Privacy policy
Last updated: 11 November 2026
This policy explains what personal information FoodieFilter collects, why, who we share it with, how long we keep it and what your rights are. We have tried to keep it short and plain. We follow the UK GDPR and the Data Protection Act 2018.
Who we are
FoodieFilter is run by Adam Cook on behalf of FoodieFilter, 148 The Grove BR4 9JZ (“we”, “us”). We are the “controller” of your personal information. ICO registration number: PENDING.
Questions or requests about your data: atcook06@gmail.com.
What we collect, why, and our legal basis
| Information | Why we use it | Legal basis |
|---|---|---|
| Without an account: the allergens and ingredients you tick or type to filter products | To show you matching products. Kept only in your browser tab for the visit and not sent to us for storage. | Not stored by us |
| Account: email address, a securely scrambled (“hashed”) password, date you joined and when you accepted our terms | To create and run your account and keep it secure | Contract (providing the service you asked for) |
| Saved allergens (Premium): the allergens and ingredients you choose to save. This is health information (“special category data”). | To load your allergens each time you log in | Your explicit consent, which you give with a tick box before saving. You can withdraw it at any time by deleting your saved allergens or your account. |
| Payments: subscription status, billing dates and your Stripe customer ID. We never see or store your card number. | To give you Premium and let you manage or cancel it | Contract; legal obligation (accounting records) |
| Login cookie and security logs: a random session token (stored hashed), and your IP address in short-lived technical logs | To keep you logged in, prevent abuse and keep the service secure | Legitimate interests (security) |
| Admin actions (admins only): which product records an administrator verified or changed, and when | To keep an accurate, accountable record of product data | Legitimate interests |
| Messages you send us (for example by email) | To reply and keep a record of the conversation | Legitimate interests |
You do not have to give us any of this to browse and filter products. We do not sell your information, we do not show adverts, and we do not use analytics or tracking cookies.
Cookies and similar technology
We use one cookie, ff_sid, which keeps you logged in. It is “strictly necessary” for the service, so UK law does not require a consent banner for it. We also keep your current filter choices in your browser’s session storage so they survive a page refresh. This stays on your device and is cleared when you log out or close the tab. We do not load fonts, scripts or trackers from other companies. If you click “Translate to English”, your browser opens Google Translate in a new tab with that product’s ingredient text only; that is your choice and Google’s own privacy policy applies from that point.
Who we share it with
Only the service providers that help us run the site (“processors”), under contract:
- Stripe (payments). Stripe is also an independent controller for its own legal and fraud-prevention duties.
- Fly.io (hosting). Our servers and databases are in London.
- our email provider (sending account emails, if you use features that send email).
Some providers are based outside the UK (for example in the USA). Where your information is transferred abroad we rely on safeguards approved under UK law, such as the UK International Data Transfer Addendum or an adequacy decision. We may also disclose information if the law requires it.
How long we keep it
- Account details and saved allergens: until you delete your account (you can do this yourself in the account menu).
- Login sessions: up to 30 days, then deleted automatically.
- Admin action records: 24 months, then deleted automatically.
- Payment records: Stripe and we keep these for up to 6 years because tax and accounting law requires it.
- Emails to us: up to 2 years after the conversation ends.
Encrypted backups of the database may keep deleted data for a short period (up to 30 days) before they are overwritten.
Your rights
You have the right to: be told what we hold about you and get a copy (use Download my data in the account menu, or email us); have mistakes corrected; have your information deleted (use Delete my account, or email us); restrict or object to some uses; receive your data in a portable format; and withdraw consent at any time. We reply within one month. You do not have to pay.
If you are unhappy with how we use your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk/make-a-complaint, 0303 123 1113).
Security
Passwords are hashed; connections use HTTPS; login cookies are HttpOnly and Secure; access to the admin tools is limited and logged. No system is perfectly secure. If a breach is likely to put your rights at risk we will tell you and the ICO as the law requires.
Children
FoodieFilter is intended for adults. If you save allergy information about a child you look after, you confirm that you are their parent or legal guardian. We do not knowingly create accounts for people under 18.
Changes
If we change this policy in a way that matters we will update the date above and, for big changes, tell account holders by email.