Legal
Privacy Policy
1. Who we are
What's For Dinner?! ("WFD", "we", "us") is operated by This is Bullish, a business registered in the United Kingdom. Our registered company details are available on request using the contact details in section 12.
We are the data controller for the personal data described in this policy. That means we decide why and how your personal data is processed, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and, where it applies, the EU GDPR.
2. What this policy covers
This policy covers two things:
- Our website, the marketing and content site at https://whatsfordinner.uk, including our email signup form and blog.
- The WFD app, our iOS and Android app that helps couples, families and households decide what to eat together.
If we introduce features that change how we handle your data, we will update this policy first. See section 11.
3. Data we collect
3.1 Website visitors
If you just browse our website, we collect very little:
- Server logs. Our hosting provider, Vercel, automatically records basic technical data when you visit, such as your IP address, browser type and the pages you request. We use this to keep the site secure and working. Logs are short-lived and are not used to build profiles of visitors.
- Analytics. We do not use any third-party analytics service, and we do not use analytics cookies. We plan to introduce our own first-party, privacy-conscious analytics, hosted on our own systems, and we will update this policy before it goes live. When we do, it will not use cookies, will not track you across other websites, and will not build a personal profile of you: it will record only aggregate, non-identifying information such as which pages are visited, roughly where visits come from (for example, country), and which links are clicked. We will not store your full IP address for this purpose. Our lawful basis for this limited measurement is our legitimate interests in understanding and improving the website.
We do not use tracking cookies on the website. That is why you will not see a cookie banner.
3.2 Email signups
If you sign up for updates through the form on our website, we collect:
| Data | Why we collect it |
|---|---|
| Your email address | To send you the updates described at the form |
| Signup timestamp | To keep a record of when you subscribed |
| Source page | To know which page you signed up from |
| Consent record | To prove you agreed to receive emails |
This data is stored in Supabase (our database provider). We use it only to send you the updates described at the point you signed up. We never sell it, and we never share it for advertising. Every email we send includes an unsubscribe link, and you can opt out at any time. You can also email us (section 12) and we will remove you.
3.3 App users
When you use the WFD app, we expect to process data such as:
- Account details, for example your name or display name, email address and login credentials.
- Household pairing; if you invite a partner, family member or housemate, we process the connection between your accounts so you can plan together.
- Meal preferences and plans, the meals you swipe on, match on, add to your weekly plan, dietary tags you set, and shopping lists you build.
- Device data, basic technical information about your device needed to run and support the app.
- Push notification token, if you allow notifications; your phone gives us a token so we can send notifications to that device.
- Supermarket connection (Add to Basket), if you choose to add your shopping list to your own online supermarket trolley from inside the app. See the note below for exactly what this involves.
A note on supermarket connections (Add to Basket). The app can show a supported supermarket's website (currently Ocado or Tesco) inside the app so you can add the items on your shopping list to your own trolley there. When you use this feature:
- You sign in to the supermarket yourself, on its own website. Your supermarket password, sign-in cookies and session stay in the browser component on your device and are never sent to, read by or stored on our systems. Payment card details, delivery address and anything you enter at the supermarket's checkout likewise never reach us.
- What we store on our systems is the record needed to run the feature and show you what happened: which supermarket you used, which shopping list and meals the request covered, the ingredient and the supermarket product identifier and quantity we tried to add for each line, the outcome for each line (added, unavailable, changed, or needs your review), the product name, pack size and identifier of any product you choose yourself as a replacement for a line, and timestamps. We do not read or store prices, trolley totals, or the contents of your trolley beyond the item-and-quantity check that confirms what the app just added.
- The supermarket is a separate organisation. When you use its website inside the app, it receives the same information it would receive if you visited it in a normal browser, including the items you add. The supermarket is an independent controller of that data under its own privacy notice; we do not send it your WFD account details, and it does not send us anything about your account.
- You can disconnect at any time in the app's Settings, under "Connected services", which removes the supermarket's sign-in data from your device. Deleting your WFD account deletes the records described above from our systems.
A note on dietary tags and allergy-related preferences. Dietary tags and preference settings you or your household enter in the app (for example "nut-free" or "gluten-free") are stored as ordinary user content and used only to organise and filter meals within your household. They are entered by users, are not verified by us, and are not treated or maintained by us as a health record, allergen register or medical information, and must not be relied on as such; see section 7 of our Terms of Service. To the extent a tag or preference could reveal information about health (such as an allergy or intolerance) or religious observance (such as halal or kosher preferences), it may constitute special category data under UK GDPR; where that is the case, we process it on the basis of your explicit consent, given when you choose to enter that information, and you can delete it at any time by removing the tag or deleting your account. The app asks for your explicit consent the first time you add a tag or preference of this kind.
A note on emails and notifications. The app sends you:
- sign-in codes, by email;
- household updates, by email or notification, for example when someone joins your household, when you match on meals, when tonight's meal changes or when an invite you sent is about to expire;
- reminders about your free period and, if you start a free trial through the App Store or Google Play, a reminder before it becomes a paid subscription;
- now and then, a personal email from us asking how the app is working for you, or following up on a problem you had. These are about the app you use, not advertising.
Reminder emails include an unsubscribe link, which also stops household update emails. You can turn notifications off in your phone's settings at any time. To stop any other email from us, reply to it or write to us (section 12).
The app does not currently use third-party in-app analytics or third-party crash reporting. If we introduce these, we will update this policy first, as described in section 11.
4. Why we use your data, and our lawful bases
UK GDPR requires us to have a lawful basis for each use of your personal data. Here is what we rely on:
| What we do | Lawful basis |
|---|---|
| Send you email updates you signed up for | Consent; you can withdraw it at any time by unsubscribing |
| Keep server logs and protect the website and app from abuse | Legitimate interests; keeping our services secure and reliable |
| Run aggregate, cookieless analytics (if enabled) | Legitimate interests; understanding overall site usage without profiling individuals |
| Provide the app: your account, household pairing, meal plans and lists | Contract; we need this data to deliver the service you signed up for |
| Add your shopping list to your own supermarket trolley, and show you the result | Contract; you ask for this each time by starting the feature, and we need the fill record to run it and report back to you |
| Send sign-in codes, and remind you before a store free trial becomes a paid subscription | Contract; you need these to use your account and to know when you will be charged |
| Send household updates and free-period reminders by email and notification | Legitimate interests; telling you what changed in your household and when your free period ends. You can unsubscribe or turn notifications off at any time |
| Email you now and then to ask how the app is working for you, or to follow up on a problem | Legitimate interests; improving the app. Reply to say stop and we will not email you for this again |
| Respond when you contact us | Legitimate interests; answering your questions |
Where we rely on legitimate interests, we have checked that our interest does not override your rights. You can object at any time (see section 8).
5. Who processes your data for us
We use a small number of trusted service providers ("processors") who handle data on our instructions:
| Provider | What they do | Location / notes |
|---|---|---|
| Supabase | Database hosting (email signups; app data) | Hosted in the London (UK) region |
| Vercel | Website hosting and server logs | Global edge network; see section 6 |
| Apple App Store | App distribution and payments on iOS | Apple processes payments under its own terms |
| Google Play | App distribution and payments on Android | Google processes payments under its own terms |
| (No third-party analytics provider.) Planned first-party analytics is hosted on our own systems (see Supabase above) | Cookieless, aggregate website analytics | Stored in our own database; no separate analytics processor |
| Resend | Sends the app's emails (sign-in codes, household updates and reminders) | Based in the United States; see section 6 |
| Zoho Mail | Our mailbox, help@whatsfordinner.uk, for emails we send and receive ourselves | Hosted in Zoho's EU data centre |
| Apple Push Notification service | Delivers notifications to iPhones | Receives the push token and the notification text |
| Google Firebase Cloud Messaging | Delivers notifications to Android phones | Receives the push token and the notification text |
Apple and Google act as independent controllers for the purchases you make through their stores. Their own privacy policies apply to those transactions.
Supermarkets you connect to through Add to Basket (currently Ocado or Tesco) are not our processors. They are independent controllers of the data you give them on their own website, including your supermarket account, the items you add to your trolley and anything you enter at checkout. Their own privacy notices apply. We have no commercial, affiliate or technical partnership with any supermarket; see section 4.5 of our Terms of Service.
6. International transfers
Some of our providers store or process data outside the UK and the European Economic Area, including in the United States. Where that happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or an adequacy decision covering the destination country. Our primary data store (Supabase) is hosted in the UK; where a provider such as Vercel processes limited technical data (like server logs) outside the UK or EEA, it does so under EU Standard Contractual Clauses and the UK Addendum incorporated in its data processing agreement. Resend, which sends the app's emails, processes your email address and the email content in the United States under the UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the EU Standard Contractual Clauses in its data processing agreement.
7. How long we keep your data
| Data | How long |
|---|---|
| Email signup data | Until you unsubscribe or ask us to delete it |
| Server logs | Short-lived; retained by our hosting provider for no more than 30 days |
| App account and household data | While your account is active; deleted within 30 days after you delete your account |
| Supermarket fill records (section 3.3) | While your account is active; deleted with your account on the same timescale. Supermarket sign-in data lives only on your device and is removed when you disconnect in Settings or delete the app |
| Push notification token | Until you delete your account, or until Apple or Google tell us the token no longer works |
| Email preferences (for example, an unsubscribe) | While your account is active; deleted with your account |
| Analytics data (if enabled) | Aggregate only; no personal data retained |
We keep data no longer than we need it. Where the law requires us to keep something longer (for example, records of consent), we keep only what is necessary.
8. Your rights
Under UK GDPR you have the right to:
- Access, ask for a copy of the personal data we hold about you.
- Rectification, ask us to correct inaccurate data.
- Erasure, ask us to delete your data.
- Restriction, ask us to limit how we use your data.
- Portability, receive your data in a portable format.
- Objection, object to processing based on legitimate interests.
- Withdraw consent, at any time, where we rely on consent (for example, email updates). Withdrawing consent does not affect processing that happened before you withdrew it.
To exercise any of these rights, contact us using the details in section 12. We will respond within one month.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to resolve your concern first, but you do not have to contact us before going to the ICO.
9. Children
The website and the WFD app are not directed at children under 13, and we do not knowingly collect personal data from them. Family features in the app, such as household plans that include children's meal preferences, are designed to be set up and managed by adults. The app does not offer accounts or profiles for children: any preferences relating to a child in a household (such as a dietary tag) are entered and controlled by the adult account holder, and are handled as described in section 3.3.
If you believe a child has given us personal data, please contact us and we will delete it.
10. Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls on our systems and databases, and reputable hosting providers with strong security practices. No system is completely secure, but we work to keep risks low, and we will tell you and the relevant regulator if a breach affects your data in a way the law requires us to report.
11. Changes to this policy
We may update this policy as the product develops; for example, when we launch new features or if we confirm a premium tier. We will post the updated version on this page with a new "updated" date. If a change significantly affects your rights, we will take reasonable steps to bring it to your attention, such as emailing subscribers or notifying you in the app.
12. Contact
Questions, requests or complaints about your data:
- Email: help@whatsfordinner.uk
If you need a postal address (for example, for formal correspondence), email us and we will provide one.