fofé privacy policy
Effective date: 2 November 2026
fofé looks into a fridge, lists what it can see, and turns that list into a web search. This policy explains what the app keeps on your phone, what it sends to us, and what you can do about it.
1. Who we are
fofé is made by metly. In this policy, "we" means metly. We are the controller for the shared scans described here. For privacy questions or deletion requests, write to support@metly.dk.
2. What stays on your phone
Scanning runs on the phone. The camera frames are read by the on-device model and then deleted. With Share scans off, no picture leaves the phone.
The Detected List, the Fridge List, your Use Soon marks and your settings stay on the phone. Settings include language, search engine, the sharing switch and the answers from the first launch. The list is also written to your phone's clipboard after a scan. The clipboard is controlled by your phone, not by us.
The app has no account, no analytics SDK, no crash reporting, no advertising SDK, no location permission, no microphone recording, and no access to contacts or calendar.
3. What we upload, only with your consent
Sharing is off until you turn it on. You can turn it on or off in the first-launch question or in Settings > Share scans. When it is on, the app uploads:
- a 768 px JPEG copy of each frame from a scan
- the model's boxes, ingredient labels and confidence scores
- your edits: what you kept, removed or added, and what you marked Use Soon
- the country you typed on the first launch
- technical metadata: app version, platform, locale, model name and confidence threshold
- a random install id
The pictures are of the inside of a fridge. They may incidentally show hands, packaging, a room or other things in view. The app removes EXIF metadata when it resizes a frame, so camera location is not included.
The install id is a random UUID created on the first upload and kept in secure storage on the phone. It groups scans from the same household so they can be kept together when the model is tested, and it is used for rate limiting. It is pseudonymous, not a name, account or device id.
The country is the answer you typed. The app never reads your location.
We keep up to 20 scans in a queue on the phone. A queued scan is deleted after the collector accepts it. While sharing is off, nothing in the queue is uploaded. Uninstalling the app removes the queue.
4. Why we collect it
To train and improve the on-device recognition model, so it can name more of what is in a fridge and make fewer mistakes. The technical metadata records which app, model and threshold produced a scan, so a training run can be reproduced. The install id groups scans from the same fridge and helps rate-limit uploads.
We do not use shared scans for advertising or to build a profile of you.
5. Legal basis
If you are in Denmark or another EU country, we process shared scans on the basis of your consent (GDPR Article 6(1)(a)). You give consent by turning on Share scans, and you can withdraw it at any time by turning it off. Withdrawing stops future uploads. It does not make past processing unlawful.
We process the install id for security and rate limiting on the basis of our legitimate interest (Article 6(1)(f)) in keeping a public collector available.
You have the right to access, correct, delete, restrict or object to the processing of your data, and to receive your data in a portable format. You can also complain to the Danish Data Protection Agency (Datatilsynet) or your local supervisory authority. To use a right, write to support@metly.dk.
6. Who processes it
Supabase hosts the database and the private object storage that receive shared scans. Supabase acts on our instructions as a processor. The collector's service-role key is kept on the server, not in the app.
We do not sell your data. We do not use advertising or third-party analytics. We do not send shared scans to anyone else.
The search engines are separate. When you tap Search the web, the app opens the engine you chose (Google, DuckDuckGo, Bing or Ecosia) and passes it the meal and ingredient names. That engine receives the query under its own privacy policy. The app does not send your scan or install id to the search engine.
7. How long we keep it
We keep shared scans for up to 24 months from upload, then delete them. A scheduled purge removes the frames and the database row. The on-phone queue holds at most 20 scans and is deleted after upload. Local settings stay until you uninstall or clear the app's data.
8. Deletion
Turn Share scans off to stop future uploads. To delete shared scans you already sent, email support@metly.dk. Tell us the approximate dates of the scans and the country you typed, or the install id if you can find it. We have no accounts and names are not attached, so we need enough detail to find the right uploads. We will answer within 30 days.
9. Security
Uploads use HTTPS in transit. Frames sit in a private Supabase bucket, and the database is closed to the public API. Only the collector's server key can read or write the data. No system is perfect, but we do not put the service key in the app.
10. Children
fofé is not directed at children under 13, and there are no accounts. We do not knowingly collect scans from children under 13. If you believe a child has shared a scan, write to support@metly.dk and we will delete it.
11. Changes
We may update this policy. When we do, we will change the effective date at the top. For a significant change, we will say so in the app or in the Play Store listing. If a change needs your consent, we will ask for it.
12. Contact
Privacy questions and deletion requests: support@metly.dk.