Privacy Policy

Last updated: 9 August 2026

This document is provided in good faith to clearly explain what data Crumbbook collects and why. It has not been reviewed by a solicitor. If you have specific legal concerns, please seek independent advice.

1. Who we are

Crumbbook is operated by Owen Spencer as an individual, and acts as the data controller for the personal data described below. Contact: owenspencer44@gmail.com.

2. What data we collect

Account data: your email address and password (your password is never stored in readable form — it's hashed by our authentication provider).
Your content: recipes, pages, meal plans, and shopping lists you create, including any photos you upload of recipes.
Device information: a device identifier used to recognise devices you've previously signed in from, so we can flag sign-ins from new/unrecognised devices as a security measure.
Payment information: if you make a purchase, Stripe (our payment processor) handles and stores your card details directly — we never see or store full card numbers ourselves. We do keep a record that a payment was made, its amount, and the date.
Usage data: how many AI actions and support messages you've used in a given week, so we can apply the app's fair-use limits.
Advertising data: if you accept ads (see section 3), Google AdSense sets cookies and processes data to serve and measure ads.

3. Cookies and advertising

We show ads via Google AdSense to help keep this app free to use. The first time you visit, you're asked to accept or decline this. If you accept, Google AdSense sets cookies and uses similar technologies to serve ads and measure how they perform, which may include using data to make ads more relevant to you depending on your own Google ad settings.

You can change this choice at any time from Account → Ad preferences inside the app. Google's ad-serving script file loads on every visit regardless (this lets Google verify the site is genuinely using AdSense), but no actual ad is ever requested or shown, and no ad-targeting cookie is set, unless you've accepted — the app works fully either way, except that the option to watch an ad for one extra free AI action per week won't be offered if you haven't (paying to unlock more AI usage remains available regardless).

For details on how Google uses data from sites that use its services, and to manage your ad settings across the web, see how Google uses information from sites that use its services and Google Ad Settings.

4. How we use it

To provide the core service: storing your cookbook, running the features you use.
To authenticate you and keep your account secure (device recognition, password reset).
To process payments and grant the corresponding AI usage allowance.
To respond if you contact support.
To enforce the app's fair-use limits on AI features.
To show ads, if you've accepted them, to help fund the app.

5. Legal basis for processing (UK GDPR)

We process your data under the following legal bases: performance of a contract (providing the service you signed up for), legitimate interests (security measures like device recognition, preventing abuse of free AI usage), legal obligation (retaining payment records as required for tax/accounting purposes), and consent (advertising cookies — see section 3, which you can withdraw at any time).

6. Who we share data with

We use a small number of third-party services to run the app. Each only receives the data it needs to do its specific job:

Service	What it's used for	What it receives
Supabase	Database, authentication, and backend hosting (EU region)	All account and content data described above
Vercel	Hosts the app itself (the website you're using)	Standard web request data (no account content)
Stripe	Payment processing	Your email and payment details, if you make a purchase
Brevo	Sends account emails (sign-in codes, password resets, support replies)	Your email address, and the content of those specific emails
Google (Gemini API)	Powers AI recipe generation, nutrition estimates, photo scanning, and shopping lists	Whatever text/photo you submit to an AI feature when you use it
Google AdSense	Shows ads to fund the free tier, only if you've accepted (see section 3)	Standard ad-serving/measurement data — nothing if you decline ads

We don't sell your data to anyone, and we don't share it with third parties beyond the service providers above who help us run the app. Google's data-handling terms for its API may differ from its consumer products — if you have concerns about AI-processed content specifically, avoid using the AI features (the rest of the app works fully without them).

7. Where your data is stored

Your account and content data is stored in the EU (Ireland) via our database provider.

8. How long we keep it

We keep your account and content data for as long as your account exists. Payment records are kept for as long as required by UK tax law even after an account is deleted. If you ask us to delete your account, we'll remove your personal content within a reasonable time, except where we're required to retain something (like payment records) by law.

9. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data (most of this you can already do yourself in the app).
Request deletion of your account and data ("right to be forgotten").
Request a copy of your data in a portable format.
Object to certain processing.
Withdraw consent to advertising cookies at any time (Account → Ad preferences).

There's currently no self-service "delete my account" button in the app — to exercise any of these rights, email owenspencer44@gmail.com and we'll action it directly. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

10. Security

We use industry-standard measures to protect your data: encrypted connections (HTTPS) everywhere, database-level access controls so your data is only ever readable by you, password hashing, and a device-recognition check for new sign-ins. No system is 100% secure, but we take this seriously and review it regularly.

11. Children

The service is intended for users aged 16 and over and isn't directed at children.

12. Changes to this policy

We may update this policy as the app changes. Material changes will be reflected here with an updated date.

13. Contact

Questions or requests regarding your data: owenspencer44@gmail.com, or use "Help & Support" inside the app.