Empty Basketby Empty Studios

Empty Basket

Privacy Policy

Last updated: October 27, 2026
Developer: Empty Studios
Contact: privacy@emptystudios.online

This policy explains what data Empty Basket ("the app") collects, how it's used, who can see it, and how you can remove it.

1. What we collect

When you sign in and use Empty Basket, the following data is created and stored:

  • Account information
    • Your email address (provided by Sign in with Apple — may be a private relay address)
    • Your display name (provided by Sign in with Apple on first sign-in)
    • A user ID (a random identifier issued by Firebase Authentication)
  • Device identifier for push notifications
    • A Firebase Cloud Messaging (FCM) token, used only to deliver notifications to your device
    • Your notification preferences (which kinds of notifications you want to send and receive)
  • App content you create
    • Pantry items and their attributes (name, brand, category, stores, tags, notes, in-stock status, and any barcodes you scan for them)
    • Shopping lists and shopping list items, including purchase and "skipped" status and shopping notes
    • Meals and recipes: names, descriptions, ingredients, instructions, notes, servings, prep time, meal type, cuisine tags, ratings, recipe links, and the dates you made a meal
    • Your meal plan: the dates and meal types you schedule meals for, and which meals household members have marked "want to make"
    • Your custom category and sub-category sort order
    • Who created or last changed each item, list, or meal (shown to household members)
  • Calendar features (only if you use them — see section 5)
    • The web addresses (URLs), names, and colors of any external calendars you subscribe to, and the events we retrieve from them
    • The on/off setting and private link for your published meal-plan calendar
  • Household membership
    • The household you belong to and the names of other members in that household
  • Sharing subscription status (only if you share your household)
    • The date your sharing subscription is paid through, and whether it renews automatically

We do not collect: your location, contacts, health data, advertising identifiers, browsing history, analytics events, or crash reports. The app does not track you across other apps or websites. Photos you scan are processed on your device and are never uploaded (see section 4).

2. How we use it

Your data is used solely to provide the app's functionality:

  • Sign you in and keep you signed in
  • Sync your pantry, shopping lists, meals, and meal plan across your devices
  • Share them with the other members of your household
  • Deliver push notifications about household activity (for example, new shopping lists, items checked off, new or scheduled meals, and a daily summary of tomorrow's meal plan). Notification text can include item names, meal names, and the name of the member who made the change.
  • Show events from calendars you subscribe to, and publish your meal plan as a calendar if you turn that on

We do not sell your data. We do not use it for advertising. We do not use it to train AI models.

3. Where it's stored and who processes it

App data is stored in Google Firebase (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting, and Firebase Cloud Messaging), operated by Google LLC. Firebase acts as a data processor on our behalf. Data is stored on Google Cloud infrastructure in the United States.

For details on Google's privacy practices, see Google's Privacy Policy and Firebase Privacy & Security.

We also rely on:

  • Apple — Sign in with Apple handles sign-in, the Apple Push Notification service delivers notifications to your device, and the App Store handles subscriptions (see below).
  • Calendar providers you choose — if you subscribe to an external calendar, our servers request it from the address you entered (see section 5).
  • Open Food Facts — when you scan a barcode, the app sends only the barcode number to Open Food Facts, an open, nonprofit product database, to look up the product's name and brand. No photo, account information, or other personal data is sent with it. Open Food Facts receives the request from your device, including your IP address, as with any website; see their privacy policy.

We do not share your data with any other third parties.

Subscriptions. Using your own pantry is free. Sharing it with others requires a subscription, which the household's owner buys and manages through Apple's App Store; people who join a shared household never pay. Apple processes the payment; we never see your payment details. So that members' devices know sharing is active, the owner's device saves the date the subscription is paid through, and whether it renews automatically, on the household's record in our database. We don't store payment details or purchase history.

4. On-device processing

Some features run entirely on your device and do not send data anywhere:

  • Recipe scanning. When you scan a recipe with your camera or choose photos from your library, the text is read and turned into a recipe on your device (using Apple's Vision framework and, where available, Apple's on-device Foundation Models). The photos are not uploaded, not stored by the app, and not attached to the meal. Only the recipe you choose to save is synced.
  • Item scanning. When you scan an item, Empty Basket reads the label and recognizes the item on your device (Apple's Vision framework and, where available, Apple's on-device Foundation Models). Photos are not uploaded or stored. The only thing that leaves your device is a scanned barcode's number, for the lookup described in section 3.
  • Category suggestions when adding a pantry item (Apple's on-device Foundation Models, on iOS 26+ devices with Apple Intelligence enabled)
  • Duplicate-item detection when saving a pantry item
  • Color and display preferences are stored only on your device.

Apple's on-device models do not transmit your input off the device.

5. Calendar features

These features are optional and are set up by the household creator.

  • Subscribed calendars. If you add an external calendar link (for example, a published iCloud calendar), our servers fetch that link roughly every six hours and store the events from about one month in the past to three months ahead. The calendar provider sees requests coming from Google Cloud servers, not from your device. The calendar link and its events are visible to everyone in your household. Removing a calendar deletes its stored events.
  • Published meal plan. If you turn on "Publish Meal Plan," your household's scheduled meals (meal names, meal types, dates, and short descriptions) are available as a calendar at a private link. Anyone who has that link can view your meal plan, without signing in. Share it only with people and devices you trust. You can turn publishing off, or regenerate the link so the old one stops working, at any time in Settings.

6. Sharing with household members

Empty Basket lets you share a household with other users via an invite code. Anyone who is a member of your household can see and modify the shared pantry items, shopping lists, meals, and meal plan, can see subscribed calendar events, and can see the names of other members and who made each change. This is an intentional feature of the app — please only invite people you trust.

You can leave a household at any time, and the household creator can remove members at any time. Your personal pre-household data is preserved when you join another household and is restored if you leave.

7. Files you export

You can export backups, recipes, and shopping lists as files (JSON, HTML, or PDF) and share them using the iOS share sheet. Once you export or share a file, it is under your control and is handled by whatever app or service you send it to.

8. Data retention and deletion

  • In-app deletion: You can delete pantry items, shopping lists, meals, and subscribed calendars, and clear your entire pantry, at any time from within the app.
  • Meal plan history: Past meal-plan entries are kept for about six months, then removed automatically.
  • Account and data deletion: To delete your account, open the app's Settings screen and use "Delete Account." This permanently removes your account, your user record (including your notification token and sort preferences), and revokes the app's Sign in with Apple authorization. What happens to your household's data depends on your role:
    • If you are the only member of your household, the entire household is deleted — pantry items, shopping lists, meals, meal plan, calendar subscriptions, and the published meal-plan link.
    • If you created a household that has other members, ownership passes to the longest-standing member and the household's shared data stays with them.
    • If you joined someone else's household, you are removed from it. Items and meals you added to that shared household remain part of it, and your name may still appear as the person who created or last changed them.

      • This action cannot be undone.

  • If you sign out without deleting: your data remains in Firestore until you sign back in or until you request deletion.
  • Backups and logs: Google Firebase may retain backup copies and operational logs for a limited period as part of its standard service operation. These are not accessible to us.

If you cannot access the app and need your data deleted, email privacy@emptystudios.online from the address associated with your account and we will delete it manually.

9. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete the personal data we hold about you (for example under the GDPR in the EU/UK or the CCPA in California). To exercise any of these rights, email privacy@emptystudios.online. We will respond within 30 days.

10. Security

Data in transit between the app and Firebase is encrypted using HTTPS/TLS. Data at rest in Firestore is encrypted by Google. Sign-in is handled by Apple and Firebase Authentication; we never see or store your Apple ID password. The published meal-plan link is protected only by its secrecy, which is why you can regenerate it at any time.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify affected users.

11. Children

Empty Basket is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to this policy

If we change this policy, we will update the "Last updated" date at the top of this page. For material changes, we will also let you know in the app or in the app's release notes.

13. Contact

Questions, requests, or concerns:

Empty Studios privacy@emptystudios.online