Privacy Policy
Last updated: October 30, 2026
This policy explains what spoil ("spoil", "we") collects, why, and the choices you have. It covers the spoil app and this early-access website.
The early-access list (this website)
When you join early access we store: your email address, how you signed up (email, Google or Apple), which of our social accounts sent you (the src in the link), your optional answers to the two questions, and the time you joined.
We use it only to email you when spoil launches and to decide what to build first. We do not sell it, share it, run ads with it or track you across other sites. The site sets no tracking cookies and loads no analytics.
Email sign-ups get one confirmation email; nothing else is sent until launch. Every email carries a removal link, and the "Remove me" form on the home page sends one at any time. Unconfirmed email sign-ups are deleted after 30 days.
Security: the sign-up form is protected by Cloudflare Turnstile (Cloudflare processes a token to tell people from bots); "Continue with Google" sends Google's sign-in token to our server, which only keeps the email address. Rate limiting keeps a hashed, short-lived form of your network address for a few hours; it is never stored with your email.
What the app collects
- Account data: your email address and display name, and if you use Google or Apple sign-in, the name and email those services share with us.
- Receipt photos: photos you choose to scan. They are uploaded to private storage, read once to list your groceries, and then deleted.
- Kitchen data: the food items, dates, recipes cooked, restock lists and savings figures you create in the app.
- Purchases: whether you have spoil Premium. Payments are handled by Apple, Google and RevenueCat; we never see your card details.
- Basic technical data: logs needed to run and secure the service (for example IP address and request times).
Instant Demo mode keeps your demo kitchen on your device. If you scan a real photo in demo mode, it is processed the same way as above under an anonymous account.
How we use it
Only to provide the app: reading receipts, tracking freshness, sending expiry reminders, unlocking Premium and keeping the service secure. We do not sell your data, show ads, or track you across other apps or websites.
Service providers
- Supabase: accounts, database, file storage and the early-access list (United States).
- Cloudflare: hosts this website and provides the Turnstile bot check.
- Brevo (or another transactional email service): delivers the confirmation and launch emails.
- Google Gemini: reads the text of receipt photos in the app.
- RevenueCat, Apple and Google Play: subscriptions and purchases.
- Grocery stores (Instacart, Amazon Fresh, Walmart, Target): only when you tap a checkout link, which may include an affiliate tag. What you do on their sites is covered by their policies.
Retention and deletion
Receipt photos are deleted after reading. Other app data is kept while your account exists. You can delete your account and all its data anytime in the app under Me → Delete account, or by emailing us from your account address. Early-access emails are deleted when you use a removal link, or after launch once the launch email has gone out.
Security
Data is encrypted in transit, and each user can only access their own data.
Children
spoil is not directed to children under 13 and we do not knowingly collect their data.
Your rights
Depending on where you live you may have rights to access, correct, export or delete your data. Email us and we will respond within 30 days.
Changes
We will update this page and the date above when this policy changes.
Contact: yousafkhokharxiii@gmail.com