Fridge Door Privacy Policy

Who I am

Fridge Door is made by Jason Foster, trading as Designspin, a software engineering practice based in Norwich, UK. For anything related to your personal data, get in touch through the support form.

The short version

There is no account to make with me, no analytics package in the app, no advertising network and no code from anyone who does those things. What your family puts into Fridge Door is kept on your phones and in iCloud, and none of it is sent to me. The only thing of mine that the app talks to is a small relay that passes notifications on to Apple, and what it carries is sealed so that it can't be read on the way.

What your family puts in, and where it is kept

The names, colours and pictures you give the people in your family, the shopping list, meals and their photos, plans, notes, jobs, points, prizes and the moves in your games are all kept in two places: on each phone or iPad in the family, and in Apple's iCloud.

In iCloud they are kept in the account of the person who started the family, and shared from there with the people that person has let in. That is Apple's service, covered by Apple's privacy policy, and it is private to those accounts: I have no access to it, and no copy of any of it exists anywhere else.

Who can see it

The people in your family, and nobody else. A phone joins by scanning a code shown on the phone of the person who started the family, joining is only open while that code is on the screen, and a phone can be taken out of the family again at any time. Within the family, grown-ups can see a little more than children: a child sees only their own points, for instance.

Notifications

When something happens that someone in the family should hear about, the phone it happened on writes the notification and seals it with a key that is kept with your family's things. It then sends the sealed words to a relay I run on Cloudflare, which hands them to Apple's notification service, and the phone that receives them opens them. Neither the relay nor I ever have the key, so the words can't be read on the way.

To do that job the relay is given three things: the sealed words, the addresses Apple issues for the phones to be notified (their push tokens), and a one word label for the part of the app the notification is about, such as the list or a game, so that your phone can group them. It passes these to Apple and keeps none of them. Its log records only how many notifications were sent and, where Apple refused one, the reason Apple gave.

To stop the relay being abused it limits how often one internet address can send and how often one phone can be notified. That means the sending phone's internet address and the push tokens are counted for about a minute by Cloudflare's rate limiter, and then forgotten. Cloudflare runs the relay on my behalf and handles each request under its own privacy policy.

Turn notifications off for Fridge Door in iOS Settings and your phone stops being sent anything.

The camera and your photos

The camera is used for one thing, which is scanning the code on another phone to join a family. Nothing it sees is saved or sent. When you add a picture to a person, a meal or a prize you choose it with Apple's photo picker, so the app is only ever given the pictures you pick. They are kept with the rest of your family's things.

Recipes from the web

When you share a web page to Fridge Door, the app reads the recipe out of that page. If all it was given was a link, your phone fetches the page and the recipe's picture from that website, exactly as a browser would, so the website sees a visit from your phone. Nothing about what you save is sent to me.

Suggestions

Ideas for the week's dinners are worked out on your phone from the meals your family has saved, planned and said they like. On an iPhone or iPad with Apple Intelligence switched on, the app can also suggest ingredients for a meal using Apple's own model, which runs on the device. In both cases nothing leaves your phone.

The purchase and the free trial

Unlocking the rest of the app is a one off in app purchase, and the free trial before it is handled the same way. Both go through Apple. Your payment details go to Apple and never come near me or the app. The app is told only that the purchase or the trial exists, which is what unlocks things, and restoring on a new phone asks Apple, not me.

Children

Fridge Door is made for families, so children use it. A grown-up starts the family and adds each child, and a child's phone or iPad joins the same way as anyone else's, signed in to that child's own Apple Account. For a child under 13 that is an account a parent has made for them through Apple's Family Sharing.

The app collects no data from anyone, of any age. What a child adds goes to the family's iCloud with everything else and is seen only by the family. Children are never shown a price, an offer or an advert, and there is no way for anyone outside the family to contact them: the notes and the games are between the people in the family and nobody else.

Leaving, and deleting everything

Anyone can leave a family in the app's Settings, which takes its things off their phone. The person who started the family can delete it for everyone there too, which removes it from iCloud and from every phone in it, and can't be undone. Because I hold nothing, there is nothing for me to delete, and nothing I could restore for you afterwards.

What Apple tells me

Apple tells every developer how many times their app has been downloaded and bought, as totals. If you have chosen in iOS Settings to share analytics with app developers, Apple also passes on anonymous crash reports. These come from Apple, not from the app, and they contain nothing your family has put in.

If you write to me for support

The support form on this site sends your name, email address and message to my inbox so that I can reply. That is the only place you can hand me any personal data, you have to choose to do it, and I keep it only as long as it takes to sort out whatever you wrote about. It is never used for marketing and never passed to anyone else.

Changes to this policy

If the app ever starts collecting anything, this page will say so before it ships and the date at the top will change. As things stand there is nothing to disclose.