What we collect and why.

Accept or reject analytics anytime.

WillItExpire gates Google Analytics 4 and product events behind your explicit choice. Your preference is stored in this browser as wie-analytics-consent (granted or denied). Until you choose, analytics scripts do not load.

Change analytics preference

Reject stops analytics collection, including cookieless analytics pings. If analytics was already running, the page reloads to remove it; other open tabs in this browser apply the same choice. Requests already sent before rejection cannot be recalled.

Basic site-usage information after consent.

When analytics is accepted, pages may load Google Analytics 4 to record page views, basic session information, and product events such as search used (result counts only — not the search text), pantry tracker CTAs, and sign-in method. This can include the page path visited, referral source, browser and device type, approximate location, and session timing. Google Analytics may store first-party analytics cookies only after consent.

We use these reports to understand which guides, food pages, and pantry tools help. We do not send your saved pantry item names, contents, or account email to Google Analytics. Your IP address may also appear in Hostinger's standard web-server access logs, which we use only to diagnose outages.

Items stored in your browser, never sent anywhere.

The default tracker mode keeps your saved items in your browser's localStorage. That data lives on your device only. We never see it; the hosting provider never sees it; no third party sees it.

Clearing your browser's site data, switching browsers, or switching devices will lose your tracked items unless you sign in.

Offline mode also caches the public app, food guidance and supporting static files on this device. Previously opened public pages can remain cached across app updates. Account API responses and Analytics collection traffic are not stored in this offline cache. Clearing site data removes these caches as well as guest pantry data, so export a pantry CSV first if you need a backup.

Email plus your saved items, stored in Supabase.

When you sign in via the tracker, we store your email address (used as your account identifier) and your saved pantry items in a Supabase database. Supabase is a third-party platform that provides authentication and a Postgres database. Our project is hosted in the eu-central-1 region.

Inside Supabase, your data is protected by row-level security for normal client access: only requests authenticated as you can read or write your rows through the app. A scheduled reminder worker (when enabled) may use a restricted service role to check confirmed pantry dates and explicit reminder preferences and send optional email or push reminders. This data is not used for advertising or resale.

Browser push endpoints and reminder preferences.

Signed-in pantry accounts start with email reminders enabled. We save this default when you sign in if your account has no reminder settings yet. You can choose Off for an item, disable email in your pantry settings, or use the opaque unsubscribe link in an email. A saved email opt-out is respected on other devices and when you track more items. Email is sent only to your verified account address. Browser push requires a separate choice and browser permission. When configured, we store the push endpoint and browser encryption keys for each enabled device. You can disable push for all account devices in your pantry settings. Push messages use a generic pantry reminder so food names are not shown on your lock screen. Browser and platform support varies.

New tracked items default to one day before and on the saved date. Choosing Track Item confirms the displayed date and reminder timing; no separate reminder checkbox is required. Account reminder settings include your chosen hour and IANA timezone. Older saved items without confirmed reminder dates stay off. Confirmed guest reminders follow your account settings when you sign in. Dates are storage estimates, not guarantees of food safety. A private delivery ledger stores item/date/channel keys and email content needed for reliable retries; client accounts cannot read that ledger.

Background push is temporarily unavailable. Email delivery uses Resend. We store provider message IDs and signed delivery-event types and times to distinguish acceptance from delivery, delay, bounce, complaint, failure, or suppression. A private recipient hash prevents further reminder sends after a bounce, complaint, or suppression; it does not change your saved pantry or preference choices. We do not store raw webhook payloads, and do not enable email open or click tracking.

Messages you send for human review.

The public feedback and contact form is currently disabled and does not accept messages. When enabled, it stores your category, message, optional food ID and page URL, and optional contact email for human review. URL query strings and fragments are removed. Reports are never published automatically. When the form is configured, a Cloudflare Turnstile challenge checks for spam when you submit; Cloudflare receives the browser information needed for that check. We send the challenge token for verification without adding your IP address, and do not save the token in the feedback queue.

Google Analytics

Measures page views and basic session information so we can improve the site. Google processes this data under its own privacy policy.

Supabase

Stores your email address and your saved pantry items when you sign in. Hosted in eu-central-1. Supabase has its own privacy policy.

Hostinger

Serves the static HTML / CSS / JS files of this site. Hostinger may keep server access logs containing IP addresses for diagnostic purposes. Hostinger has its own privacy policy.

jsDelivr and Google Fonts

React and React DOM are loaded from jsDelivr with subresource-integrity hashes. The Supabase JS client is served from this site's own origin. Fonts (Fraunces, Outfit) are loaded from Google Fonts. jsDelivr and Google Fonts may receive your IP address when your browser requests these resources, as they do on any site that uses them. Neither provider has any information about you specific to this site.