package with the camera, when you choose to. The text is recognised on your phone by Google’s ML Kit, through Google Play services, which provides the recognition model and downloads it the first time if the phone does not have it yet. The camera images and the text read are looked at in memory and never stored or uploaded: only the date you confirm is saved, as the expiry of what you add. Like the other features of Google Play services, ML Kit may send Google technical information about the device and how the feature performs, never the images or the text. The store-free build has no date reading: you type the date or pick it from the calendar.

Photos of a package. The camera is also used, inside the app, when you choose to take a photo of a package; you can pick one from your gallery instead, through the system’s photo picker, and the app asks for no access to your photos. The photo is processed on your device before it is uploaded: it is made smaller and turned the right way up, and everything else in the file, location included, is removed. It is uploaded only when you attach it yourself, under the same rules as Pictures you choose to attach and the shared catalog.

Signing in with Google, and linking accounts. In the Google Play build you can sign in with Google, and in Settings you can link your Google account, your Telegram account and an email address to the account you already have. For Google, the app asks Google for a signed proof of who you are and sends it to the server, which checks it with Google and keeps Google’s account identifier (the “sub”) and the verified email address, to recognise you the next time, as the web app does, plus your name if Google creates the account. To link Telegram, the app opens the bot, the bot sends you a 6-digit code, and you type it back into the app; the server then ties your Telegram id to the same account. Linking an email works with a code sent to that address, as above. A build without Google Play services has no Google sign-in.

Pro on Google Play. In the Google Play build, Pro can be bought in the app as a Google Play subscription, monthly or yearly, with a free trial. Google takes the payment, as the processor of the purchase, under Google’s terms and privacy policy: card and billing details stay with Google and never reach Hello Pantry. Google gives the app a purchase token, and the app sends it to Hello Pantry’s server. The server stores the token and a hash of it, which account it belongs to, and whether Google reports a payment problem, and sends the token to apps-management, which checks with Google whether the subscription is active and until when. The state and the dates that come back are kept on your account. That is what makes Pro valid in the bot, the Mini App and the web app as well as in the app. Cancelling and refunds go through Google Play (see the terms); when Google reports the change, Pro follows it. The purchase record is removed when your account is deleted; deleting your data does not cancel a subscription, which you cancel in Google Play. A build without Google Play services does not sell Pro; it points to the bot.

Expiry alerts on your phone. The app can warn you about products close to their expiry date as Android notifications. They are computed on your phone, from the data the app already has from the server and keeps for working offline: nothing is sent to anyone for it, and there is no push service. Android asks your permission to show notifications, and you can switch them off in the app or in Android’s settings. Which channel you want, the phone or Telegram, is stored on your account, so that the bot does not send the same warning too.

Your data, from the app. The app can delete all your data (Settings → Delete all data), with the same effect as in the bot and as described under Retention, and the owner of a home can export its data as a file, which is saved where you choose on your phone.

The diagnostics question. After you first sign in to the Google Play build, the app asks about “diagnostics”, with two switches: crash reports and usage statistics. Both are shown switched on, and nothing is sent until you have answered. You can change the answer at any time in the app’s Settings.

Crash reports (Firebase Crashlytics)When the app crashes: the stack trace (where in the code it failed), the device model, the Android version, the app version and an installation identifier.
Usage statistics (Firebase Analytics)Which screens and features are used, as events, with an app-instance identifier and the Android advertising ID. The advertising ID is used only for these statistics, never for advertising: there are no ads anywhere in Hello Pantry.

What is never sent. What is in a home, product names, the shopping list, pictures, your email and your Telegram name are not part of either report.

Google’s part. Both services are Google’s. Google processes the data for Hello Pantry as a service provider (processor), and may process it outside the EU. See Google’s privacy policy and Firebase’s privacy information.

Changing your mind. Switch either one off in the app’s Settings and the app stops sending it. What was already sent is kept and deleted by Google according to its own retention periods, as described in Delete your account.

A build without Google Play services contains neither Crashlytics nor Analytics, and has no diagnostics question.

Retention

What you keep in your home is kept until you delete it.

Settings → Delete all data, inside the bot and in the Android app, deletes your homes, wardrobes, products, pieces and shopping lists, and the pictures attached to them, permanently and immediately. It is not a request that gets processed: the rows are gone when the confirmation comes back, and the picture files follow within a day. What you gave the shared catalog stays there, as facts about a packaged product, with nothing that links it to you any more; the reports you made are deleted. Anything not yet sent to Open Food Facts, new products and corrections alike, is cancelled, and the records of what was sent no longer name you; what was sent stays public there. Your profile and the conversation itself survive, so the bot still works afterwards; deleting those too is a request to the address above.

Connected AI assistants are kept as described under AI assistants (MCP): no more than a year from your approval. Disconnecting stops one at once and its record is deleted within about a month; deleting the account deletes them all.

Deleting a home or a wardrobe. An owner can delete a home or a wardrobe. It disappears for every member at once, and is kept for 30 days so that an owner can restore it. Until then it still holds its products, pictures and activity. After 30 days it is purged for good, together with its products, pictures and activity. If you do not want to wait, Delete all data removes yours immediately, as above.

Backups of the server exist for disaster recovery and are retained for a limited period. Data deleted from the live database is not restored from them.

What is deleted, what is kept and for how long, and how to ask for your profile to be deleted too, is set out on one page: Delete your account.

Performance of a contract for everything you write down: an app that keeps track of what you have cannot work without storing it.
Legitimate interest for the operational logs the server keeps to stay working and to investigate abuse, and for keeping which account added a catalog entry or a picture and who reported one, so that abuse of the shared catalog can be stopped.
Consent for sending a product to Open Food Facts: you give it by ticking the box, each time, and nothing is sent without it. You can take it back until the product is sent, as described above; after that it cannot be undone.
Consent for correcting a product on Open Food Facts: you give it by ticking what to send, each time, and nothing is sent without it. You can take it back during the hour before it is sent; after that it cannot be undone.
Consent for crash reports and usage statistics in the Google Play build of the Android app: you give it by leaving the switches on when the app asks, nothing is sent before you answer, and you can withdraw it at any time in the app’s Settings.
Performance of a contract for the Google account identifier and email, which are needed to sign you in, and for the purchase token and the subscription state, which are needed to give you the Pro you bought.
Performance of a contract for connecting an AI assistant: it is a feature you ask for, and the connection, its keys and the notice we send you are what it needs to work. The server’s log of requests falls under legitimate interest, above.
Legal obligation for the records a payment leaves behind.

Your rights

You may ask for a copy of your data, its correction, or its deletion, and you may object to its processing. One of those needs nobody’s help: Settings → Delete all data is the deletion, and Delete your account explains the rest. For anything else, write to apps@gpm.name.

You also have the right to complain to a supervisory authority.

Children

Hello Pantry is not directed at children and asks for nothing that would identify one.

Changes

This page carries the date it was last substantively changed. A change that affects what is collected will be said in the changelog as well, rather than only here.