The product problem
I did not throw food away because I stopped caring. I threw it away because I could not remember what was at the back of the fridge, and because nothing is faster than forgetting.
That set the bar. An app like this competes with a notes app and with doing nothing at all, so adding something has to take seconds and work in a cold garage with no signal.
The decisions that shaped it
I treated the phone as the real database rather than a cache. Everything lives in SQLite on the device, and the whole app works with no account: scanning, reminders, history, shopping list. Signing in adds sync and nothing else.
Reminders are scheduled by the phone itself. There is no push token and no server involved, so nobody can tell that you were reminded about anything.
- No account needed, and nothing held back behind one.
- Every action lands immediately, then syncs afterwards.
- Changes are grouped, so unpacking a shop is one upload instead of forty.
Encryption, and what it costs
When sync is on, the kitchen is encrypted on the phone with a key made from your password. The database holds ciphertext. I can see how big it is and when it changed, and that is all.
A promise like that is only worth something if you say the awkward part out loud, so the app does. Forget your password with no device still holding the key, and that copy is gone, not recoverable by you and not by me. If I could get it back, I could read it.
Sharing a kitchen without a readable key
Sharing is the feature people actually ask for, and it is usually where end-to-end encryption quietly gets dropped. Each home has its own key, sealed to each member's public key, so the server passes along something it cannot open.
Most of the work went into the awkward cases rather than the happy path. Reinstalling the app makes a new keypair, which leaves the stored seal useless to the person it was made for. So seals record which key they belong to, and a stale one gets noticed and replaced without anyone typing a recovery code.
- One key per home, sealed per member, never readable by the server.
- Automatic re-sealing after a reinstall instead of a manual code.
- Conflicting edits resolve by time, and the person whose change was replaced gets told.
Built as a complete product
The parts nobody sees took as long as the screens. Nightly encrypted backups with an automatic restore check, because a backup you have never restored is only a hope. Deploys pinned to the commit that passed its tests. Rate limits counted per account instead of per address, so a shared flat does not lock itself out.
That range is the part I like. A good interface is not worth much if the thing behind it loses your data, and the decisions I am happiest with here are ones you should never have to notice.