Privacy Policy

Fumet is a cooking app for recipes, meal plans, shopping lists and your pantry. This policy explains what personal information Fumet collects, why, who else sees it, how long it is kept, and what you can do about it.

The short version

• Much of Fumet works without an account. If you use the app as a guest or on a Pantry license, your recipes and lists stay on your device and we never receive them.
• When you create an account or turn on sync, we store what you put into Fumet so it can follow you between devices. We use it to run Fumet, and for nothing else.
• We don't sell your information. We don't show ads. We don't use advertising identifiers or tracking across other apps and sites.
• You can export everything you have stored with us at any time, on any plan, and delete your account from its settings.

Who we are

Fumet is run by FUMET LLC, an Oregon limited liability company (registry number 263808199), based in Portland, Oregon, USA. Our principal office address is on file with the Oregon Secretary of State and can be looked up by that registry number in the Oregon business registry. FUMET LLC is the controller of the personal information described here.

Questions about this policy or your information go to [email protected].

What we collect

When you use the app without an account

As a guest or on a Pantry license, your recipes, plans, lists, pantry and cook log are stored only on your device. We don't receive them. We do receive the following:

• Crash reports if the app fails (see Error reports).
• A purchase record if you buy Pantry. The app store processes the payment. Our purchase provider, RevenueCat, gives us the store's transaction id and a random identifier it creates for your install, which is how we confirm your license.
• A random device identifier that the app generates when it is installed. It is used to tie a Pantry seat to one device at a time. It is not linked to your hardware or advertising identifiers.

Scanning groceries into your pantry doesn't change this. A barcode the app needs to look up goes from your device to Open Food Facts, not to us, and on a Pantry license only once you agree to it (see Who else sees it). Receipt photos are read on your device and never sent anywhere.

When you create an account

• Account details: your email address and display name, and optionally a profile photo. We also record your language preference, taken from your device or browser when you sign up.
• Your password, stored only as a one-way hash. We cannot read it.
• Marketing email choice: whether you've agreed to receive news about Fumet and cooking tips by email, and when you agreed. It is off unless you tick the box when you sign up or turn it on in your account settings. You can turn it off there at any time.
• Sign-in sessions: for each device you sign in on, we keep the platform (for example iOS or web), an optional device name, and the IP address you signed in from. Your account settings show these sessions, so you can recognize and sign out devices you don't know. An IP address can show your approximate location.

What you put into Fumet

If you use Fumet on the web, or turn on sync in the app, we store the content you create:

• recipes, including their photos, notes and nutrition, and the web address of any recipe you import;
• recipe history;
• cookbooks, meal plans, shopping lists and store layouts;
• pantry items, and the barcodes and receipt lines you have scanned with the name you gave each one, so the app recognizes them next time;
• your cook log, including ratings and notes;
• saved searches.

Photos. We remove location and other hidden metadata (EXIF) from photos when you upload them.

Dietary and allergy information. On a Family plan, members can record diets and allergies so meal plans and shopping lists can respect them. Allergy information can reveal something about your health, so we treat all of it as consumer health data. Before we store yours, the app asks you to agree, separately from accepting our terms, to two things: that we keep it, and that we show it to the members of your household. Nobody can agree for you. If your household admin enters a profile for you, nobody sees or uses it until you accept it, and we delete it if you decline or don't answer within 30 days. We use this information only to filter and flag recipes for your household, and we never sell it or share it outside your household. You can turn your dietary profile off at any time, which deletes it from our servers and from the other members' devices when they next connect. Our consumer health data privacy policy, at getfumet.com/consumer-health-data, says more, including how to ask to see or delete it and how to appeal if we refuse.

When you share

• Household and list invitations: when you invite someone, we store their email address and send them an invitation. We keep it until they accept or the invitation is canceled, and delete it 7 days after it expires.
• Recipe links: if you create a share link for a recipe, anyone with the link can see that recipe without signing in until you turn the link off. Don't share a link to anything you want kept private.
• Households and shared lists: people you share with see the content you share with them, and your name next to changes you make.

When you buy something

We never see your card details.

• On the web and on Windows, Stripe processes payment. Stripe receives your email address and your payment and billing details, and tells us what you bought.
• On iPhone, iPad, Mac and Android, Apple or Google processes payment, and RevenueCat tells us what you bought. When you are signed in, RevenueCat knows your purchases by your Fumet account's id.

We keep a record of your subscription or license: the plan, the store, the store's transaction id and the renewal date. For a purchase through Stripe, we also keep the country of your billing address, and whether and when you asked us to start your plan straight away, with the version of the wording you agreed to. That decides what you get back if you withdraw from the purchase. We email you a confirmation of the purchase that includes this.

When you withdraw from a purchase

Anyone can use the "Withdraw from contract here" page at getfumet.com/withdraw, without signing in. We store what you type into it, exactly as you typed it:

• your name;
• your email address;
• the order or plan reference, if you give one;
• your browser's time zone, so we can tell you the time we received it in your local time;
• when we received it and when we sent the acknowledgment.

We email that address an acknowledgment of what we received. To handle the withdrawal, we match the email address to a Fumet account and look up that account's purchases. Once we have handled it, we also record the account it matched, what we did (a refund, or a reply) and why.

We keep this record for one year from the day we received it, even if you delete your account in the meantime, because it is our evidence that we handled your withdrawal as the law requires. If you delete your account, the record is no longer linked to it.

When you join the waitlist

Before launch, getfumet.com lets you join a waitlist. We store:

• your email address;
• when you signed up;
• when we sent the confirmation email;
• when you confirmed;
• when we sent you the launch email.

We use your address to send the confirmation and one email when Fumet launches. That launch email has an unsubscribe link, and unsubscribing deletes your address.

If you don't confirm within seven days, the link expires, and we delete the address 30 days later, or when Fumet launches if that comes first. We delete the whole waitlist seven days after the launch email is sent. To be removed sooner, email [email protected] from the address you signed up with.

When you contact us

If you email us, we keep the message and our reply so we can help you, and to keep a record of what was agreed. These messages are held in Google Workspace.

Error reports and diagnostics

When something breaks, the app, the website and our servers send an error report to Sentry. A report includes:

• what went wrong;
• the app or browser version;
• the device model and operating system.

We configure Sentry not to receive your IP address, email or the content you were working on. On the website, if an error occurs, Sentry may record a replay of the page's layout leading up to it. All text in it is masked and all images are blocked, so it shows the shape of the page, not what you typed or saw.

Security logs

To protect Fumet from attack, our hosting provider and our firewall log some network traffic. This includes the IP address of requests the firewall blocks or flags. Our application logs do not record IP addresses, email addresses or content.

Website analytics

We use Plausible to count visits to our website. Plausible sets no cookies and builds no profile of you. It counts unique visitors with a daily-rotating hash of the IP address and browser, which it does not store. We remove sign-in links and other private codes from page addresses before they are counted. The app has no analytics.

What we don't do

• We don't sell or rent your personal information, or "share" it for cross-context behavioral advertising as California law uses that word.
• We don't show ads, and we don't use advertising or attribution services.
• We don't collect your precise location.
• We don't offer sign-in with Apple, Google or other accounts, so we receive nothing from them.
• We don't use your recipes or other content to train AI models, and this version of Fumet sends your content to no AI provider.

Why we use it

Who else sees it

We use service providers to run Fumet. They process your information only on our instructions, under contracts that require them to protect it.

When we look up nutrition information, we send ingredient names (nothing about you) to the US Department of Agriculture's FoodData Central.

When you scan a barcode the app doesn't recognize yet, your phone sends the barcode number to Open Food Facts, an open database of food products, to find the product's name and size. It sends nothing else: no account, no device identifier, nothing from your pantry. On a Pantry license the app asks you first, and you can turn online lookup off or on at any time in Settings. Open Food Facts handles the request under its own privacy policy. Product details it returns are shown with credit to Open Food Facts.

Receipt photos you scan are read on your device and never leave it.

We may also disclose information:

• where the law requires it;
• to protect someone's safety or our rights;
• to a buyer or successor if FUMET LLC is sold or reorganized. A successor would be bound by this policy.

Cookies and storage on your device

The website uses only the cookies it needs to work:

The site also stores preferences in your browser's local storage, for example your theme, list view and an unsaved cook-mode edit. When the bot check is on, Cloudflare Turnstile checks your browser to tell people from bots. We don't turn on the Turnstile option that sets a clearance cookie. Everything here is either needed for security and sign-in or a preference you chose, so we don't ask for cookie consent.

The app stores your content, your preferences and your sign-in in its own storage on your device.

How long we keep it

Deleting your account and getting a copy

Export. You can export everything you have stored with us from your account settings, on any plan, as a file you can keep or import back into Fumet. Recipes can also be exported as PDF.

Delete. You can delete your account from its settings. Deletion is immediate and permanent. It removes:

• your content. Your profile photo is removed from storage within eight days;
• your sessions;
• your place on other people's shared lists;
• your Pantry licenses;
• households you run alone.

A shared household you belong to stays with its other members. Deleting your account also:

• cancels any subscription you pay for through our website, immediately and without a refund for the rest of the period;
• deletes your customer record at Stripe, including your saved payment cards;
• does not cancel a subscription bought through the App Store or Google Play. Cancel that in your store account first, or it will keep renewing.

After deletion we keep:

• a record that an account existed, with your name and email removed;
• your purchase history, for tax records. Stripe also keeps the invoices and payments it processed for you, with the name and email on them, for the same reason;
• any withdrawal request you made, until a year after we received it (see When you withdraw from a purchase);
• a security log of actions our staff took on the account.

Data on your devices is yours to remove. Uninstalling the app deletes it.

Your rights

Wherever you live, you can ask us to:

• show you the information we hold about you;
• correct it;
• delete it;
• give you a copy in a portable format.

You can do most of this yourself in your account settings; for anything else, email [email protected]. We'll answer within one month (45 days for requests under US state laws). We may ask you to confirm the request from the email address on your account. We won't treat you differently for exercising these rights.

In the EEA, the UK and Switzerland, you can also:

• object to processing based on our legitimate interests;
• ask us to restrict processing;
• withdraw consent at any time;
• complain to your local data protection authority.

In California and other US states with privacy laws, you have the rights above, and you can appoint an authorized agent. We don't sell or share personal information for targeted advertising, and we don't use sensitive information to infer characteristics about you. If we decline a request, you can appeal by replying to our answer; we'll respond within 60 days.

International transfers

Fumet is run from the United States, and our servers are in the United States. If you use Fumet from elsewhere, your information is transferred to and stored in the US. Where the law requires a transfer mechanism, our US providers rely on the EU-US Data Privacy Framework and its UK Extension, with the European Commission's Standard Contractual Clauses and the UK Addendum as a fallback in their data processing agreements. RevenueCat relies on Standard Contractual Clauses and the UK's International Data Transfer Addendum. Plausible keeps website visit data in the EU and doesn't transfer it.

Security

• Information is encrypted in transit and at rest.
• Passwords are hashed.
• Sign-in and reset links are stored only as hashes.
• Access to production systems is limited, and every action our staff take on an account is logged.

No service is perfectly secure. If a breach affects your information, we'll tell you and the authorities as the law requires.

Children

Fumet is not directed at children. You must be at least 13 to create an account, or 16 in the EEA and UK. We don't knowingly collect information from younger children. If you believe a child has given us information, email us and we'll delete it.

Changes to this policy

When we change this policy, we'll update the date above. If a change is significant, we'll tell you in the app or by email before it takes effect.

Contact

FUMET LLC, Portland, Oregon, USA (Oregon registry number 263808199). [email protected]