Last updated September 10th, 2026
Reduit keeps what's in your kitchen on your phone. This page says what that means in practice, and names the one thing that leaves your device.
There is no sign-up. We never ask for your name, email address, phone number, or a social login, and there is nothing to log in to.
On first launch the app generates a random identifier and keeps it in your phone's secure keychain. It tells your household which device made a change. It is not linked to you, and we hold no record that connects it to a person.
Items, quantities, locations, expiry dates, notes, photos, shopping list and recipes are stored in an encrypted database on your phone.
When you share a group, changes travel end-to-end encrypted. Our relay passes the message on without being able to read it: it sees which group a message belongs to, how big it is, and when it arrived — never what is in it.
We do not store your inventory. There is no copy of it on our servers to hand over, sell, or lose.
When you ask the Chef for recipes, the app sends the list of ingredient names and quantities you selected to our own server in Switzerland, which passes them to a language model to write the recipes.
That request carries no identifier: no device id, no group id, no account. It is a list of ingredients and nothing else. Generated recipes are cached against the ingredient list so that the same request can be answered without generating it again.
This is the one feature that is not end-to-end encrypted, and we would rather say so here than bury it. If a list of ingredients is something you would not want to leave your phone, do not use the Chef — every other part of the app works without it.
The Chef is part of the subscription. To use it, the app proves your subscription once and receives a short-lived token in return. The token carries no subject: it says a request has been paid for, not whose request it is.
The recipe request itself is made with that token alone, so the server can enforce the limits without ever learning who is asking.
Scanning looks the barcode up in a shared product catalogue that maps barcodes to product names, brands and categories. This is public product information, not personal data.
If a barcode is unknown and you name the product, that pairing is contributed to the catalogue so the next person who scans it gets a result. No identifier is attached to a contribution.
Because contributions are public, do not type anything personal into a product name.
The camera is used only while a scanner or photo screen is open, for reading barcodes and taking pictures of items and recipes. Nothing is recorded or uploaded in the background.
Photos you attach stay on your phone. The image file is never sent anywhere — including to the people you share a group with, who see a placeholder rather than your picture.
Reduit is free — your inventory and your cookbook. The Chef is a subscription, handled by the app store and by RevenueCat, which manages the receipt. Payment details go to the store, never to us — we never see a card number, a name, or a billing address.
RevenueCat receives an anonymous subscriber identifier so your subscription can be verified and restored on a new device.
There are no advertisements, no analytics SDK, no crash reporting service, and no third-party trackers. We do not measure how you use the app, because we chose not to build the thing that would measure it.
The database on your phone is encrypted at rest, with the key held in the hardware-backed keychain. Copying the file off the device gets you nothing readable.
Each shared group has its own encryption key. It is never put in an invite link: joining runs a sealed handshake in which the key is encrypted specifically for the joining device.
One honest limit: anyone you invite keeps a copy of that group key. Removing them from the member list stops them being shown as a member, but does not take the key back. Invite people the way you would hand out a spare key to your home.
Settings › Delete all data erases the local database and the encryption keys. Uninstalling the app removes everything it stored.
Product catalogue contributions cannot be withdrawn individually, because nothing records which contribution came from which device — the same property that makes them anonymous makes them impossible to trace back and delete.
Reduit is not directed at children under 13 and we do not knowingly collect anything from them. Since we collect no personal data from anyone, there is nothing held about a child either.
If this policy changes, the date above changes with it. A change that affects what leaves your device will be announced in the app, not quietly published.
Questions about privacy: privacy@reduit.io