App Privacy Label
This page documents the data-collection answers Pantry submits in App Store Connect → App Privacy. Use it as the source of truth when preparing the App Store listing — it should match what the “Privacy Nutrition Label” displays on the product page.
For full background, see the Privacy Policy.
Summary
Data the developer collects: Contact Info — Email Address, and only from users who run the optional “Import from Pantry Manager” migration.
For everything else Pantry collects nothing. All user content lives in:
- Apple’s CloudKit (the user’s own private database under their Apple ID), OR
- The user’s device local storage.
Two outbound requests exist, both described under “Outbound requests” below:
- Open Food Facts on barcode scan — sends only the barcode digits and the request’s IP address, no user identifier.
- The legacy Pantry Manager import — sends the user’s legacy account email and a hash of their legacy password to a server we operate, so their old data can be migrated. Entirely opt-in and skippable.
App Privacy Form Answers
Does your app collect any data?
Yes — one item, and only from users who run the optional legacy import.
Nothing to correct yet — Pantry has never been submitted. There is no live listing and no published label, so this page is simply the answer sheet for the first submission. Worth flagging only because earlier drafts of this page answered No here, from before the “Import from Pantry Manager” migration existed; don’t copy that older answer forward.
| Data type | Collected | Linked to identity | Used for tracking | Purpose |
|---|---|---|---|---|
| Contact Info — Email Address | Yes (optional feature only) | Yes | No | App Functionality |
Why: Settings -> Data -> Import from Pantry Manager authenticates against
https://api.mjlyco.com/prod300/login, a server MJLyco LLC operates for our older
Pantry Manager app. Running the import transmits the user’s legacy account email and
an MD5 hash of their legacy password to that server so it can return that account’s
items and photos. The server is read-only in this flow — the import copies data out
and writes nothing new — and the email is used solely to authenticate the migration,
never for marketing, profiling, or advertising.
Scope: users who never used Pantry Manager, or who never open the import screen, transmit nothing; the app makes no request to this server otherwise. Everything else in the app remains device-and-iCloud only.
If reviewers ask about CloudKit: Apple’s documentation explicitly states that data stored in the user’s iCloud account does not count as developer-collected data for the purposes of the App Privacy Label. (Same reasoning as iCloud Drive, Photos, Notes, etc. — Apple is the data custodian, not the app developer.) That reasoning covers the pantry itself; it does not cover the legacy-import credentials above, which is why they are declared.
How to enter this at first submission
Requires the Account Holder, Admin, or App Manager role. Apple revises this form’s wording periodically, so match on meaning rather than exact strings.
- App Store Connect → My Apps → Pantry → App Privacy (left sidebar, under General).
- Data Collection → Edit → answer Yes to “Do you or your third-party partners collect data from this app?”
- On the data-type checklist, tick exactly one box: Contact Info → Email Address. Leave every other category unticked — nothing else in the app is collected.
- Apple then asks three follow-ups about Email Address. Answer:
- How is this data used? → App Functionality only. (Not Analytics, not Product Personalization, and explicitly not either advertising purpose.)
- Is this data linked to the user’s identity? → Yes. It is an account email, so treat it as linked.
- Do you use this data for tracking purposes? → No. This must stay No, and
it is consistent with
NSPrivacyTracking = falseinPrivacyInfo.xcprivacy.
- Save. The App Privacy section must be completed before the app can be submitted for review at all, and later edits publish with the next version you submit rather than taking effect immediately.
The resulting public label reads “Data Linked to You: Contact Info” instead of “Data Not Collected.”
If the legacy import is ever removed from the app, revert step 2 to No; every other answer disappears with it and the label returns to “Data Not Collected.”
Data the user stores (for reference; not part of the label)
For transparency with reviewers, this is what the app stores on the user’s behalf:
| Category | What | Where | Linked to identity? | Used for tracking? |
|---|---|---|---|---|
| User Content — Photos | Item thumbnails the user takes or imports | Local SQLite + user’s iCloud | No (private CloudKit) | No |
| User Content — Other | Item titles, quantities, expiration dates, notes, household names, tag names, UPC barcodes | Local SQLite + user’s iCloud | No (private CloudKit) | No |
| Diagnostics | None | n/a | n/a | n/a |
| Usage Data | None | n/a | n/a | n/a |
| Identifiers | None | n/a | n/a | n/a |
None of the above leaves Apple’s ecosystem (device + iCloud) under our control. The one exception is the legacy-import credential exchange declared at the top of this page, which is user-initiated and touches only the legacy account’s email/password.
Outbound requests
The app makes exactly two kinds of outbound request: the Open Food Facts barcode lookup below, and the optional legacy-import call documented further down.
Open Food Facts
A UPC barcode lookup against the Open Food Facts public API when the user scans or manually enters a UPC that isn’t already in their local cache.
| Field | Value |
|---|---|
| Third party | Open Food Facts (non-profit, France) |
| Endpoint | https://world.openfoodfacts.org/api/v2/product/{barcode}.json |
| Data sent | Barcode digits, request IP, app User-Agent string |
| User identifier sent | None |
| Authentication | None (anonymous, no API key) |
| Frequency | One request per user-initiated scan (cached on success) |
| Third-party retention | IP logs up to 3 years per their privacy policy |
A matching product’s image may also be downloaded (capped at 10 MB, re-encoded to a 512x512 HEIC thumbnail). If it becomes an item’s photo it syncs to the user’s own iCloud and remains subject to Open Food Facts’ CC-BY-SA licensing — see the Attribution page.
Pantry Manager legacy import (MJLyco-operated)
| Field | Value |
|---|---|
| Operator | MJLyco LLC (us) |
| Endpoint | https://api.mjlyco.com/prod300/login |
| Data sent | Legacy account email, MD5 hash of legacy password, request IP |
| Trigger | Explicit: user opens Settings -> Data -> Import, enters credentials, taps Import |
| Direction | Read-only — returns the account’s items/tags/photo URLs; writes nothing |
| Frequency | Once per user (the import is idempotent and self-disables after success) |
This is disclosed in the in-app Privacy Policy and the Open Food Facts attribution page (Settings → Open Food Facts Attribution in the app).
Apple’s App Privacy review does not require declaring third-party services that the user triggers (a barcode scan is a deliberate user action), as long as the user is made aware. The disclosure surface — in-app attribution screen, privacy policy, and this document — satisfies that informed-consent bar.
Tracking
NSPrivacyTracking in PrivacyInfo.xcprivacy is false. The app does not:
- Link user data with third-party data for advertising or measurement.
- Share device identifiers with data brokers.
- Track users across other apps or websites owned by other companies.
SDK declarations (for App Store Connect → SDK list)
Pantry uses these SDKs / open-source packages (all linked statically into the app or extension binaries). None of them collect telemetry on the developer’s behalf:
| SDK / Package | Purpose | Privacy manifest |
|---|---|---|
swift-composable-architecture (Point-Free) |
App architecture | Ships its own PrivacyInfo.xcprivacy |
sqlite-data (Point-Free) |
Local SQLite + CloudKit sync | Wraps GRDB.swift |
GRDB.swift |
SQLite engine | Ships its own PrivacyInfo.xcprivacy |
swift-sharing (Point-Free) |
Cross-feature shared state | Ships its own PrivacyInfo.xcprivacy |
swift-dependencies (Point-Free) |
DI container | No data collection |
swift-custom-dump (Point-Free) |
Test assertion library; not in release binary | n/a |
swift-issue-reporting (Point-Free) |
Issue reporting | No data collection |
When the answers might change
The legacy import already moved this page off “Data Not Collected” (see the top). The answers would change again if we ever add:
- A general backend Pantry operates for its own data (analytics, error reporting, or an account system beyond the legacy migration)
- A third-party SDK that collects data (e.g., crash reporting, advertising, A/B testing)
- An API call that sends user content — item titles, photos, notes — to a service we control. The legacy import pulls content from our legacy server; it does not push the user’s new pantry to it.
- A cloud AI backend for meal suggestions. Generation is on-device Foundation Models today, so no pantry data is transmitted for it.
None of those exist today.