Privacy Policy | SmartFood

Last updated: 28 August 2026. This page is a technical description of how SmartFood currently works. It is not legal advice and does not claim compliance with a specific privacy law.

The Privacy Policy body is published in English. For questions, see Contact.

Who this page covers

This page describes the SmartFood web application at smarterfood.app (routes under /app). SmartFood is the product name. This page does not name a registered company or legal entity.

Information you provide

If you create an account, SmartFood stores the email address you register with and a hashed password. If you sign in with Google, SmartFood stores your Google account identifier and the email Google returns. You may also create and save your own products, dishes, menus, shopping lists, and images.

Account and authentication

After you sign in, SmartFood keeps a short-lived access token (about 15 minutes) in the browser's localStorage (keys token and userId). A longer-lived refresh cookie named sf_refresh is set as HttpOnly, scoped to /api/auth, with a lifetime of 14 days. JavaScript cannot read that cookie. The access token in localStorage is available to scripts running on this site.

Preferences stored in the browser

SmartFood stores UI language in localStorage key smartfood_lang and navigation collapsed/expanded state in mainMenuCollapsed.

First-party analytics

SmartFood records page-view events for product analytics. The browser keeps a persistent visitorId and a sessionId in localStorage (keys under smartfood.analytics.*), plus last-activity and acquisition fields (including UTM values when present). Events are sent to /api/analytics/events. Stored fields include path, referrer host, UTM parameters, locale, and whether the visitor appears signed in. If you are signed in with a valid session, the event may be associated with your user id. There is currently no in-app opt-out for this first-party analytics, and stored events do not have an automatic deletion period.

Country, device class, and server logs

For first-party analytics, the server derives a country code from the request IP using GeoIP and stores only that country code (or unknown). The IP address itself is not stored on the analytics event. Browser, operating system, and device are stored as coarse classes (for example Chrome / Android / mobile), not as the raw User-Agent string. Nginx access logs may still include IP addresses. The project's log-rotation configuration keeps application and nginx logs for 14 days; that is an operational setting, not a legal retention promise.

Google Analytics (GA4)

In production builds, SmartFood also loads Google Analytics 4 (measurement ID G-6XZYGJYJ28). Google may collect data under Google's own policies.

Google sign-in

Google sign-in requests the email and profile scopes. Google is a separate service with its own terms and privacy policy.

Email we send

SmartFood sends transactional email (for example address confirmation and password reset) using SMTP. Those messages go to the address on your account.

Public and shared content

Published Global Products, Dishes, and Menus are public catalog content. Signed-in users can create a shareable shopping-list link. Those links use a secret token in the URL. New share links are created with an expiry (by default 180 days) and can be revoked. Anyone with an active link can open that list.

Uploads

If you upload images for your products or dishes, those files are stored on the server so they can be shown in the app.

Advertising

SmartFood loads Google AdSense in production, including the AdSense account verification meta tag and the standard AdSense script. Google Privacy & Messaging is configured to provide consent messaging where applicable. SmartFood does not currently display AdSense ads: Auto Ads are off, and the site has no manual ad units. Google Consent Mode is not currently integrated.

How long we keep data

Access tokens expire in about 15 minutes. Refresh sessions last 14 days unless you sign out or the session is invalidated. Shared shopping-list links expire as described above. Nginx logs follow the 14-day rotation setting. First-party analytics events and user accounts currently have no automatic deletion. We do not promise a specific deletion deadline when you write to us.

Other services

Depending on how you use SmartFood, data may be processed by Google (sign-in, Analytics, AdSense, and mail delivery). See also https://policies.google.com/technologies/partner-sites

Security

Production traffic is served over HTTPS. The refresh cookie is HttpOnly. Access tokens live in localStorage. No system is perfectly secure.

Requests about your information

There is currently no in-app account self-delete control. To ask about access, correction, or deletion of your account or personal data, email smarterfood.app@gmail.com. We handle these requests by email. We do not guarantee a response time or an automated deletion workflow.

Changes to this page

We may update this page when SmartFood's technical behavior changes. The date at the top will change when we do. Questions: smarterfood.app@gmail.com.