Privacy Policy

Last updated: April 27, 2026

Butler is a family kitchen assistant. We collect what we need to plan meals with you and keep your household's data safe. This page explains what that means in plain terms.

The operator of Butler is the developer listed in the App Store and Google Play store pages, contactable at [email protected]. By using Butler you agree to the practices below.

What we collect

• Account info — your name and email from Sign in with Apple or Google.
• Household data you create — family members, dietary preferences, recipes, meal plans, pantry items, grocery lists, and cooked-meal logs.
• Photos you take — pantry, fridge, receipt, and cooked-meal photos uploaded inside the app.
• Chat messages — what you send to Butler and what Butler replies. Used to provide the service and improve responses.
• Optional Gmail data — only if you connect Gmail: we read order-confirmation emails from Whole Foods, Amazon Fresh, and Instacart to import items into your pantry. We never read other email and we don't store the message bodies after parsing.
• Optional calendar data — only if you connect Google Calendar: we read upcoming events to flag busy nights when planning meals.
• Diagnostics — error reports and feedback you submit, plus app and server version metadata.

What we don't collect

• We don't track you across other apps or websites.
• We don't sell your data.
• We don't show ads.
• We don't read Gmail messages outside the order-confirmation senders you opt into.

Who processes your data

Butler relies on a small set of providers to run the service:

• Anthropic — powers the AI chat. Messages and the relevant household context are sent to Anthropic's API to generate responses.
• Google (Gemini) — used only for image analysis when you scan a pantry, fridge, or receipt photo.
• Supabase — hosts our PostgreSQL database and image storage.
• Railway — runs the Butler backend.
• Apple — handles push notifications and Sign in with Apple.
• Google — handles Sign in with Google, Gmail, and Calendar OAuth (only if you connect those).

Google user data — Limited Use

When you connect Gmail or Google Calendar, Butler receives data from Google APIs under the scopes you grant during sign-in. Butler's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely:

• Gmail message data is read only to find order-confirmation emails from Whole Foods, Amazon Fresh, and Instacart, and to extract the line items from those receipts.
• Calendar event data is read only to detect busy nights when planning your week's meals.
• We do not use Google user data for advertising, do not sell or transfer it, and do not let humans read it except (a) with your explicit consent, (b) for security or abuse investigations, or (c) where required by law.
• You can disconnect Gmail or Calendar at any time from Settings inside the app, or revoke access at myaccount.google.com/permissions.

Security

Butler talks to its servers over HTTPS only. Data at rest in Supabase is encrypted with AES-256. OAuth tokens for Gmail and Calendar are stored encrypted and scoped to your household. Access to production data is limited to the maintainer(s) and used only to operate the service or investigate reported issues.

How long we keep it

Your household data is kept as long as your account is active. Diagnostic logs (error reports, feedback) are retained for up to 90 days unless we need them longer to fix a reported bug. Deleted accounts and their associated data are removed from active databases immediately and from backups within 30 days.

Where your data is processed

Butler is operated from the United States. Our database (Supabase) and backend host (Railway) run in U.S. regions. If you use Butler from outside the U.S., your data is transferred to and processed in the U.S. by us and our sub-processors listed above.

Your rights

You can access, correct, export, or delete your household data at any time:

• Access & correct — view and edit family members, recipes, pantry items, meal plans, and grocery lists directly inside the app.
• Delete — Settings → Account → Delete account removes everything (see below).
• Export — email [email protected] from your account email and we'll send a JSON dump of your household data within 30 days.
• Object or restrict — if you're in the EU/UK or California (CCPA), you have the right to object to processing or request restriction. Email us and we'll honor it.

Deleting your account

You can delete your account from inside the app under Settings → Account → Delete account. This permanently removes your household, family members, recipes, pantry items, meal plans, grocery lists, cooked-meal logs, photos, chat history, and connected Gmail/Calendar tokens. Deletion is irreversible.

If you can't access the app, email [email protected] from your account email and we'll do it for you within 7 days.

Children

Butler is designed for adults running a household. It is not directed to children under 13. Children's names and ages may appear inside a household's family profiles, entered by a parent — that information is treated the same as any other household data and never shared.

Changes

If we materially change how we handle your data, we'll update this page and notify account holders by email or in-app message before the change takes effect.

Contact

Questions or requests: [email protected].