Privacy Policy

Last updated: September 2026

Souva is a pantry and recipe app. We designed it to keep your data on your device.

Data stored on your device

Your pantry contents, saved recipes, preferences, and theme settings are stored locally on your device. They are not synced to any account and we cannot access them. Deleting the app deletes this data.

Data sent over the network

• Recipe search: ingredient names you search with are sent to TheMealDB and to our recipe-discovery service, which queries public recipe websites on your behalf. The recipes it finds are saved to a shared catalogue so the next person searching the same things gets an answer without another trip to the web, and the ingredient list that found them is stored alongside them. Nothing in that catalogue records who searched: there is no account, no device id, and no address attached to it.
• Barcode scanning: scanned barcode numbers are sent to Open Food Facts to look up nutrition information.
• AI recipe generation: your ingredient list and recipe preferences are sent to our recipe-generation service (hosted on Cloudflare), which forwards them to an AI model to create recipes. Requests are not linked to your identity, are not stored, and request contents are not logged. To enforce the free daily generation limit, the app sends a random identifier that is not derived from you or your device; the only thing stored server-side is a count of generations for that identifier, which is deleted automatically within 48 hours.
• Photo scanning (optional): if you choose to photograph your fridge or pantry, that photo is sent to our service and forwarded to an AI vision provider to identify ingredients. The photo is processed in memory only: it is never stored, never logged, and never used by us to train anything; location and other camera metadata are removed on your device before upload. The same random daily-limit identifier and 48-hour counter described above apply to photo scans. If you never use photo scanning, no photos ever leave your device.
• Receipt scanning (optional): if you choose to photograph a grocery receipt, the photo is read entirely on your device and the image never leaves your phone. Only the text of priced line items is sent to our service, where an AI model identifies the food items; that text is processed in memory only, never stored, and never logged. Store names, totals, payment details, and card information are filtered out on your device before anything is sent. The same random daily-limit identifier and 48-hour counter apply to receipt scans.

Advertising

Souva shows ads through Google AdMob only as optional "watch to unlock more" rewarded ads. There are no banner or interstitial ads. To serve ads, Google's advertising SDK may collect and process a device advertising identifier and related technical data as described in Google's Privacy & Terms. Souva requests non-personalized ads where possible, and on iOS you can decline app tracking and still use every feature. We ourselves do not build advertising profiles or sell your data.

Analytics

Souva uses Aptabase, a privacy-first analytics processor, to understand which features are used. The usage events we send contain no personal information and no advertising or device identifiers, are not linked to you, and are not used to track you across other apps or websites.

Purchases (Souva Unlimited)

If you buy Souva Unlimited, the purchase itself is handled entirely by Apple's App Store or Google Play, and we never see your name, card, or billing details. To activate the purchase, the app sends the store's transaction identifier to our server, which verifies it directly with Apple or Google and then stores a small entitlement record: the transaction identifier and the app's random install identifier. This record exists only to keep your purchase working across reinstalls and your own devices, and to prevent abuse of a shared license. Our analytics record only that a purchase or restore was attempted and whether it succeeded, never amounts, identities, or payment details.

Affiliate links

Souva has one affiliate link: a line under the nutrition facts on a recipe, pointing to Cronometer, a nutrition tracker. If you sign up through it, Souva may earn a commission. Every link that can earn Souva a commission says so plainly on the same screen as the link, before you tap it. A commission never changes what you pay, and it never changes which recipes or ingredients Souva shows you: results are ranked by your pantry match, not by what earns us money. Tapping such a link shares nothing with the store beyond the ingredient names you chose to send.

What we don't do

• No accounts, sign-ins, or logins
• No cross-app tracking, and no advertising profile built from your activity
• We do not sell your personal data
• We do not store your pantry, your saved recipes, or your preferences on our servers. Those live on your phone. The shared recipe catalogue described above holds ingredient lists that were searched, but never a pantry and never a person

Children

Souva is not directed at children under 13, and it does not knowingly collect personal information from anyone, including children.

How long anything is kept

The little the servers do hold, and for how long: daily usage counters (the free-tier caps) expire automatically within a day or two. Feedback you submit through the app is kept for 90 days, then deleted. If you buy Souva Unlimited, the store's purchase record (an order id and the country of purchase, with no name and no payment details) is kept for as long as needed to keep honoring your one-time purchase. Photos you scan are processed in memory and never stored at all. We also keep anonymous cost records for about 40 days: a date, a random id, and how many tokens a generation used. They tell us what the AI features cost to run. They contain nothing you typed and nothing that identifies you or your device. The shared recipe catalogue is kept indefinitely, because it is what stops us re-crawling the same recipes forever; it holds recipes and the ingredient lists that found them, with nothing tying either to a person.

Your rights

Privacy laws in some places (California's CCPA, Europe's GDPR, and others) give you rights to access, correct, or delete personal data a company holds about you. Souva's honest answer to such a request is that we hold almost nothing: there is no account, and your pantry and preferences never leave your device. Deleting the app deletes them. We do not sell or share personal information as those laws define it. If you want the one server-side record tied to a purchase or a feedback submission removed, email support@souva.app and we will handle it within 30 days.

Changes

If this policy changes, the updated version will be published at this URL with a new "last updated" date.

Contact

Questions? Email support@souva.app.