Privacy
Short version: the site counts page views and collects nothing else. The detail below says exactly what that means, what an advertising space does, and what the host can still see.
Analytics
This site counts page views with Google Analytics 4, a Google product. The file that does the counting is fetched from www.googletagmanager.com, and what it records goes to Google: the address of the page, the site that sent you here, an approximate location no finer than a city, and the kind of browser and device you are using. It is not told your name or your email, and nothing you type into the search box on this site is sent to it. When you open a food from the search results, that is recorded as an event named lookup, which carries what a page view carries and nothing more: not what you typed. The food you open is counted as a page view, like any other page.
Advertising storage, advertising user data and advertising personalization are refused on every page and in every country, so nothing measured here feeds advertising profiling. In the European Economic Area, the United Kingdom and Switzerland the analytics storage is refused as well, by default and without asking: those visits are counted without writing anything to your device.
Advertising
This site has advertising space on food pages, on the list and ranking pages and on the front page — not on this page, the terms, the contact page or the error page. Today every one of those spaces is filled with a link to another page of this site. No advertising network is connected yet, so nothing in an advertising space reaches any other company. On the day one is connected, this paragraph is rewritten by the same switch that turns the network on, and the build refuses to publish if the two disagree.
What your browser loads
The counter named under Analytics is the only thing a page loads from anywhere but this site. Every release is scanned for the 35 kinds of address-carrying construct an HTML page can hold — every address-bearing attribute, every url() and @import in a stylesheet, and any script that would fetch or navigate while you read — and the scan reads every file in the release, in all 11 file formats it knows, not the pages alone. Everything it finds points either at this site or at an address named on this page.
Every page also carries a Content Security Policy, sent by the host as a header of the page itself. It names the site's own scripts and its stylesheet by their exact fingerprints, allows images from this site itself — the site icon is the only one a page loads — and allows exactly 3 outside addresses — *.analytics.google.com, *.google-analytics.com, www.googletagmanager.com — and nothing else at all. It is there for the part we cannot check ourselves: a host can add a script to a page after we have built it, and once the page has left us the policy is the only instruction your browser still has from us.
One more picture lives on this site: the link-preview picture that apps and social networks show when someone shares a link here. Its address sits only in the preview tags at the top of each page, and only the app or service that draws a preview goes to fetch it; your browser does not. No page loads the link-preview picture.
Cookies and storage
Outside the European Economic Area, the United Kingdom and Switzerland the counter writes cookies of its own, named _ga and _ga_ followed by the property identifier. They tell one browser from another, so a second page in the same visit is not counted as a second visitor, and they expire two years after your last visit. Inside those countries neither is written. Nothing else here sets a cookie.
One thing is stored by the site itself: if you keep a food in My fridge, that list is written in this browser and nowhere else. It is not sent anywhere, it is not readable by us, and it does not follow you to another browser or another device. Forget everything on the front page erases it, and so does clearing this site’s data in your browser.
What the host sees
The site is served by Cloudflare Pages. Like any web host, it processes the request itself — your IP address, the page requested, your browser string — to deliver the page and to block abuse. We do not receive those logs as a report and do not use them to build any profile.
A host can also add things to a page after we have built it. Cloudflare's email obfuscation and script rewriting both do exactly that. We turn both off for this domain, and if a host adds something regardless, the content policy above is what stops your browser from running it: every piece of code written into a page is named there by a hash of exactly what we shipped, and code from outside this site may load only from www.googletagmanager.com and *.google-analytics.com, the counter’s own addresses, so anything else fails. A promise about privacy is a promise about what your browser loads, not about what we wrote.
Contact and email
If you write to hello@keepsuntil.com, we keep the message and your address for as long as it takes to answer, and delete it afterwards. Ask us to erase it sooner and we will.
Changes
This page is generated from the same switches that build the pages, so it cannot drift from what they actually load. Last changed 16 October 2026.
KeepsUntil is an independent reference built on public USDA data. It is not affiliated with, endorsed by, or connected to the U.S. Department of Agriculture or the Food and Drug Administration. Whether a given window is a safety limit or a quality window is stated on the page that prints it.