Privacy notice

Last updated: October 15, 2026

This notice explains what Tengo collects, why, who helps us run it, how long we keep it and what you can do about it. It covers the Tengo apps for iPhone, Apple Watch and Android, and this website.

The short version

We collect what you put into Tengo so it can work: your account, your kitchens and the food, places, recipes, plans and lists in them.
No advertising, no tracking across apps or websites, no analytics tools from other companies. We don't sell your data or share it for advertising.
AI reading of photos and text is off until you agree to it. If you agree, the photos and text you choose to send are read by DeepSeek, in the People's Republic of China. The AI only suggests. Nothing changes in your kitchen until you check and confirm it.
Photos are deleted after 24 hours. Location data is removed from them first.
Other members of a kitchen see your name and role, never your email address. Your private food and places stay private to you.
You can download your data and delete your account in the app at any time. Deleting your account signs you out everywhere at once and finishes within 7 days.

Who we are

Tengo is run by LEL LLC, 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States ("we" or "us"). We decide how your personal data is used, which makes us the controller (in Japan, the business operator handling personal information; in Korea, the personal information controller).

Privacy questions and requests: support@tengoai.app
Data protection officer: None appointed
Representative in the European Union: None appointed
Representative in the United Kingdom: None appointed

The same contact is our privacy officer for Korea and our contact person (encarregado) for Brazil.

What we collect

Things you give us

Account: your name, email address, password (stored only as a secure hash) and, if you turn it on, two-step verification. If you sign in with Apple or Google, we receive the name and email address they share with us.
Kitchens: the kitchens (households) you create or join, your role in each (admin, editor or viewer), when you joined, and the kitchen's name, country and time zone.
Your food and plans: food and its amounts, places such as the fridge or pantry, dates printed on packaging and the kind of date, barcodes, notes, what you used, froze, moved or threw away, recipes, meal plans, shopping lists, purchases you record and their prices, and budgets.
Food you want left out: allergens and staples you ask Tengo to remember. These can say something about your health. They are private to you, used only to leave out food and recipes, never sent to the AI service, and you can delete them at any time.
Photos and text for AI reading, only if you agree to it (see "AI reading").
Voice: when you speak a change, your speech is turned into text on your device (on Android, by your phone's speech service, which may be Google's where on-device recognition isn't available). Only the text reaches us. We never receive or store the audio.
Support requests: what you write to us, the subject it is about, and any device details you choose to include (app and system version, device model, language, time zone, request ids and connection state).
Your choices: whether you allow AI reading, whether you want news and offers, your reminder settings, and which version of the terms each choice was made under.

Things we collect as you use Tengo

Sign-in sessions: each signed-in device or browser, its description (for example the browser and system), its IP address, and when it signed in and was last active. You can see and end them under Devices.
Push notifications: a token from Apple or Google so we can send your reminders. We store it encrypted.
Subscriptions: if you buy Tengo Plus, the App Store or Google Play tells us the plan, its status and dates, and their transaction ids. We never receive your card or bank details.
Server logs: the address and type of each request, its IP address, timing and errors. Logs never contain what you typed, your photos or what the AI read.

We do not collect your location. We don't use advertising identifiers, contacts, or your browsing outside Tengo.

Why we use it, and on what basis

To run Tengo for you: your account, kitchens and sharing, food and dates, recipes, plans, lists, reminders, export and deletion. Basis: our contract with you (the terms of use).
To give you Tengo Plus: checking subscriptions with the App Store or Google Play, applying AI units, and emailing you 2 days before a free trial turns into a paid subscription. Basis: contract.
To read photos and text with AI: only after you agree on the AI screen. Basis: your consent, which you can withdraw at any time.
To leave out food you told us to avoid: basis: your explicit consent, given when you ask Tengo to remember it. Deleting it withdraws that consent.
To keep Tengo secure and working: sign-in protection, limits against abuse, logs to find faults, and our records of staff actions. Basis: our legitimate interest in a safe, reliable service.
To answer support requests: basis: contract, or our legitimate interest in helping you.
To send news and offers: only if you turn this on. Basis: consent. Turning it off never turns off your reminders.
To keep accounting and tax records and meet legal duties: basis: legal obligation.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

In Mexico, everything above except AI reading and news and offers is needed for the service you asked for. AI reading and news and offers are optional: you can refuse them and still use Tengo.

AI reading

AI reading turns a receipt, a photo of food, a label, a typed list or something you say into suggested food lines, or into a suggested change to your kitchen.

It is off until you agree. Before your first photo, the app asks, names the AI service and the country where it processes data, and explains what is sent. Typing food in and scanning barcodes never need it.
The service is DeepSeek, run by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., which processes the data in the People's Republic of China. If we ever change the service, the app asks you again before anything is sent to the new one.
What is sent: only the photos and text you choose to send, with your kitchen's country and app language. When you ask the assistant something, it also gets today's date and your recent messages in that conversation, and for a spoken message the names (only) of up to 150 foods you can see in the kitchen, so a misheard word can be matched. When you ask for a calorie estimate, it gets the food names.
What is never sent: your name, email address, account id, the allergens you asked us to remember, or anything private to other members.
The AI only suggests. Every suggestion is marked as coming from AI. Nothing is added or changed until you check it and confirm it. The AI never decides whether food is safe to eat, and dates, amounts, prices and allergens it can't read stay unknown.
Photos are rebuilt on your device without their metadata, including location. We strip metadata again on our server, keep the photo privately and delete it after 24 hours.
What DeepSeek does with it: DeepSeek's published terms do not set a period for keeping the data we send, and do not rule out using it to improve its models. Please consider this before you agree.
Turning it off: Settings › AI and Plus › AI processing. Work that is still waiting is cancelled and its AI units are given back.

We don't sell your personal data or share it for advertising. We use these service providers, who process it only on our instructions:

DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China): AI reading, only with your consent, as described above.
Cloudflare (Cloudflare, Inc., United States): hosting of our servers and website, our database and private storage for photos and exports, sending account emails (email confirmation, password reset and trial reminders), and the network that delivers the website and the app's connection to our servers.
Apple and Google: push notifications (Apple Push Notification service and Firebase Cloud Messaging), Sign in with Apple and Google sign-in if you use them, and the App Store and Google Play for subscriptions. Apple and Google also handle your payment under their own terms.

We may also disclose data when the law requires it, to protect people's safety or rights, or as part of a sale or merger of our business, in which case this notice would continue to apply to your data.

Other members of a kitchen see your name, your role and when you joined. They never see your email address.
Shared food, places, recipes, plans and lists are visible to everyone in the kitchen, along with who added or changed them.
Anything you mark as private (private places and the food in them, private recipes) is visible only to you. Being in a kitchen does not give anyone access to it.
An invitation shows the kitchen's name, the inviter's name and the role offered.

Transfers to other countries

We and our providers may process your data outside your country. Where the law requires a safeguard, we use one:

AI reading in China. The European Commission, the United Kingdom and Japan have not found China's data protection to be equivalent to their own, and there are no standard contractual clauses in place with DeepSeek. We transfer this data only with your explicit consent, given on the AI screen after you are told where it goes. China has a general data protection law (the Personal Information Protection Law), but Chinese law also gives public authorities broad powers to require access to data held by companies in China, and your rights there may be harder to enforce. If you don't agree, nothing is sent.
Other providers. Where they process data outside the European Economic Area, the UK or your country, we rely on an adequacy decision or on standard contractual clauses (or the equivalent clauses in the UK, Brazil and other countries).

For people in Korea, the overseas transfer for AI reading: items transferred are the photos and text you choose to send, your kitchen's country and app language and, for the assistant, the details listed under "AI reading"; the recipient is Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (privacy@deepseek.com) in the People's Republic of China; it happens over an encrypted network connection each time you use AI reading; the purpose is to suggest food lines and changes; it is kept as set out under "AI reading"; you can refuse by not agreeing or by turning AI reading off, in which case you can still add food by typing or scanning barcodes.

How long we keep it

Account, kitchens and everything in them: until you delete them or your account.
Photos for AI reading: deleted 24 hours after upload.
Suggestions you didn't confirm: 7 days.
Sign-in sessions: until you sign out, end them under Devices, or after 30 days without use.
Email confirmation and password reset links: 1 hour. Invitations: until used, withdrawn, or they expire (7 days unless the sender chose up to 30).
Data exports: the file is kept for 7 days. Each download link works for 15 minutes.
Support requests: deleted 180 days after they are closed, or with your account.
Push tokens: removed when you sign out of the device or delete your account.
Server logs: 30 days, and up to 90 days for security records.
Backups: kept for up to 35 days, then overwritten. If a backup is restored, completed deletions are applied again first.
Subscription records: kept after your account is deleted, without your account linked to them, for as long as accounting and tax law requires.

Deleting your account

In the app, open Settings › Delete account. On the web, sign in and go to Delete your account. The page Delete your Tengo account explains the steps without signing in.

Every device is signed out straight away, and sign-in is refused from then on.
The deletion finishes in the background, within 7 days in our online systems. Backups are overwritten within 35 days after that.
Kitchens where you are the only member are deleted with everything in them. In kitchens shared with others, you leave; the food you shared stays with the kitchen, and your name is no longer shown on its history.
If you are the only admin of a shared kitchen, a remaining member becomes admin.
Deleting your account doesn't cancel a store subscription. Cancel it in the App Store or Google Play.

Getting a copy of your data

In the app, open Settings › Export my data. You get a ZIP file in JSON and CSV with your account, the kitchens you can see, their food and history, places, recipes, meal plans, shopping lists, purchases, food thrown away, cooking, the allergens and staples you asked us to remember, the recipes you liked or hid, your photo and receipt captures, your subscriptions, your choices, devices and support requests. A file inside explains each part. Other members' private food and preferences are never in it. It's free on every plan. If you think something is missing, write to us and we'll send it.

Your rights

Wherever you live, you can ask us to access, correct, download or delete your data, and you can withdraw a consent at any time. Most of this you can do yourself in the app. For the rest, write to support@tengoai.app. We answer within one month, or sooner where your law requires. We may need to confirm it is you, and we never charge for a reasonable request.

European Economic Area and the United Kingdom: you have the rights to access, rectification, erasure, restriction, data portability and objection, including to processing based on our legitimate interests. You can complain to us first, and you can always complain to your data protection authority: in Germany the authority for your state, in France the CNIL, in Spain the AEPD, in the UK the Information Commissioner's Office (ico.org.uk).
United States: we don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer things about you. Where your state's law gives you rights (such as California's rights to know, delete, correct and not be discriminated against for using them), you or an authorised agent can use them by writing to us. If we refuse, you can appeal by replying to our answer.
Brazil: you have the rights in article 18 of the LGPD, including confirmation, access, correction, anonymisation, portability, deletion, information about who we share with, and withdrawal of consent. You can complain to the ANPD.
Mexico: you have the ARCO rights (access, rectification, cancellation and opposition) and can withdraw consent or limit use of your data by writing to us. Tell us your name, how to reply, the data and the right concerned. You can complain to the Secretaría Anticorrupción y Buen Gobierno.
Japan: you can ask us to disclose, correct, stop using or delete the data we hold about you. Our security measures include encryption in transit, access limited to staff who need it with every staff action recorded, and private storage that deletes photos after 24 hours. You can contact the Personal Information Protection Commission.
Korea: you can ask to access, correct, delete or suspend processing of your data, and withdraw consent. We destroy data when it is no longer needed as set out above, by deleting it from our databases and storage so it can't be restored. You can contact the Personal Information Protection Commission or the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118).

Security

All connections to Tengo are encrypted. Passwords are stored only as secure hashes and push tokens are encrypted. Staff access is limited and every staff action is recorded. Photos and exports are kept in private storage and handed out only through short-lived links. No system is perfectly secure, and we'll tell you and the authorities about a breach where the law requires it.

Cookies

The website uses one cookie that keeps you signed in, and a second short-lived one during two-step verification. There are no advertising or analytics cookies, so there is nothing to opt out of.

Children

You must be 16 or older to create a Tengo account. Tengo is not meant for children, and we don't knowingly collect children's data. If you think a child has given us data, write to us and we'll delete it.

Changes to this notice

We'll update the date at the top when this notice changes, and tell you in the app or by email before a significant change takes effect. If what AI reading sends or where it goes changes, the app asks for your consent again before anything is sent.

Contact

LEL LLC, 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States. Email support@tengoai.app.