Privacy statement
Last updated: 7 September 2026.
This statement describes how this Basket & Burner instance handles personal data. Basket & Burner is a self-hosted pantry app. Data stays on the operator’s server unless a feature you use sends a request to a third party.
Who is responsible
The operator of this Basket & Burner instance decides how it is run (where it is hosted, who has admin access). This is not a public SaaS product with a separate company privacy office.
What we store
If you create an account we store:
- Email, username, and a hashed password (not the password itself)
- Pantry items (name, brand, barcode/PLU, quantity, dates, location, notes)
- Preferences (diet, allergies, cuisines, recipe sites, cook-time, and similar)
- Shopping list and recipe favourites/ratings where those are saved for your account
On Android, a PIN lock and on-device copies of pantry/list/preferences may also be stored on the phone.
We do not sell your data. We do not run advertising trackers on the app screens.
What we send elsewhere
Only when a feature needs it:
- Barcode lookup — the barcode may be sent to Open Food Facts
- Recipes — pantry ingredient names, search text, and diet/cuisine filters may be sent to recipe providers (for example TheMealDB, Forkify, Spoonacular if a key is configured). Sites you add under Preferences may be fetched to import a recipe page
- Food checker — product text you submit is checked against *your* preference rules on this server
We do not send your full pantry or shopping list to grocery delivery companies.
Cookies and local storage
The web app stores a sign-in token in the browser (local storage) so you stay logged in. The shopping list and some recipe stars may also be kept in the browser. You can clear them by logging out and clearing site data.
How long we keep it
Account and pantry data stay until you delete them or the operator deletes the instance. The operator may keep backups of the server for a limited time.
Your choices
You can edit pantry items and preferences in the app. You can export a shopping list as text or CSV. To delete your account and data, contact the operator of this instance.
If this instance is run in the UK or EEA, you may also have rights of access, correction, and erasure under UK GDPR / GDPR. Ask the operator.
Security
Passwords are hashed. The operator should keep the server and database off the public internet except through the access they choose (for example a LAN URL or a login gate). No system is perfectly secure.
Changes
Updates to this statement will change the date at the top. Material changes should be noted in Help → What’s new.
Contact
Privacy questions: use Help in the app or contact the operator of this Basket & Burner instance.