Privacy policy

Who is responsible

Grocery Brain is run by Tony Hadjandonis, in Athens, Greece, who is responsible for your personal data (the "controller" under the EU's General Data Protection Regulation, the GDPR). For anything about your data, email tony.hadjandonis@gmail.com.

What we store and why

• Your account: your email address and password. Supabase, our database provider, stores the password in a form nobody can read back (a hash), us included. We use your email to log you in and to send you emails about your account, such as a password reset link. Legal basis: we need it to provide the service (GDPR article 6(1)(b)).
• Your setup: how many people you cook for, your country, weekly budget, diet, cooking time and confidence, and foods you'd rather skip. We use these to plan your meals and show what they cost. Legal basis: providing the service.
• Your allergies, only if you agree. Allergies are health information, a special category of data under the GDPR. We save them only with your explicit consent (article 9(2)(a)), use them only to leave out recipes that contain them, and record when you gave consent. You can withdraw it at any time in Settings, and your allergies are then deleted.
• Your kitchen: your pantry, meal plans and shopping lists. Legal basis: providing the service.
• Usage statistics: which screens and features you use and when (for example "made a meal plan"), linked to your account's random ID number, not to your name or email. They never include your allergies, diet or budget. They show us whether Grocery Brain is useful and what to improve. Legal basis: our legitimate interest in understanding how the app is used (article 6(1)(f)). You can switch them off in Settings at any time.
• Technical logs: when you use the app, our hosting providers keep standard server logs for a short time (such as your IP address and browser type), to keep the service running and secure. Legal basis: legitimate interest.

Cookies and your browser

We only use what the app needs to work: a cookie that keeps you logged in, one that remembers your language, and a setting in your browser that remembers light or dark mode. There are no advertising or tracking cookies, and usage statistics don't use cookies at all. That's why there's no cookie banner.

Who else handles your data

We use a few providers to run Grocery Brain. They process your data only on our instructions, under data processing agreements:

• Supabase (database and login), with servers in Ireland, in the EU.
• Vercel (hosting the app), with servers in Dublin, Ireland, in the EU.
• PostHog (usage statistics), with servers in Frankfurt, Germany, in the EU.

Supabase, Vercel and PostHog are companies based in the United States. Your data is stored in the EU, but if any of them accesses it from outside the EU, that transfer is covered by the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

We don't sell your data, we don't show ads, and we don't share your data with anyone else unless the law requires it.

How long we keep it

• Your account and everything in it: until you delete your account. You can do that at any time in Settings, and it's deleted from our database straight away. Anything in our providers' backups disappears as those backups expire.
• Your allergies: until you remove them, withdraw your consent or delete your account.
• Usage statistics: one year, then PostHog deletes them automatically. Once you delete your account, the ones already collected can no longer be linked to you.
• Technical logs: for a short time, as set by our providers.

Your rights

Under the GDPR you can:

• see the data we hold about you, and get a copy of it;
• correct it (you can change most of it yourself in Settings);
• delete it (Settings > Delete my account);
• withdraw your consent for allergies (Settings), which doesn't affect what we did before;
• object to usage statistics (Settings > Share usage statistics);
• ask us to limit how we use your data, or to send it to you in a common, machine-readable format.

To do any of these, email tony.hadjandonis@gmail.com. We'll answer within one month. If you think we've mishandled your data, you can complain to the Hellenic Data Protection Authority (www.dpa.gr), or to the authority in the country where you live.

Age

Grocery Brain is for people aged 15 and over.

Changes

If we change this policy, we'll update the date at the top. If a change is important, we'll let you know before it applies.