What we keep, and why.

What Fare stores

• Your account: the email you sign in with, your name if you give one, and a session cookie that lasts 30 days. There are no passwords.
• Your household: its name, zip code, time zone, the stores you shop, the nutrition framework you pick, and the roster you enter (names, roles, birth years, allergies, dislikes, diet preferences). Everyone signed into the household sees the same data.
• What you add: receipt photos and the line items read from them, barcode scans, shelf photos (only if you turn on saving them), pantry and shopping items, recipes you save, what you cook, what you finish or toss, and your conversations with the coach.
• Usage: which screens you open and which features you use, and a count of the AI calls your household makes.
• If you connect Kroger: the tokens Kroger issues so Fare can add items to your cart, and the store you pick. Fare never sees your Kroger password. Disconnect at any time in Settings, which deletes the tokens.
• If you subscribe: your Stripe customer and subscription ids. Card details never touch Fare; Stripe holds them.

Who processes it

Fare runs on a single server in the United States. To do its job it sends specific data to these providers, and nothing else:

• Anthropic (Claude) reads receipt and shelf photos, product names and ingredient lists, your pantry, and your coach messages to grade items, plan meals, and answer questions. Household text is passed as data for the task, never used by Fare to train anything.
• OpenAI generates recipe illustrations from recipe titles only. No personal data is sent.
• Open Food Facts is queried by barcode to look up products. Product photos are loaded from their servers and credited on every page that shows one (CC BY-SA). The USDA FoodData Central database is queried by product name.
• Kroger receives product searches and, when you send a run, the items to add to your cart, under your own Kroger account and Kroger’s terms.
• Resend delivers sign-in links and the optional weekly email digest.
• Stripe handles payment if you subscribe.
• Mixpanel collects product analytics (screens, clicks, feature use) so we can see what is working. It sets its own cookies.
• Fly.io hosts the server and its encrypted disk, and a separate storage provider holds nightly backup copies, kept for 14 days.

Fare does not sell data, does not show ads, and does not share data with advertisers.

How long, and how to delete

• Shelf photos are removed automatically after a short retention window, and are only saved at all if you turn that on.
• Reset kitchen in Settings deletes everything your household has accumulated (pantry, receipts and their photos, purchases, lists, plans, coach conversations, notifications) while keeping the account so you can start over.
• To delete the household and every account in it, or to get a copy of your data, email hello@fare.kitchen from the address you sign in with. Deletion also purges backup copies within the 14-day retention window.
• Sign-in links expire after 15 minutes; sessions after 30 days. Both are stored hashed.

What Fare is not

Grades and suggestions are informational. They are computed from public product data and the framework you chose, not from your medical history, and they are not medical or dietary advice. Fare is not directed to children under 13, and household rosters are entered by adults in the household.

Changes

When this page changes in substance the date at the top changes with it. Questions go to hello@fare.kitchen.