ShelfSage Privacy Policy
What stays on your device
Your profile (allergies, diets, preferences), pantry, saved recipes, shopping list and scan history are kept on your device.
What our server stores
Our server runs on Cloudflare's network, and your install's records are stored with Cloudflare.
- A random install id that our server issues to the app when it first connects, not tied to your name, email or Apple ID.
- Your scan counts for each month, used to apply the monthly scan allowance.
- If you subscribe to ShelfSage Plus: the subscription's transaction id, product and expiry date, so that your install is recognised as subscribed. These subscription records are tied to your install id. Payment details never reach us; Apple handles payment.
- Operational logs that record what happened (for example which request failed), with only a shortened tail of your install id. They contain no photos, no text you wrote, no AI prompts and no full install id.
The server also keeps a cache of AI answers for text requests (for example product facts and recipes) on its disk, for up to 30 days (recipes, 7 days), so that repeat questions are answered faster and cost less. Each entry is filed under a one-way hash of the request and holds only the answer, not your question, your profile or a photo; an answer can repeat words you typed. Photo scans are never cached.
Feedback and crash reports
Feedback, ideas and crash reports are limited to TestFlight test builds. In those builds, if you use Send feedback or share an idea, or the app crashes, the text you wrote or the crash report (app version and technical crash details) is sent to the developer's own server, and when you reach the monthly scan limit the app sends the developer a short note that includes your install id. The App Store version sends none of these. Nothing is sent to any third-party analytics or advertising service, and the app contains none. If you email support, we receive what you write and the app and iOS versions the app adds at the end.
What is sent to Anthropic, our AI provider
When you scan, search or chat, the photo or text you provide and the relevant parts of your profile (such as allergies and diets) are sent through our server to Anthropic, the AI provider, for that single request, so it can write the answer. The server does not save your photos or text requests, and the AI provider receives them only to answer.
Your IP address
To prevent abuse, our server briefly uses your IP address to apply request rate limits. Only a keyed one-way hash of it is kept, for at most an hour, and never with your install's records.
No selling, no tracking
Your data is not sold, not shared for advertising, and not used to track you across other apps or websites. The app contains no advertising or third-party analytics.
Contact
Questions, or a request to remove your install's server records: email support@blowfish.works.
ShelfSage 隐私政策
保存在你设备上的内容
你的档案（过敏原、饮食习惯、偏好）、食材库、收藏的菜谱、购物清单和识别记录都保存在你的设备上。
我们的服务器保存什么
我们的服务器运行在 Cloudflare 的网络上，你的安装记录由 Cloudflare 存储。
- 应用首次连接时由我们的服务器分配给它的随机安装标识，它与你的姓名、邮箱或 Apple 账户无关。
- 每个月的识别次数，用于执行每月的识别额度。
- 如果你订阅了 ShelfSage 会员：订阅的交易编号、商品和到期时间，以便识别这个安装已订阅。这些订阅记录与你的安装标识关联。支付信息不会到达我们这里，付款由 Apple 处理。
- 记录运行情况的日志（例如哪个请求失败），其中只包含安装标识的末尾几位。日志不含照片、你写下的文字、AI 提示词，也不含完整的安装标识。
服务器还会把文字类请求（例如商品信息和菜谱）的 AI 回答缓存在磁盘上，最长 30 天（菜谱为 7 天），让重复的提问更快、更省钱。每条缓存以请求的单向哈希值命名，只保存回答，不保存你的提问、你的档案或照片；回答中可能含有你输入过的词句。拍照识别的结果从不缓存。
反馈与崩溃报告
反馈、想法和崩溃报告仅限 TestFlight 测试版。在测试版中，如果你使用「发送反馈」或分享想法，或者应用发生崩溃，你写下的文字或崩溃报告（应用版本和技术性的崩溃细节）会发送到开发者自己的服务器；当你达到每月识别上限时，应用还会向开发者发送一条简短提示，其中包含你的安装标识。App Store 版不会发送以上任何内容。不会向任何第三方统计分析或广告服务发送数据，应用中也没有这类服务。如果你发邮件给我们，我们会收到你写的内容，以及 App 在末尾附上的 App 版本和 iOS 版本。
发送给 AI 服务商 Anthropic 的内容
当你识别、搜索或聊天时，你提供的照片或文字，以及档案中的相关部分（例如过敏原和饮食习惯），会经由我们的服务器发送给 AI 服务商 Anthropic，仅用于这一次请求，以便生成回答。服务器不会保存你的照片和文字请求，AI 服务商收到它们也只是为了作出回答。
你的 IP 地址
为防止滥用，我们的服务器会短暂使用你的 IP 地址来执行请求频率限制。只保存它经过密钥处理的单向哈希，最长一小时，且从不与你的安装记录一起存储。
不出售，不追踪
你的数据不会出售，不会用于广告共享，也不会用来跨其他应用或网站追踪你。应用不含广告和第三方统计分析。
联系方式
如有疑问，或希望删除你的安装在服务器上的记录，请发邮件至 support@blowfish.works。