PRIVACY

Last updated: 20 September 2026 · Version: 1.2

The short version, before it gets long:

• We host in Germany / the EU, on our own servers.
• We use no trackers and no ad networks. No cookie banner circus.
• We strip EXIF and GPS data from your photos before anything is stored.
• On a Fridge Tour the video stays on your device. Only single still frames are uploaded – and those are private.
• For food recognition we send images to OpenAI – as a processor, not for model training.
• Minimum age 16.
• You can export your data and delete your account in the app at any time.

1. Controller

oerli GmbH, Maiwaldstr. 9, 77855 Achern, Germany
E-mail: service@fridgee.net

Contact for privacy matters: Till Isaak Jedamczik, reachable at service@fridgee.net (subject "Privacy").

2. What we process

2.1 Account

E-mail address, username, password (stored as an argon2id hash, never in clear text), year of birth (age check only), language, time of registration. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.2 Profile

Display name, status text, website, profile picture – all optional and publicly visible. Legal basis: Art. 6(1)(b) GDPR.

2.3 Content

Photos of your fridge, titles, descriptions, hashtags, comments, votes, follows. This content is public and can be found via search engines. Pictures taken during a Fridge Tour or while restocking are not part of this – they are private (see section 2.5). Legal basis: Art. 6(1)(b) GDPR.

Important about photos: Photos of a fridge front often show pictures, magnets, drawings and other personal items – including ones featuring other people. Only upload what you are entitled to upload. Before uploading we offer on-device face detection (images do not leave your device for this) and suggest blurring detected faces. See Terms of Use, section 6.

2.4 Technical data

IP address, timestamp, requested resource, status code, bytes transferred, user agent. Server logs are deleted after 30 days at the latest. Legal basis: Art. 6(1)(f) GDPR (security of operations, abuse prevention).

2.5 Smart Fridge (optional)

Detected food items, your inventory, your shopping lists, recipes you open. Your inventory is private and never becomes part of a public post – not even when it was derived from a public photo. You can turn AI detection off entirely in Settings. Legal basis: Art. 6(1)(a) GDPR (consent), revocable at any time.

Fridge Tour and restock mode. You film your fridge, or you hold each item up to the camera while putting the shopping away. The video never leaves your device – it is neither uploaded nor stored. All that reaches us is:

• single still frames from the recording (JPEG, longest edge at most 1536 px, EXIF/GPS removed) – at most 24 per Fridge Tour and 40 per restock session,
• barcodes your device reads from the camera picture itself (no image is sent for this),
• technical events from the session: timestamps, "shelf done", device and connection state.

These pictures are private. They never appear in a post or in the feed; members of your household can see them, but only the person who made the recording can edit them or move items into the inventory. Once items are confirmed we keep at most one receipt picture per product and delete the rest (retention in section 5). You can discard any single picture, and delete a whole recording at any time. Legal basis: Art. 6(1)(a) GDPR (consent, via the "AI detection" switch), revocable at any time.

Product memory. If an article number is in no database, you can name the product once yourself. Your household remembers that pairing – barcode, name, brand, typical shelf life – until you delete it or the household is deleted; if you share the household, the product memory stays with the others when you leave.

2.6 Push notifications (optional)

Device token (APNs, FCM) or web push subscription. Only with your explicit consent; can be turned off. Legal basis: Art. 6(1)(a) GDPR.

2.7 Moderation

Reports, reasons, decisions, warnings, suspensions – with timestamp and case number. Without these records we cannot meet our obligations under the DSA. Legal basis: Art. 6(1)(c) and (f) GDPR.

3. What we do not do

• No Google Analytics, no Meta pixel, no TikTok pixel, no ad networks.
• No sharing or selling of personal data to third parties for advertising.
• No location requests. On the contrary: we remove existing GPS data from your photos.
• No profiling for advertising, no automated decisions with legal effect (Art. 22 GDPR) – moderation decisions are always made by a human.
• No cookies beyond the strictly necessary ones (see section 9).

4. Recipients and processors

On hosting: Fridgee runs on our own rented server in Düsseldorf, Germany. We send e-mails (verification, password reset, notifications) through our own mail server on the same machine – no external delivery service. We do not use a CDN or an upstream protection service such as Cloudflare. The server is rented from BrainStorm Network Inc. ("OneProvider"), Canada; the European Commission has issued an adequacy decision for Canada (Art. 45 GDPR).

On backups: Backups are encrypted before upload (contents and file names) and stored in Backblaze's EU region in Amsterdam. Backblaze cannot read the data. Backblaze Inc. is certified under the EU-US Data Privacy Framework.

On AI processing: We transmit to OpenAI only the downscaled image (max. 1080 px, without EXIF/GPS) and, for recipes and for a Fridge Tour, the list of your inventory items. The same limit applies to Fridge Tour and restock mode: only the still frames go to OpenAI, downscaled to max. 1080 px and stripped of metadata. We do not transmit your shopping list – which entry gets ticked off is decided by our own server. When a product is identified by its barcode, no AI is involved at all. No account, name or contact data is transmitted. Our contracting party is OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland. The data is processed on servers of OpenAI OpCo, LLC in the USA; the transfer is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). OpenAI processes the data solely on our instructions and not to train its own models; for abuse monitoring OpenAI keeps requests for up to 30 days and then deletes them.

On barcode lookups: A scanned barcode is first resolved against your household's product memory and our own cache. Only if neither knows the code does our server – not your device – ask the open product database Open Food Facts about that article number. Nothing but the number is sent, nothing about you. Product data comes from the Open Food Facts database and is available under the Open Database License (ODbL).

We have data processing agreements under Art. 28 GDPR with OneProvider, Backblaze and OpenAI.

5. Retention

After account deletion, comments by other users remain; your username in them is replaced with "Deleted user".

If you share a household with other people, deleting your account means leaving it. What you added there stays for the remaining members – but without any link to you. If you owned the household, that role passes to the remaining member who has been part of it the longest.

6. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent at any time with effect for the future.

You don't have to write to us for that:

• Data export: Settings → Your data → Export your data. You get a ZIP with data.json and all original images – including your inventory, your shopping list entries, your recipes, your scans and your tours. It contains what you added yourself; if you are the only member of a household, it also contains that household's complete data including the product memory. Entries other members of a shared household made are not included – that is their data, not yours.
• Deletion: Settings → Your data → Delete account.

You also have the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany (https://www.baden-wuerttemberg.datenschutz.de).

7. Minors

Fridgee is for users aged 16 and over. We ask for the year of birth at registration. If we learn that an account is run by a younger person, we delete it. Our service is not directed at children.

8. Security

Transport exclusively over TLS. Passwords as argon2id hashes. Access to user data by our team is logged. Sessions use short-lived access tokens and rotating refresh tokens; changing your password logs out all other devices. Backups are encrypted and stored in the EU.

9. Cookies and local storage

We only use strictly necessary cookies:

We also store preferences such as design mode and the offline shopping list in your browser's local storage. That data never leaves your device. No consent banner is required for this under § 25(2) TDDDG.

10. What is public

Posts, comments, username, profile picture, cool score and rank are public – visible without an account and indexable by search engines (fridgee.net/f/…, /u/…, /t/…). Your inventory, shopping lists, Fridge Tour and restock recordings, product memory, e-mail address, year of birth and notifications are not public.

11. Changes

We update this policy when our processing changes. We announce material changes in the app. The current version is always at https://fridgee.net/legal/privacy.