Privacy policy

Updated: October 9, 2026

Chefrigo is operated by MuggyTea, a sole proprietorship in Japan. This policy explains how the app and website handle information. Contact: support-fudan@muggytea.com. The operator's name and address are provided by email without delay on request.

Your kitchen, on your device

Ingredients, rough quantities, dates, shopping lists, preferences, meal records, conversations and saved photos are stored in encrypted app storage on your device. The app does not currently synchronize your kitchen across devices. Keep any information you need before deleting app data.

When you choose AI

After your consent, the question, relevant recent conversation, saved food preferences and targets, selected inventory context and any attached compressed photo are sent over HTTPS through our Cloudflare service to OpenAI to provide the response. Do not include information about other people without permission. Microphone access is optional; voice input uses supported on-device speech recognition, and the resulting text is sent as a question. We do not upload a recording as part of this flow. You can withdraw consent anytime in the app under Settings > Sending to AI > Withdraw consent. After that, the app asks again before anything is sent to AI.

Reporting an AI answer

When you report an answer, we receive the selected AI output, your chosen reason and a pseudonymous account identifier. Original photos and conversation history are not included. Reports are encrypted, used to investigate and improve safety, and deleted after about 30 days or when you delete your account. Reporting does not use AI credits.

Accounts, purchases and advertising

Firebase Authentication provides app identity, including anonymous access and supported sign-in providers. Apple and Google process store payments; we do not receive your card details. Purchase identifiers, account bindings, balances and verification status are used to deliver access and prevent duplicate use. Google AdMob and its consent tools handle ads where available, and may process device identifiers, IP address, interactions and diagnostics under your choices and applicable requirements. Paid plans are designed without ads. In TestFlight, purchases use the test environment and ads are test ads. Watch 3 test ads to earn 2 test credits for AI. Sign in with a registered tester account. Test credits are separate from production credits and generate no ad revenue. To prevent repeated welcome claims, we use a record derived from verified app-user identifiers, including anonymous accounts, and linked sign-in identifiers with a server-only key, together with device checks and received-benefit flags from Apple DeviceCheck and Google Play Integrity. Device proofs are used for verification. Only when a device write has an uncertain outcome do we retain an encrypted proof for recovery; it is removed when the process completes or the account is deleted. Received-benefit records remain after account deletion to prevent repeat claims through reinstallation or account recreation. They are not used for cross-ad tracking.

Optional usage analytics

Off by default. Only with your consent, Google Analytics for Firebase receives activity events (setup steps, AI feature starts and outcomes, and the plan screen), app/device information, an SDK-generated app-instance identifier and approximate region. The SDK may also automatically measure app opens, sessions and store purchases. We do not pass chat text, photos, food names, nutrition targets, email addresses or login IDs to Analytics. Analytics advertising identifiers and ad personalization are disabled. Turn sharing off in Settings at any time; this resets local Analytics data and identifiers, but does not immediately delete previously sent data. Detailed event and user retention is set to 2 months without extension for new activity. Aggregate reports are not subject to this period.

Retention and deletion

On our AI proxy, encrypted answers used to recover interrupted requests expire after 24 hours; request receipts are removed after 48 hours. Usage and budget counters are kept for service operation and abuse prevention. Store verification and transaction records may need to be retained for refunds, fraud prevention and legal obligations; they are not used as a kitchen backup. Service providers have their own retention policies. Device data remains until you delete it. You can initiate account deletion in the app or contact support using the deletion page.

Your choices and rights

You can use manual features without consenting to AI, withdraw optional permissions in device settings, and change advertising choices where offered. You may request access, correction or deletion of personal data by contacting support. We may verify account ownership before acting. Applicable privacy rights, including objection, restriction, portability and complaints to your local authority, remain available. We use data to provide the requested service, meet legal duties and protect the service; optional processing is based on the choices or consent required in your region.

Providers and international processing

Cloudflare, Google/Firebase, OpenAI, and Apple/Google store services may process information outside your country. Their published privacy and data-processing terms explain applicable safeguards and retention. This website does not run advertising trackers or collect a mailing list. Cloudflare processes ordinary connection and security information to deliver the site. Chefrigo is intended for adults managing household meals, not as a service directed at children.

Policy updates

We update this page when the service or data practices change. Material changes and any new consent requirements will be presented before the relevant processing begins.