Privacy Policy

Last updated: October 16, 2026

Perio helps you track food and expiry dates. This policy describes the Android and iOS app and these information pages. Perio is operated by Donguk Oh, an individual. For privacy questions or requests, contact perioapps.admin@gmail.com.

Information we process and why

• Your account: email address, Firebase user ID, internal account ID and account creation time, to sign you in and keep your pantry separate from other users. Firebase Authentication handles your password and authentication tokens; the Perio API does not store your password. Firebase also processes IP addresses and user-agent information for authentication and abuse prevention.
• Your pantry: food names, categories and subcategories, expiry dates, creation times, item IDs and photo reference IDs. Custom category names are also stored. We use these to show, edit and organize your food and schedule reminders.
• Buy again: when you mark food as finished, we remove the current food entry and remember its name, category, subcategory and source ID. Removing a remembered entry or refilling it hides it from the list, but keeps this record to prevent retries from restoring it. A refill uses a new expiry date and does not reuse the old photo.
• Reliability and AI limits: item creation request IDs, item IDs and a hash of the submitted item details prevent duplicate saves. AI request keys, hashes of your user ID and submitted request, request times, plan, outcome and cost records enforce limits and prevent duplicate analysis. These records do not contain photo bytes.
• Support and service operation: if you contact us, we receive your email address and the details and attachments you choose to send. Infrastructure providers may process IP addresses, request metadata and diagnostic logs to deliver and protect the service.
• Crash diagnostics: production mobile builds use Firebase Crashlytics to detect app failures. Reports include crash stack traces, app and operating-system versions, device state and installation identifiers. Perio replaces Dart error messages with fixed diagnostic codes and does not attach your account ID, email, food, photos, authentication tokens or purchase evidence. Native crash diagnostics are produced by the platform SDK. We do not add Analytics breadcrumbs, advertising identifiers or custom user identifiers. Reports may be queued on your device until a later app launch and network connection.

Photos and optional AI analysis

Scanning sends the food and expiry-label photos you take through the Perio API to OpenAI to extract food details. Refilling with a new expiry photo sends that photo for analysis. Photos can reveal anything visible in the frame, so avoid including people, addresses or other sensitive information. The API sends photos and extraction instructions; it does not add your email address, Firebase user ID or internal account ID to the OpenAI request.

The API does not save photo bytes. To recover a lost response without repeating analysis, it stores an encrypted copy of extracted food names, categories and expiry dates, even if you have not saved them as pantry items. These analysis results and their request keys remain until you delete your account. Only details you confirm and save become pantry records. Photo reference IDs are saved in those records. Original captures are stored in the app's private storage on your device, including captures from failed or abandoned scans. They are not automatically erased when you delete an item, sign out or delete your account.

You can add food manually without sending photos for AI analysis. Denying camera permission prevents scanning; manual entry remains available. AI results may be wrong: review names and dates before saving.

Service providers and international processing

We use Google Firebase Authentication for accounts and Firebase Crashlytics for crash diagnostics, Microsoft Azure App Service and Azure SQL for the API and pantry database, OpenAI for photo analysis, and Google Gmail for support correspondence. These providers process information to perform their services. Processing may occur outside your country. Firebase Authentication processes data in the United States. These pages do not add advertising, analytics scripts or tracking cookies.

On iOS, Google's sign-in SDK may collect a user identifier and IP address, which Google may use to estimate general location for fraud prevention. Its privacy manifest also declares name, email address, phone number, device identifiers, usage and other data for sign-in functionality or analytics. These SDK declarations are broader than the profile fields Perio stores; Perio does not request your phone number or device location permission. See Google's sign-in disclosure and the SDK privacy manifest for provider details.

OpenAI's API data controls state that API content is not used for model training by default unless the API customer opts in. Its default abuse-monitoring retention is up to 30 days, with possible longer legal or safety retention; flagged image inputs may be retained for manual safety review. Perio does not promise Zero Data Retention or a particular data-residency arrangement. Provider retention is separate from deleting your Perio account.

Retention and deletion

When store subscriptions are enabled, Apple or Google handles payment. Perio verifies purchase status with the store using a random account binding, product and transaction identifiers. Purchase evidence needed for rechecking is encrypted on the server. Perio does not receive your payment card details. Deleting your Perio account does not cancel a store subscription; manage cancellation in your Apple or Google subscription settings.

• Live pantry data: retained until you delete it or delete your account. Deleting a food entry removes that entry, but its duplicate-save prevention record remains for the account's lifetime. Buy-again records, including hidden entries, also remain for the account's lifetime.
• Account deletion: Open My account → Delete account and confirm your identity using your password or the Google or Apple sign-in method offered in the app. It deletes the live SQL account, food, custom categories, buy-again records and item creation records, then requests deletion of the Firebase identity. If interrupted, deletion may remain pending; retry Delete account until completion is confirmed. Uninstalling the app does not delete your server account.
• Security exception: a SHA-256 hash of the deleted Firebase user ID, deletion request time and completion flag are retained indefinitely to block reuse of that deleted identity and support interrupted deletion. This is a pseudonymous security record, not anonymous data.
• AI recovery and cost records: account deletion erases encrypted analysis results, client request keys, request-content hashes and the user-ID hash from AI usage records. Internal request IDs, timestamps, plan, costs and outcome flags, together with monthly budget totals, remain without that account attribution. No automatic expiry is currently applied to these cost records.
• Purchase security records: account deletion removes the account binding, encrypted purchase evidence and stored product/status dates. Transaction/token hashes and a random owner identifier remain indefinitely to prevent a deleted account's purchase from being claimed by another Perio account. These are pseudonymous security records, not anonymous data. Store records follow Apple's or Google's separate retention rules.
• Provider copies: deleting live data does not immediately remove backup or provider log copies. Azure backups expire under the database's configured retention policy; a fixed expiry period has not yet been verified for this deployment. Firebase's policy says authentication IP logs remain for a few weeks, and other authentication information is removed from live and backup systems within 180 days after user deletion is initiated. Perio's own API diagnostics contain route templates, status codes, response times and random server request IDs, with no account identifier or request content. These use two daily files with an approximate 10 MB cap each. Older files are removed as new logs are written; this is not a fixed retention in days and inactive files can remain longer. Other infrastructure log retention is managed separately and has not been fully verified.
• Crash reports: Firebase states that Crashlytics retains crash traces and associated installation identifiers for 90 days before starting removal from live and backup systems. Reports are not linked to your Perio account by a custom user ID; account deletion does not immediately delete these provider diagnostics. Clearing app storage removes locally queued reports.
• Device copies: clear Perio's app storage or uninstall it to remove local photos. This also removes local app state; your online account must be deleted separately. Device or cloud backups can retain copies according to your operating system and backup settings.
• Support: We retain support emails, replies and attachments for 90 days after the inquiry is resolved, then delete them from our support mailbox. Email provider copies may remain under provider retention policies. This period applies to support correspondence, separately from your pantry data.

Your choices and requests

You can view and edit pantry entries, delete food, use manual entry instead of AI, and turn camera or notification permission off in device settings. Expiry reminders are scheduled locally and can display food names on your lock screen; control previews in device settings. Signing out clears scheduled reminders but does not delete your account or local photo files.

Contact perioapps.admin@gmail.com to request access, correction or deletion, or to report a privacy concern. Tell us which account email is involved; do not send passwords or authentication tokens. We may need to verify ownership before releasing or deleting account information. Depending on your location, you may also have rights to object, restrict processing, obtain a copy of information or complain to a data-protection authority.

Changes

We will update this page and its date when our practices change. Review the current policy before using a changed feature.