Privacy Policy (UK GDPR)

Last updated: 18 July 2026

Controller: Cavan Judge (sole trader) trading as “FlavDex”
Contact: Cavan@flavdex.com

1. Who we are

For UK GDPR, the data controller is Cavan Judge (sole trader) trading as “FlavDex”. If we appoint a Data Protection Officer (DPO) later, we will update this notice.

2. What we collect

Account data: email address, password (hashed), display name, optional profile photo.
Contact data: your email address for communications and account support.
Content you provide: ratings, notes, photos (if uploaded), comments, favourites, collections, and list activity.
Social data: friend/follow relationships, requests, and in-app messages (where available).
Preference data: profile visibility, dietary/lifestyle settings, saved filters, and notification preferences.
Reports & moderation data: reports you submit, moderation outcomes, and related safety records.
Device & usage data: app version, device type, IP address, log data, basic diagnostics for security and performance.
Camera/photos & barcodes: when you upload images or scan products.
Location (optional): if enabled, to show nearby stores/branches or relevant content.
Taste Diary and health data (optional): food, nutrition and hydration entries you add to the Taste Diary. If you explicitly connect Apple Health or Google Health Connect, FlavDex can read nutrition, hydration, active energy, workout duration/count and steps, and can write new nutrition and hydration entries. Imported nutrition and hydration entries, their source app name and an opaque provider record identifier are saved to your FlavDex account. Active energy, workout and step totals are used on your device to calculate and display daily activity and net calories; FlavDex does not save those activity totals to our servers.
Communications: emails you send us and support requests.
Cookies (web only): essential cookies/session storage for login and security. If we later add analytics or ads, we will ask for consent.

Health integration is off by default and only starts after you choose its data directions and grant the operating-system permissions. Health data may be special category data under UK GDPR. We process connected health data only for the Taste Diary features you request and with your explicit consent. Please avoid posting other medical or allergen information in public or social areas of FlavDex.

3. Why we use your data (and legal bases)

Provide the Service (accounts, ratings, collections, retailer/brand pages, social features, and content hosting): contract.
Safety & moderation (review reports, detect abuse/spam, enforce rules, approve photos): legitimate interests.
Improvement & diagnostics (debugging, performance, service quality): legitimate interests.
Personalisation (surface relevant items, filters, and retailer results based on your settings/activity): legitimate interests.
Communications (essential service messages): contract/legitimate interests.
Push notifications (if enabled in-app/device settings): consent.
Optional health integration (import/export nutrition and hydration; show activity and calculate net calories): consent under UK GDPR Article 6(1)(a) and, where the information is special category health data, explicit consent under Article 9(2)(a). You can withdraw consent by disconnecting the integration.
Marketing (optional updates/newsletters): consent (withdraw anytime).
Advertising (if enabled): consent for personalised ads/cookies where required; legitimate interests for limited non-personalised ads where permitted.
Legal compliance (lawful requests, disputes): legal obligation.

4. Sharing your data

Processors: Supabase (auth, DB, storage; UK region), email provider (e.g., 123-reg), push notification services (APNs/FCM if used), crash reporting/analytics (if added).
Public/social outputs: aggregate rating averages may be public on product pages; approved photos may be public; social/profile visibility follows your privacy settings in-app.
Payments: purchases via Apple App Store / Google Play are handled by those stores; they act as independent controllers for payment data.
Apple Health / Google Health Connect: when you request a sync, data is exchanged directly with the health service on your device under the permissions you grant. Apple and Google govern their respective health platforms. We do not disclose connected health data to advertising, marketing, analytics, or data-broker services.
Legal & safety: where required by law or to protect rights, safety, and property.

We do not sell your personal data, including health data.

5. International transfers

We aim to keep your data in the UK (and EEA as applicable). Some providers (e.g., Apple/Google for app-store payments or push notifications, or future analytics/ad vendors) may process data outside the UK/EEA. Where that occurs for our processors, we will use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (with UK addenda), plus additional measures as needed.

6. Retention

We keep your personal data only as long as necessary to provide the Service and for legitimate and legal purposes. In general:

Account data & UGC: retained while your account is active. We may delete or anonymise content/accounts at our discretion (e.g., storage management or rule breaches).
Social data & messages: retained while needed to provide social features and safety records, then deleted/anonymised under our retention rules.
Inactive accounts: may be deleted or anonymised after a period of inactivity, with reasonable notice where feasible.
Logs & diagnostics: typically 90–180 days unless needed longer for security/legal reasons.
Reports/moderation records: retained as needed for abuse prevention, appeals, and legal compliance.
Taste Diary health imports: retained with your Taste Diary while your account is active or until you remove them. If you remove an imported entry only from FlavDex, we retain its opaque provider record identifier so it is not re-imported; no nutrition or activity value is kept in that marker. Disconnecting stops future access but does not automatically erase existing Taste Diary entries. You can remove those entries in-app or request account deletion.
Backups: stored for limited periods, then deleted.

You can delete your ratings and notes in-app where available, and you can request full account deletion at any time (see Section 9).

7. Security

We use reasonable technical and organisational measures, including encryption in transit (TLS), encryption at rest via our hosting providers, and access controls. No service can be 100% secure.

8. Your choices

Profile & visibility: profiles are private by default; adjust privacy settings in the app.
Location: disable location sharing in your device settings if you prefer.
Notifications: manage push notifications in-app and device settings.
Health: choose food import, food export, water sync and active-calorie subtraction separately in the Taste Diary. Disconnect at any time. On iPhone, you can also change FlavDex permissions in the Health app; on Android, disconnecting asks Health Connect to revoke them. Removing an imported item from FlavDex does not delete the original item from Apple Health or Health Connect.
Marketing: opt in/out of optional emails at any time.
Cookies (web): if we add analytics/ads later, we’ll show a consent banner with choices.

9. Your rights (UK GDPR)

You have rights to access, rectify, erase, restrict processing, object to processing based on legitimate interests, and data portability. Where processing is based on consent, you can withdraw consent at any time. To exercise your rights or request account deletion, email Cavan@flavdex.com.

We aim to respond to rights requests within one month, or as otherwise permitted by UK GDPR.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). We’d appreciate the chance to resolve your concerns first.

10. Children

The Service is not intended for anyone under 18. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

11. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. We will notify you of material changes (e.g., by email or in-app).

12. Contact

For privacy queries or rights requests, email Cavan@flavdex.com.

Cookies: On web, we currently use only essential cookies. If we add analytics/ads later, a consent banner will let you choose your preferences.