Privacy Policy

Kitchen Forage ("the Service", "the app") is operated by Stow Quill Limited ("we", "us", "our"), a company registered in England and Wales (company number 15671718) with its registered office at 47 Jerounds, Harlow, Essex, CM19 4HE.

We are the "data controller" for the personal data described in this policy. We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZC191878.

For any privacy question, or to exercise your rights, contact us at mike_stow@hotmail.co.uk or by post at our registered office above.

This policy explains what personal data we collect when you use Kitchen Forage at kitchen-forage.com (and any related apps), why we collect it, who we share it with, how long we keep it, and your rights. It does not cover third-party websites or services we link to, which have their own policies.

We collect the following, depending on how you use the Service:

• Account data: your first name, email address, and password (passwords are handled by Google Firebase Authentication and are not visible to us). If you sign in with Google, we receive your name and email from Google.
• Household and content data: the household you create or join, its members' names and preferences (including allergies, dietary requirements and dislikes you choose to enter), your food inventory, expiry/use-by dates, shopping lists, meal plans, recipes, ratings and notes.
• Images you upload: photos of your kitchen, receipts and meals. Receipt photos may contain purchase details such as items, prices and the retailer.
• AI-related data: when you use the kitchen scan, receipt scan or recipe suggestions, the relevant images and text are sent to our AI provider to recognise items and generate suggestions (see 'Who we share data with').
• Payment data: if you subscribe to Kitchen Forage Pro, your payment is processed by Stripe. We do not store your full card details; we receive limited information such as your subscription status and the last four digits/card type from Stripe.
• Calendar data: only if you choose to connect Google Calendar — your Google account email, the calendars you select, and event titles/times used to help plan meals. We can also add meal entries to your calendar.
• Gamification data: points, levels, streaks and an activity history reflecting your use of the app.
• Technical data: IP address, device and browser information, and log/usage data generated when you use the app, plus limited product analytics (see 'Cookies and local storage').
• Communications: any messages you send us.

Under UK GDPR we rely on the following legal bases:

• To provide the Service — creating your account and household, storing your inventory, plans, recipes and photos, and running core features. Legal basis: performance of our contract with you.
• To run AI features you request — sending your kitchen/receipt images and inventory text to our AI provider for recognition and recipe suggestions. Legal basis: performance of our contract, and your choice to use these optional features.
• To take payment for Pro subscriptions and keep financial records. Legal basis: performance of our contract and compliance with our legal obligations.
• To connect and use Google Calendar. Legal basis: your consent, which you can withdraw at any time by disconnecting it in Settings.
• To keep the Service secure, prevent abuse and fraud, and fix problems. Legal basis: our legitimate interests in operating a safe, reliable service.
• To understand and improve the Service using limited, milestone-level analytics (we do not send your food, recipe or household content into analytics). Legal basis: our legitimate interests.
• To respond to your enquiries and provide support. Legal basis: our legitimate interests and/or performance of our contract.
• To comply with the law, including tax, accounting and responding to lawful requests. Legal basis: compliance with our legal obligations.

We do not sell your personal data. We share it only with service providers who process it on our behalf, and only as needed to run the Service:

• Google (Firebase and Google Cloud) — authentication, database, file storage and hosting. Your account, household content and uploaded images are stored on Google's infrastructure.
• OpenAI — processes the images and text you submit for the kitchen scan, receipt scan and recipe suggestions, to recognise items and generate content.
• Stripe — processes Pro subscription payments as a payment services provider and data controller for that payment data.
• Spoonacular and TheMealDB — provide recipe data. We send generic ingredient search terms, not your personal details.
• Google Calendar (Google) — only if you connect it, to read the calendars/events you select and add meal entries you request.

If you choose to publish a recipe to the community library, that recipe (and the display name you are credited under) is shared publicly with other households. People in your household can see the household's shared data. We may also disclose data where required by law, to enforce our terms, or to protect our rights, users or the public.

Some of our providers (including Google, OpenAI and Stripe) are based in, or process data in, the United States and other countries outside the UK. Where we transfer personal data outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses, so that your data receives an equivalent level of protection.

We keep your personal data for as long as your account is active. If you delete your account (in Settings), we delete or anonymise your personal data and any household you own, except where we must keep certain records to meet legal obligations — for example, transaction and tax records, which we keep for up to six years. Residual copies may persist in backups for a limited period before being overwritten.

We use appropriate technical and organisational measures, including:

• Encryption of data in transit (HTTPS/TLS) and encryption at rest provided by Google Cloud.
• Any Google Calendar refresh tokens are additionally encrypted (AES-256-GCM) and stored in a server-only area that clients cannot read.
• Access controls and database security rules that restrict data to your own account and household.
• Server-side validation for sensitive operations, so credentials such as API keys never reach your browser.

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase your data ('right to be forgotten').
• Restrict or object to our processing in certain circumstances.
• Data portability — receive certain data in a portable format.
• Withdraw consent at any time where we rely on consent (this does not affect processing already carried out).

You can delete your account and its data at any time from Settings. To exercise any other right, contact us at mike_stow@hotmail.co.uk. We will respond within the timeframes required by law (usually within one month).

We use only essential and functional storage needed to run the app — for example, sign-in tokens (managed by Firebase Authentication) and small items in your browser's local storage such as your active household and which meal suggestions you have already seen. We do not use advertising or third-party tracking cookies. Our product analytics is limited to milestone events and does not include your food, recipe or household content.

The Service is intended for people aged 16 and over. It is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will remove it.

We may update this policy from time to time. If we make material changes, we will update the "last updated" date above and, where appropriate, notify you in the app. Please review it periodically.

If you have a concern about how we handle your data, please contact us first at mike_stow@hotmail.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.