PantryRoll Privacy Policy
Last updated: November 2, 2026
1. Introduction
ClearStack Apps ("we", "us", "our") operates the PantryRoll mobile application and the household card pages it serves at pantryroll.web.app. PantryRoll is the door record of a food pantry: households on a card and visits checked in at the table. A pantry runs PantryRoll, and the pantry decides what it records about the households it serves. This policy explains what is stored, where, who can see it, how long it is kept and how to delete it. It covers PantryRoll only; the rest of ClearStack Apps is covered by our main privacy policy.
2. What PantryRoll Stores
- The pantry's account: an anonymous account is created when the app first opens. If the pantry adds an email address and password, they are held by Google Firebase Authentication and never seen by us. The name a seat gives is stored with the pantry.
- The pantry's settings: its name, time zone, how often a household may visit under its own rule, what it gives out, its distribution weekdays and hours.
- Households: the head of household's name, the last four digits of a phone number, a ZIP or postal code, the number of adults, children and seniors, any dietary needs the pantry ticks (such as vegetarian or diabetic), short notes, whether the household agreed to being kept on file, and the date of the last visit.
- Phone numbers: the full number is never stored. PantryRoll keeps only the last four digits, for lookup.
- Visits: the date, the household's size on that date, its ZIP or postal code, the amount given, and which seat checked it in. A visit carries no name.
- Purchase check: if the pantry buys a plan from Google Play, the purchase token, used only to confirm the purchase with Google and to renew or end the plan.
PantryRoll does not ask for income, immigration status, government identification or anything else about eligibility, and it makes no decision about who may receive food. Pantries are asked to keep notes to what the table needs.
3. Camera
The camera is used only to read a household card's QR code at the table, and only when a volunteer taps Scan card. No picture is saved or sent anywhere. A pantry can look households up by name or digits without giving the app camera permission.
4. Household Cards and Card Links
A printed card carries the household's name and a QR code holding a random address. On the Pro plan a pantry can switch on a card link for a household. Anyone holding that link sees the pantry's name, the card's QR code, the pantry's hours and its next distribution day. The page never shows the household's name, phone digits, size, notes or visits, and the link holds nothing about the household. It stops working when the pantry switches it off or deletes the household. Card pages are marked so search engines leave them out.
5. Crash Reports and Analytics
- Firebase Crashlytics (Google LLC): crash reports, device model, operating system and app version, so we can find and fix bugs.
- Firebase Analytics (Google LLC): basic usage events such as app opens and screen views, tied to a random ID for the app on your phone. The advertising ID is not collected.
These never include households, visits, names, phone digits or notes. PantryRoll shows no third-party ads. The free tier shows a banner for ClearStack's own website service; nothing from the pantry's records is used to choose it. Nothing in a pantry's records is sold or shared with advertisers.
6. Where It Is Stored
On Google Cloud (Firebase) in the United States, encrypted in transit and at rest. The app keeps a copy on the phone so the Roll works without a connection; check-ins made offline stay on the phone until they are sent.
7. Who Can See It
- Every seat of the pantry (the owner and, on Pro, up to four volunteers) sees the pantry's households and visits. A volunteer loses access as soon as the owner removes the seat.
- PantryRoll does not send anything to a food bank or agency. A report leaves the app only when someone at the pantry shares the PDF or CSV, and those carry counts and no names.
- We do not read pantries' records. Google acts as our processor to store them.
8. If You Are a Household
The pantry that serves you holds your card. Ask anyone at that pantry to change it or delete it. When a household is deleted, its card and link are removed at once. The month's counts stay so the pantry's reports still add up, but they carry no name. If you cannot reach the pantry, email support@clearstackapps.com and name the pantry.
9. Deleting the Pantry or Your Account
In the app: Settings, then Delete account, and confirm. Or email support@clearstackapps.com from the address on the account. When the owner deletes the account, the whole pantry goes with it: every household, visit and card link. A volunteer who deletes their account leaves the pantry; what they added stays with it. Crash reports are kept by Firebase for 90 days and then deleted.