Legal
Privacy policy
Carroty is made by OMEGA SEED LTD, a UK company (“Carroty”, “we”, “us”). This policy explains what personal data the Carroty iPhone app and this website collect, why we collect it, who else handles it, and what you can do about it.
We are the data controller under UK data protection law (UK GDPR and the Data Protection Act 2018). Questions about anything here: support@carroty.app.
The short version
- We collect what the app needs to plan your meals: the email from your sign-in, the profile you choose to fill in, and the recipes, favourites and meal plans you make.
- Your body measurements, goal, diet and allergens count as health information. Giving them is optional. We use them only to work out your daily targets and to keep your allergens out of your meal plans.
- Your shopping basket stays on your phone. We never see it.
- No ads. We don’t sell your data, and we don’t track you across other apps or websites.
- You can see, correct or delete your data at any time.
What we collect
When you sign in
You sign in with Apple or Google. We receive:
- your email address. If you use Apple’s “Hide My Email”, we get a private relay address instead.
- your name and profile photo, if your Apple or Google account shares them.
- an account ID that identifies you to our servers.
We never see your Apple or Google password.
What you choose to tell us
During onboarding, or later in Profile, you can give us:
- sex, age, height and weight
- activity level and goal (lose, maintain or gain weight)
- diet, allergens and foods you avoid
From these we calculate daily calorie and macro targets and store them with your profile. You can skip onboarding entirely.
What you make in the app
- recipes you create, with their ingredients and steps
- recipes you favourite
- your meal plan: which recipe is planned for which day and meal, and how many servings
- when you swap, skip or fill a meal in your plan. We record this to improve how plans are picked.
What you search for
When you search recipes or ingredients, the text you type is sent to Google’s Gemini API to find close matches. Only the search text is sent, never your name, email or account ID.
Technical data
When the app talks to our servers, they handle your IP address, app version, device type and the details of each request. If something breaks on our servers, an error report goes to our error-monitoring service. That report can include your IP address and account ID.
When the app starts, it also checks Expo’s update service for a newer version. That check shares your IP address, app version and device platform with Expo.
What stays on your phone
Your shopping basket, your last meal-plan choices and a cached copy of your profile are stored only on your device. Your sign-in tokens are kept in the iOS Keychain. Deleting the app removes them.
What we don’t collect
We don’t collect your location, contacts, photos, Apple Health data, advertising identifier or payment details.
Your health information
Your weight, height, goal, diet and allergens can reveal things about your health. UK GDPR treats information about health as a special category, so we only use it with your explicit consent. You give that consent by entering the information in the app.
You can withdraw consent at any time. Change or remove the information in Profile, or email us and we’ll delete it. The app still works without it, but plans won’t leave out your allergens and you won’t see calorie or macro targets.
Why we use your data
| What for | Data used | Legal basis |
|---|---|---|
| Running your account and signing you in | Sign-in details | Contract: needed to provide the app |
| Recipes, favourites, meal plans and search | What you make in the app, search text | Contract |
| Working out targets and keeping allergens out of plans | Health information | Explicit consent |
| Keeping the service working and secure, fixing bugs | Technical data | Legitimate interests: running a reliable, secure service |
| Improving how meal plans are picked | Swap, skip and fill records | Legitimate interests: making the app better |
| Replying when you contact us | Your email and message | Legitimate interests: helping you |
| Meeting legal obligations | Whatever the law requires | Legal obligation |
We don’t use your data for advertising. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who else handles your data
We use a small number of service providers to run Carroty. They process data only on our instructions and under data processing terms.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Sign-in and our database | UK (London) |
| Google Cloud | Runs our servers | UK (London) |
| Google (Gemini API) | Turns search text into search results | May be outside the UK |
| Sentry | Error reports from our servers | May be outside the UK |
| Expo | Delivers app updates | United States |
| Apple and Google | Sign-in, when you choose them | Covered by their own privacy policies |
We don’t sell your personal data or share it with advertisers. We disclose it to others only if:
- the law requires it.
- it’s needed to protect someone’s safety.
- Carroty is sold or merged. In that case we’ll tell you before your data falls under a different privacy policy.
International transfers
Some of these providers may process data outside the UK. When they do, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum to standard contractual clauses.
How long we keep it
- Account, profile, recipes and meal plans: for as long as you have an account. When you ask us to delete your account, we delete this data within 30 days. Copies in our backups expire on the backups’ normal cycle.
- Error reports and server logs: up to 90 days.
- Emails to support: as long as we need them to help you, and no longer than two years.
Deleting your account
Email support@carroty.app from the address you signed in with. If you used “Hide My Email”, tell us which Apple ID you signed in with. We’ll delete your account and everything linked to it within 30 days and confirm when it’s done.
If you signed in with Apple, you can also stop using Apple sign-in with Carroty from iPhone Settings → your name → Sign in with Apple.
Your rights
Under UK data protection law you have the right to:
- get a copy of your personal data
- correct data that is wrong
- have your data deleted
- restrict or object to how we use it
- receive your data in a portable format
- withdraw consent at any time, where we rely on consent
To use any of these rights, email support@carroty.app. It’s free, and we’ll reply within one month.
If you’re unhappy with how we handle your data, please tell us first. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.
Children
Carroty is not meant for anyone under 18, and we don’t knowingly collect data from children. If you think a child has given us personal data, email us and we’ll delete it.
Keeping your data safe
Data travels between the app and our servers over encrypted connections. Sign-in tokens are stored in the iOS Keychain, and access to our systems is limited to the people who run Carroty. No system is perfectly secure, but we work to protect your data and will tell you and the ICO if a breach puts you at risk.
This website
carroty.app does not use cookies, analytics or tracking scripts. Like any website, our hosting provider keeps standard server logs (IP address, page requested, browser type) to keep the site running and secure.
Changes to this policy
If we change this policy, we’ll update the date at the top. If a change materially affects how we use your data, we’ll tell you in the app before it takes effect.
Contact
OMEGA SEED LTD, trading as Carroty · support@carroty.app