Privacy Policy

Who's responsible

AllergenKit is operated by Common Measure, a UK sole-trader software studio (commonmeasure.co.uk), which is the data controller for the personal data described here. Contact: [email protected].

The free tools and saving a matrix to Pro

The matrix builder, one-off label maker, charts and posters run in your browser. They do not save their food content to an account unless you choose the matrix-to-Pro action described below. Session replay has separate coverage, explained under Cookies and analytics. Matrix entries are saved to local storage so they're there when you come back. The one-off label maker keeps a bounded draft and print settings in this browser tab's session storage, so they can survive a reload or a return to the tool in the same tab. Use Clear draft to remove them, especially on a shared device. The draft is not uploaded to your account or imported into Pro. Clearing browser data removes these locally stored entries and drafts.

If you choose Sign in or start a Pro trial from the matrix, we explain that Pro will save a populated matrix as a named menu. After you sign in in the same browser, its business name, menu name, item names and recorded allergen states are copied to your account as an unreviewed manual menu. Your original free browser copy stays in place. Opening the sign-in link on another device does not transfer that browser-held copy.

A temporary carryover copy in browser storage holds that menu and the email/account binding needed to import it safely. It expires after 24 hours and is removed on the next read; an opaque import reference and account/receipt identifiers remain locally to prevent duplicate or cross-account imports. The carryover storage payload is not sent in analytics event properties; matrix editing can appear in session replay as described below.

Anonymous usage counters

We count page use with a small script of our own. For each event we record: the page path (for example /allergen-matrix), the event type (page view, tool use, print), and a short random session number that exists only for that visit. For a successful label print we also record only the chosen output and dimensions, such as thermal:100x75 or a4:l7165. We do not record the printer model, account, product, label text, IP address, name, email or device fingerprint in these counters, and we honour your browser's “Do Not Track” setting. These counters do not contain an account identifier. Legal basis: legitimate interests — knowing which pages and label sizes actually help people.

Cookies and analytics

We also use PostHog, an EU-hosted analytics service, to understand how the site and app are used and to improve them. PostHog sets cookies and similar browser storage (names beginning ph_) lasting up to a year; while the cookie banner is shown you can turn analytics off from its Options panel, clearing your browser's site data brings the banner back, and your browser can block or clear cookies whenever you choose. Session replay masks email and password inputs and excludes the one-off label maker’s draft fields, preview, print output and temporary layout copies. Other tool and app interactions can include food and business information you enter or view, including matrix editing and published QR menus. Ordinary navigation and the safe usage events described here remain available. The site also uses essential browser storage for signing in and for remembering your cookie choice. Legal basis: legitimate interests — understanding what helps visitors and improving the product.

Acquisition and account milestones

Unless you turn analytics off or enable Do Not Track, we remember the first observed source of a visit for up to 90 days in browser storage (ak_acquisition_v1). We distinguish this from the visit when you request your signup link and from the location of a button on our own site. We keep only registered source, medium and campaign codes; unknown sources are reported as unknown. We do not keep full referring addresses, arbitrary query strings, names, email addresses, authentication tokens or recipe contents in these acquisition and milestone event properties. Session replay is described separately above.

A random reference joins these source codes to a confirmed account, including when a signup link is opened in another browser. The temporary reference expires after 24 hours and is removed during subsequent cleanup. Linked analytics uses a random account identifier. Our private aggregate report measures confirmed signup, first useful output action, paid subscription and renewal using account milestones and verified invoice facts. Consented product milestones also record successful menu saves, reviews, branding saves, print actions and later account visits, without menu names, item content, business identity, logo or colour values. Opening a print dialog does not prove that a sheet was printed. We do not infer sources for existing customers. Internal and test activity is excluded.

Analytics preferences and Do Not Track apply to this tracking. Turning analytics off clears browser attribution and removes linked source labels when you are signed in and the preference update reaches our service; essential account and billing records remain. Blocked storage or requests can leave attribution unknown. Legal basis: legitimate interests — understanding which sources bring customers who use and continue using the service.

Accounts

If you create an account we store your email address and sign-in records. Sign-in works by emailed magic link, so there's no password to store. Account data lives in our database, hosted by Supabase in London (AWS eu-west-2). Legal basis: performing our contract with you.

Your ingredient and recipe data (Pro)

Pro stores the ingredients, recipes, products and matrix/QR visibility choices you enter so your outputs stay in sync. This data is yours and we use it to provide the service. We do not sell it. The service providers listed below process data for us, and visible editing or output content can appear in session replay under Cookies and analytics above. Ask us to delete your account and it goes too. Legal basis: performing our contract with you.

Your Pro label-print preferences — including the business name and optional address you choose to print — stay in your browser's local storage and are not saved as account preferences. Visible values can appear in session replay as described above. Packed, best-before and optional-content choices are kept only for the current app session. While you edit, an unfinished ingredient or product draft is also kept in session storage for your signed-in account so it can survive a refresh; it is not saved to the account as a draft and is removed when you save, discard or sign out. Visible editing content can appear in session replay as described above. Clearing your browser data clears these browser-held preferences and drafts.

Saved menus, Items and branding (Pro)

Pro stores your named manual menus, business names, sections, item placements, print settings and review records. Your shared Items library stores item names, fourteen allergen declarations and output notes. Saved menu branding includes your chosen style, accent colour and optional logo, so it can be reused from your account. These records are used to provide the service. Food and business content is excluded from structured acquisition and milestone event properties; visible content can appear in session replay as described above. Legal basis: performing our contract with you.

Archived Items remain available to menus already using them. Removed menus are retained in Deleted menus for restoration; restoring a menu uses current shared Item facts and requires a fresh review. These retained records are removed with your account. Unsaved manual menu and Item edits are held in the current page and are not saved to the account as drafts; save them before leaving. Visible editing content can appear in session replay as described above.

Payments

Subscriptions are processed by Stripe. Your card number goes directly to Stripe and never touches our servers; we store only your subscription status and Stripe's reference codes so the app knows you're a Pro member. Stripe processes your payment data under its own privacy policy. Legal basis: performing our contract with you.

The rule-change email list

If you opt in, we store your email to send short notes when UK allergen rules change, plus the occasional AllergenKit update — a few emails a year at most. Every email includes an unsubscribe link, and unsubscribing removes you promptly. Your address is never shared. Legal basis: consent, which you can withdraw anytime.

Earlier support requests

Our former support form is closed. For requests received while it was available, we may still hold the product name, email address, page and campaign source, contact consent, and private follow-up notes. We use these records only to finish requested support and handle related enquiries. They are not added to the rule-change email list or sent to analytics. Legal basis: the consent given with the original request, which you can withdraw by emailing us.

Who processes data for us

• Supabase — database and sign-in, hosted in London (AWS eu-west-2).
• Stripe — payment processing.
• Cloudflare — serves the website and app.
• PostHog — product analytics, hosted in the EU (Frankfurt). PostHog's privacy policy.
• Resend — sent private alerts for earlier support requests. It does not receive new requests from the retired form.
• Bunny Fonts — serves our display font from an EU privacy-first CDN that doesn't log personal data. No Google Fonts here.

We don't use advertising networks, social pixels or data brokers, and we never sell data.

How long we keep things

Account and Pro data: while your account exists, then deleted on request (allow a few days, plus short-lived backups that expire automatically). Earlier support requests that did not progress: up to 90 days; those that progressed are kept only as needed to finish the requested support and handle related enquiries. Usage counters: kept as anonymous statistics. Linked acquisition records: while the account exists, with source labels removed on a received analytics opt-out; the temporary signup snapshot expires after 24 hours. Analytics data in PostHog: kept for up to seven years. List emails: until you unsubscribe.

Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere. Email [email protected] and we'll sort it. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes materially, we'll note it here and email account holders. This version: 20 September 2026.