Security
Your kitchen is nobody else's business.
Photos of a kitchen can show people, receipts, and addresses. Shelfcook is built so they never sit on a server. This page lists what we do today, not what we plan to do.
What we do
Nine commitments
Photos are processed, not stored
A photo is resized and stripped of location data on your phone, sent once to build your pantry, processed, and discarded. Nothing to leak, nothing to purge.
No passwords to leak
Sign in by email link, Sign in with Apple, or Google. An optional authenticator step is available in Settings, using the same mechanism that protects the admin.
Sessions you control
Sign out everywhere from Settings. On the phone, tokens live in the device's secure store, never in plain storage.
Row-level security on every table
Household data is readable only by household members. The rules live in the database schema, not in app code, and the service role is used only inside server functions and scheduled jobs.
Keys stay on the server
Every third-party key, including the AI provider's, sits behind our own server function. The app carries only the public database key and the public purchase key.
Rate limits and no bots
Every public form is rate limited by a keyed hash of the IP address (the address itself is never stored), carries a honeypot, and can be put behind a bot check with one setting.
A locked-down site
Every page ships a content security policy with per-request nonces, frame-ancestors none, strict referrer policy, and a permissions policy that denies camera, microphone, and location on the website.
Admin behind two steps
One customer sign-in for everyone, an allow list of admin accounts, and an authenticator code enforced at the database level, so an admin session without its second step reads nothing. Every admin action is written to an audit log.
No ad trackers, minimum data
No advertising identifiers, no cross-app tracking, so no tracking prompt on iOS. Analytics events carry no personal data, and website analytics run only after you say yes.
Your control
Export, delete, and ask
- Export your data as JSON from Settings in the app or from your account on this site.
- Delete your account from either place. The request is processed within 30 days and confirmed by email.
- Ask what we hold about you. Email support@shelfcook.app from your account address and we answer within 30 days.
Responsible disclosure
Found something?
If you believe you have found a security issue in the app, the site, or our server functions, tell us before you tell anyone else.
Email security@shelfcook.app with the steps to reproduce and how to reach you. The same details are in security.txt. We acknowledge reports within two business days, keep you updated while we fix the issue, and credit you if you want credit. We ask that you avoid accessing other people's data and give us reasonable time to fix before publishing.
What we do not claim: Shelfcook has not completed a third-party audit. When that changes, it will be listed here. Read the full privacy policy for what is collected and why.