Privacy Policy (UK GDPR)

Last updated: 8 August 2026

Controller: Cavan Judge (sole trader) trading as “FlavDex”
Contact: Cavan@flavdex.com

1. Who we are

For UK GDPR, the data controller is Cavan Judge (sole trader) trading as “FlavDex”. If we appoint a Data Protection Officer (DPO) later, we will update this notice.

2. What we collect

Account data: email address, password (hashed), display name, optional profile photo.
Contact data: your email address for communications and account support.
Content you provide: ratings, notes, photos (if uploaded), comments, favourites, collections, and list activity.
Social data: friend/follow relationships, requests, and in-app messages (where available).
Preference data: profile visibility, dietary/lifestyle settings, saved filters, and notification preferences.
Reports & moderation data: reports you submit, moderation outcomes, and related safety records.
Device & usage data: app version, device type, IP address, log data, basic diagnostics, and interactions needed for security, performance, and service operation.
Advertising and consent data (mobile app): when advertising is available, the Google Mobile Ads SDK and Google AdMob may automatically process IP address (which can indicate approximate location), ad impressions, ad clicks and other interactions, diagnostic and performance information, and device or account identifiers such as an advertising identifier where available and permitted. Consent choices and related privacy signals may be stored on or read from your device. The data used depends on your device settings, region, consent choices, and the ad-serving mode available to Google.
Camera/photos & barcodes: when you upload images or scan products.
Location (optional): if enabled, to show nearby stores/branches or relevant content.
Taste Diary and health data (optional): food, nutrition and hydration entries you add to the Taste Diary. If you explicitly connect Apple Health or Google Health Connect, FlavDex can read nutrition, hydration, active energy, workout duration/count and steps, and can write new nutrition and hydration entries. Imported nutrition and hydration entries, their source app name and an opaque provider record identifier are saved to your FlavDex account. Active energy, workout and step totals are used on your device to calculate and display daily activity and net calories; FlavDex does not save those activity totals to our servers.
Communications: emails you send us and support requests.
Cookies (web only): essential cookies or session storage used for site operation and security. We do not currently serve advertising on the FlavDex website.

Health integration is off by default and only starts after you choose its data directions and grant the operating-system permissions. Health data may be special category data under UK GDPR. We process connected health data only for the Taste Diary features you request and with your explicit consent. FlavDex does not provide connected health data, Taste Diary entries, ratings, private messages, or account profile details to Google for advertising. Please avoid posting other medical or allergen information in public or social areas of FlavDex.

3. Why we use your data (and legal bases)

Provide the Service (accounts, ratings, collections, retailer/brand pages, social features, and content hosting): contract.
Safety & moderation (review reports, detect abuse/spam, enforce rules, approve photos): legitimate interests.
Improvement & diagnostics (debugging, performance, service quality): legitimate interests.
Personalisation (surface relevant items, filters, and retailer results based on your settings/activity): legitimate interests.
Communications (essential service messages): contract/legitimate interests.
Push notifications (if enabled in-app/device settings): consent.
Optional health integration (import/export nutrition and hydration; show activity and calculate net calories): consent under UK GDPR Article 6(1)(a) and, where the information is special category health data, explicit consent under Article 9(2)(a). You can withdraw consent by disconnecting the integration.
Marketing (optional updates/newsletters): consent (withdraw anytime).
Advertising (display ads, measure delivery, prevent fraud, and manage advertising preferences): consent where required for access to device information, identifiers, or personalised advertising; and legitimate interests for basic ad delivery, security, fraud prevention, and aggregated measurement where the law permits. If consent is not given or is not available, Google may serve non-personalised or limited ads where permitted.
Legal compliance (lawful requests, disputes): legal obligation.

4. Sharing your data

Service providers: Supabase (authentication, database, and storage; UK region), email provider (e.g., 123-reg), push notification services (APNs/FCM if used), and crash reporting or analytics providers if added.
Google AdMob: Google receives advertising, device, consent, and interaction data described above to request, select, deliver, measure, secure, and report on ads. Google processes this information under its own terms and privacy documentation. See Google’s Privacy Policy and How Google uses information from sites or apps that use its services.
Public/social outputs: aggregate rating averages may be public on product pages; approved photos may be public; social/profile visibility follows your privacy settings in-app.
Payments: purchases via Apple App Store / Google Play are handled by those stores; they act as independent controllers for payment data.
Apple Health / Google Health Connect: when you request a sync, data is exchanged directly with the health service on your device under the permissions you grant. Apple and Google govern their respective health platforms. We do not disclose connected health data to advertising, marketing, analytics, or data-broker services.
Legal & safety: where required by law or to protect rights, safety, and property.

We do not sell your personal data, including health data.

5. Advertising, consent and tracking choices

The FlavDex mobile app displays native advertisements supplied by Google AdMob. Depending on your region and choices, Google may provide:

Personalised ads: ads selected using information about interests or previous activity, only where the necessary permissions and consent are available.
Non-personalised ads: ads selected mainly from contextual information, although limited identifiers or device storage may still be used for purposes such as frequency capping, aggregated reporting, security, and fraud prevention where permitted.
Limited ads: ads delivered without personalisation or features that require a local identifier when the applicable consent is unavailable.

For users in the UK, EEA, Switzerland, and other regions where required, FlavDex uses Google’s User Messaging Platform (UMP) and a Google-certified consent message to request and communicate applicable advertising choices. We request up-to-date consent information when the app starts and only request ads when Google’s consent status indicates that an ad request is permitted. Where required, you can revisit your decision using the Privacy and cookie settings option in the app. Withdrawing consent does not affect processing that was lawful before withdrawal.

FlavDex does not currently request Apple’s App Tracking Transparency permission and does not intentionally access the iOS advertising identifier (IDFA) for cross-app tracking. If we introduce cross-app tracking in the future, we will first request the operating-system permission and update this policy. On Android, you can reset or delete your advertising identifier through your device’s privacy settings. You can also manage ads associated with your Google account through Google My Ad Center.

6. International transfers

We aim to keep FlavDex account and content data in the UK (and EEA as applicable). Some providers, including Google for advertising and Apple or Google for app-store, device, and push-notification services, may process information outside the UK/EEA. Where we are responsible for a restricted transfer, we use an appropriate transfer mechanism, which may include the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, an adequacy regulation, or another legally recognised safeguard.

7. Retention

We keep your personal data only as long as necessary to provide the Service and for legitimate and legal purposes. In general:

Account data & UGC: retained while your account is active. We may delete or anonymise content/accounts at our discretion (e.g., storage management or rule breaches).
Social data & messages: retained while needed to provide social features and safety records, then deleted/anonymised under our retention rules.
Inactive accounts: may be deleted or anonymised after a period of inactivity, with reasonable notice where feasible.
Logs & diagnostics: typically 90–180 days unless needed longer for security/legal reasons.
Reports/moderation records: retained as needed for abuse prevention, appeals, and legal compliance.
Advertising and consent data: consent choices remain on the device or within Google’s consent systems as needed to respect and evidence those choices. Advertising data retained by Google is subject to Google’s retention practices and user controls.
Taste Diary health imports: retained with your Taste Diary while your account is active or until you remove them. If you remove an imported entry only from FlavDex, we retain its opaque provider record identifier so it is not re-imported; no nutrition or activity value is kept in that marker. Disconnecting stops future access but does not automatically erase existing Taste Diary entries. You can remove those entries in-app or request account deletion.
Backups: stored for limited periods, then deleted.

You can delete your ratings and notes in-app where available, and you can request full account deletion at any time (see Section 10).

8. Security

We use reasonable technical and organisational measures, including encryption in transit (TLS), encryption at rest via our hosting providers, and access controls. No service can be 100% secure.

9. Your choices

Profile & visibility: profiles are private by default; adjust privacy settings in the app.
Location: disable location sharing in your device settings if you prefer.
Notifications: manage push notifications in-app and device settings.
Health: choose food import, food export, water sync and active-calorie subtraction separately in the Taste Diary. Disconnect at any time. On iPhone, you can also change FlavDex permissions in the Health app; on Android, disconnecting asks Health Connect to revoke them. Removing an imported item from FlavDex does not delete the original item from Apple Health or Health Connect.
Advertising privacy: use Privacy and cookie settings in the app when available to review or change consent choices. Device-level advertising and privacy controls also remain available in iOS or Android settings.
Marketing: opt in/out of optional emails at any time.
Cookies (web): the website currently uses only essential cookies or session storage. If non-essential web analytics or advertising is introduced, we will provide the applicable choices before using it.

10. Your rights (UK GDPR)

You have rights to access, rectify, erase, restrict processing, object to processing based on legitimate interests, and data portability. Where processing is based on consent, you can withdraw consent at any time. To exercise your rights or request account deletion, email Cavan@flavdex.com.

We aim to respond to rights requests within one month, or as otherwise permitted by UK GDPR.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). We’d appreciate the chance to resolve your concerns first.

11. Children

The Service is not intended for anyone under 18. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

12. Changes to this Policy

We may update this Policy to reflect changes in our practices or the law. We will notify you of material changes (e.g., by email or in-app).

13. Contact

For privacy queries or rights requests, email Cavan@flavdex.com.

Website cookies: The FlavDex website currently uses only essential cookies or session storage. Advertising consent for the mobile app is managed separately through the app’s privacy controls where required.