Your kitchen is nobody’s dataset.
Butler Pantry’s promise isn’t a privacy policy: it’s the architecture. Your family’s grocery data lives on your family’s devices. Not because we promise to be nice: there is nowhere else for it to be.
There’s no Butler Pantry cloud, no Butler Pantry account.
There is no server holding your shopping history: not “we choose not to look,” but literally nowhere for it to be.
Nothing about your family sync leaves your network. Your pantry, recipes, shopping list, and budget live on your family’s devices, and the core app works fully offline. Only three helpers ever reach the internet, and each one waits for you: the barcode lookup and recipe import stay off until you switch them on, and the receipt importer fetches a store page only when you paste a link.
Barcode lookup: when you scan, sends only the barcode to Open Food Facts, a free, no-account public database. It is cached locally after the first scan, so repeat scans never touch the network.
Recipe import: fetches exactly the one page you pasted, once, as plain text. Nothing is crawled, suggested, or re-fetched later.
Receipt links: when you paste a store link, your device fetches that one order page straight from the store. Only the link travels, and it goes only to the store, never to us. The fetched copy is thrown away after your receipt is read; nothing from the page is kept beyond the items you import.
On-device processing: voice recognition and receipt scanning run right on your device. No cloud AI, no language models. Butler Pantry is local-first by architecture, the same philosophy as the local-LLM crowd, with zero language-model claims.
What you might wonder, answered plainly
| You might wonder | The honest answer |
|---|---|
| Can you see my shopping history? | No. We have no mechanism to read it: we don’t have it. |
| What happens on my own Wi-Fi? | Devices talk directly to each other; nothing leaves your network. |
| When I’m away from home? | An end-to-end-encrypted relay: a blind pipe that can’t read or keep your data. |
| What if I lose my phone? | Encrypted backup, keys are yours (argon2id + XChaCha20-Poly1305). |
| What if I stop paying? | The app locks to the Resubscribe screen; your data stays fully intact on your devices. |
| Can I take my data with me? | Always: CSV/JSON export, anytime. Never hostage. |
Judge it from the stack, not the policy
400+ automated tests gate every release. Every dependency is open and permissive-licensed. The privacy claim is provable from the dependency list: not a promise, a stack.
Encrypted backups use argon2id + XChaCha20-Poly1305, and the keys are yours. We can’t open a backup even if we wanted to. Family sync happens on your own Wi-Fi; away from home an end-to-end-encrypted relay carries a sealed envelope it cannot open, read, or keep.
What we never do: sell or share your data (we can’t: we don’t have it) · run ads · track you across apps · upload or process receipts in the cloud · force a phone-home for subscription checks.
Join the early list
Butler Pantry is in early access and not sold in any store yet. Leave your email and we’ll write to you: a handful of notes as we get closer, nothing else. No spam, no selling your address, no account required.
Local test build: capturing locally only, not connected yet. We’ll wire it to our server when we go live.