Privacy Policy

1. Who we are

Crumbs (“Crumbs”, “we”, “us”, “our”) is operated by CRUMBS APP LIMITED, a company registered in England & Wales (company number 17260345), registered office: Flat 2, 50 Hatton Garden, London EC1N 8YS.

We are the data controller for the personal data described here. This policy covers the Crumbs mobile app and our website at crumbsapp.co.uk (together, the “Service”).

Questions, data requests, or want to exercise your rights? Email hello@crumbsapp.co.uk.

2. The short version

• We collect what you give us to make Crumbs work: your account, your profile, and the restaurants, reviews, lists and plans you create.
• Some things are optional and used only with your permission: your location, your contacts (to find friends), your photos, and push notifications.
• Crumbs is public by default — like Letterboxd or Goodreads, your profile, your reviews, and who you follow are visible to anyone. Your visit logs, private notes, and the people you invite to a plan stay private.
• We never sell your data, and there's no third-party advertising or tracking in the app.
• A small set of trusted suppliers help us run the Service.
• You can edit your profile, change what's visible, and delete your whole account from inside the app at any time.

3. What we collect

Information you give us

• Account: your email and password (your password is hashed by our authentication provider — we never see it).
• Profile: your username and display name, and optionally a bio, avatar, phone number, dietary preferences, and a taste archetype.
• Content you create:
  • Reviews & ratings — your scores and written reviews. Public.
  • Lists — each one public, followers-only, or private, your choice.
  • Visit logs — the date, what you ordered, who you were with, notes and photos. Private to you.
  • Private notes and tags — private to you.
  • Plans — private until you share the link; invitee names and their dietary notes are always private.
• Messages you send us.

Information from your device (only with your permission)

• Location: used on your device to centre the map and sort places by distance. We don't send your location to our servers, or to Google.
• Contacts: to help you find friends, your phone hashes your contacts' numbers on the device and sends only those one-way hashes to match against other users. Your actual contacts are never uploaded or stored. Your own number, if you add it, is stored as a hash so friends can find you.
• Photos: only the ones you choose to attach to a review or set as your avatar.
• Push notifications: we store a push token so we can notify you.

Information created automatically

• Technical & diagnostic data: app version, platform, and limited error logs if something fails. Error logs are automatically stripped of identifying details (emails, phone numbers, IDs).

Information from other people

• If you import a Google Takeout file, we read it so you can choose which places to add; the file is deleted after processing.
• Someone may add your name and a dietary note when inviting you to a plan.

Website

• The waitlist form collects your email, used only to email you about Crumbs.
• The site uses cookies — see section 11.

4. Why we use your data, and our legal basis

Dietary preferences can reveal health or religion, so they count as “special category” data. They're optional, and we process them on the basis of your explicit consent — you can remove them at any time.

Personalisation uses your activity to tailor recommendations and taste-overlap. This isn't automated decision-making with legal or similarly significant effects.

Marketing: we only send service messages. We don't send marketing emails and we don't share your details with advertisers.

5. Who can see your data, and who we share it with

What other people can see

• Public to anyone: your profile, your reviews and ratings, and who you follow / who follows you.
• Your choice, per list: public, followers-only, or private.
• Anyone you give a plan link to: that shared plan (its title, brief and options).
• Shared-list members: anyone with a list's invite code can join and see what's in it.
• Private to you: your visit logs, private notes, tags, and email.

You can block other users, change a list's visibility, or delete content at any time.

Service providers

• Supabase — our database, authentication and file storage, hosted in the EEA (Ireland).
• Google (Maps & Places) — powers maps and search. When you search, your search text (and place names from any import you run) is sent to Google; when a map loads, it runs on your device via Google's Maps SDK, so your device contacts Google directly and Google receives your IP address, under Google's own terms. These calls use Crumbs' API key — Google doesn't receive your account or identity.
• Expo / EAS — app delivery, updates, and push-notification delivery.
• Email delivery (Supabase / Resend) — account and waitlist emails.
• Vercel — hosts our website and provides Vercel Web Analytics for cookieless, anonymised visitor statistics.

We do not sell your personal data or share it for third-party advertising. We may disclose data where the law requires, or to protect the rights and safety of our users, the public, or Crumbs.

6. International transfers

Our database and storage (Supabase) are hosted in the EEA (Ireland), which the UK recognises as adequate — so no extra transfer safeguards are needed there. Some providers are in the United States (Google, Expo, Resend, Vercel); where data goes to them we rely on the UK “data bridge” (UK Extension to the EU–US Data Privacy Framework) or the UK IDTA / SCCs.

7. How long we keep it

• Your account and content: while your account is active.
• When you delete your account: we delete your profile, reviews, lists, visit logs, plans, follows, blocks and uploaded files. Content you added to other people's shared lists stays with that shared list but is no longer linked to you. Residual copies may remain in secure backups for a short time before being overwritten.
• Imports: uploaded files are deleted after processing; imported items are kept until you delete the import.
• Error logs: sanitised and kept only as long as needed.

8. Your rights

You can access, correct, delete, restrict or object to the use of your data, request portability, and withdraw consent at any time (e.g. turn off location, contacts or notifications in your settings). Much of this you can do yourself in the app.

To exercise any right, email hello@crumbsapp.co.uk — we'll respond within one month. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd like the chance to help first.

9. Children

Crumbs is for people aged 16 and over. We don't knowingly collect data from anyone under 16; if you believe a child has given us their data, contact us and we'll delete it.

10. Security

We protect your data with encryption in transit (HTTPS/TLS) and at rest, and we limit access to what's needed to run the Service.

11. Cookies and similar technologies

The Crumbs app uses no advertising or analytics SDKs.

Our website uses only essential cookies needed to make it work. For visitor statistics we use Vercel Web Analytics, which is cookieless, stores nothing on your device, and collects only anonymised, aggregated page-view data — so there's no cross-site tracking, and no cookie banner to click through.

12. Changes to this policy

We may update this policy as Crumbs evolves. If we make significant changes, we'll tell you in the app or by email. The date at the top always reflects the current version.

13. Contact

For data requests, support, or questions about this policy, email hello@crumbsapp.co.uk.
CRUMBS APP LIMITED — Flat 2, 50 Hatton Garden, London EC1N 8YS