Privacy Policy

1. Data Controller

FeastAhead is operated by Fluffy Leopard Labs, which is the data controller responsible for your personal data.

• Fluffy Leopard Labs is based in the United Kingdom. Company registration is in progress; our registered company number and address will be added here once incorporation is complete.
• Contact for privacy matters: privacy@feastahead.app.

2. Data We Collect

We collect the following categories of personal data:

• Account information: name, email address, profile image.
• Authentication data: hashed passwords, OAuth tokens.
• Content you create: recipes, meal plans, shopping lists, pantry items.
• Usage data: household membership, friend connections, notification preferences.
• Technical data: IP addresses, browser information, session data.
• Image data (optional features only): photos you choose to submit to features such as barcode scanning, best-before date scanning, or recipe import. See Section 7 for how these are processed.

3. Legal Basis for Processing

We process your data based on:

• Contractual necessity — to provide the FeastAhead service.
• Your consent — for marketing communications and optional features.
• Legitimate interests — service improvement, security, and fraud prevention.
• Legal obligations — tax records and regulatory requirements.

4. Data Retention

We retain your personal data for as long as your account is active. Notifications are automatically deleted after 90 days. If you delete your account, your personal data is erased within 30 days, except where retention is required by law. Public recipes from deleted accounts are anonymised and attributed to "Deleted User".

5. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data (via the data export feature in account settings).
• Rectify inaccurate data (via your profile settings).
• Erase your data (via the account deletion feature).
• Restrict processing.
• Data portability — your data export is provided in JSON format.
• Object to processing.
• Withdraw consent at any time, where processing is based on consent (for example, marketing). Withdrawing consent is as easy as giving it — use the unsubscribe link in any marketing email or the relevant toggle in account settings.

To exercise these rights, use the relevant features in your account settings or contact privacy@feastahead.app.

6. Data Sharing

We share your data only with the service providers we need to run FeastAhead. We do not sell your personal data to third parties, and we do not share it for advertising. Our processors currently include:

• Stripe — payment processing.
• Resend — transactional emails.
• Sentry — error monitoring.
• OVH — hosting and infrastructure.

This list may change as our service develops; we will keep this policy updated to reflect the processors we use.

Recipes you choose to make public are visible to all authenticated users. Recipes you keep private are not shared publicly. If you use any contextual shopping links we provide (for example, "add this list to your basket at a partner store"), these do not use third-party tracking and do not pass identifying information about you to the partner.

7. Artificial Intelligence and Automated Features

Some optional features use automated processing, including AI, to make the app more useful — for example, reading a product label from a photo when a barcode lookup fails, confirming a best-before date from an image, or helping import a recipe.

Our design principle is privacy by architecture:

• These AI features run on our own hardware. Image and content data processed by them is not sent to any third-party AI service (such as external large-language-model or cloud-vision providers).
• Where, in future, demand exceeds our own capacity, a limited, metered cloud-vision fallback may be used for specific requests. If and when that happens, we will update this policy to describe it clearly, including which provider is used and what safeguards apply. We will not introduce such a fallback silently.
• These features are optional. You are not required to submit photos or use AI-assisted features to use FeastAhead's core functionality.

8. International Transfers

Some of our service providers (Section 6) process data on infrastructure located outside the United Kingdom. Where personal data is transferred outside the UK, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum — to ensure your data remains protected to UK GDPR standards.

9. Children

FeastAhead is a household food-planning service intended for adults. It is not directed at children, and we do not knowingly collect personal data from children under 16. A household may include children whose meals are planned by an adult, but we do not intend for children to create their own accounts. If you believe a child has provided us with personal data, please contact privacy@feastahead.app and we will delete it.

10. Cookies and Local Storage

We use a small number of strictly necessary cookies and similar local-storage technologies to keep you signed in and to maintain your session. We do not use advertising or third-party tracking cookies. Because these are strictly necessary to provide the service, they do not require consent, but you can clear them at any time through your browser settings.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), secure password hashing, session management, and regular security reviews.

12. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you within the service.

13. Contact

For privacy-related enquiries, contact us at privacy@feastahead.app.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom (ico.org.uk).