Privacy Policy

Who's responsible

AllergenKit is operated by Common Measure, a UK sole-trader software studio (commonmeasure.co.uk), which is the data controller for the personal data described here. Contact: [email protected].

The free tools: nothing leaves your browser

The matrix builder, one-off label maker, charts and posters run entirely in your browser. Matrix entries are saved to your device's local storage so they're there when you come back; the one-off label maker does not save what you type. This content is never uploaded to us. Clearing your browser data clears locally stored matrix entries.

Anonymous usage counters

We count page use with a small script of our own. For each event we record: the page path (for example /allergen-matrix), the domain a visitor arrived from (just the site name, never the full address), the event type (page view, tool use, print), and a short random session number that exists only for that visit. For a successful label print we also record only the chosen output and dimensions, such as thermal:100x75 or a4:l7165. We do not record the printer model, account, product, label text, IP address, name, email or device fingerprint in these counters, and we honour your browser's “Do Not Track” setting. None of it can identify you. Legal basis: legitimate interests — knowing which pages and label sizes actually help people.

Cookies and analytics

We also use PostHog, an EU-hosted analytics service, to understand how the site and app are used and to improve them. PostHog sets cookies and similar browser storage (names beginning ph_) lasting up to a year; while the cookie banner is shown you can turn analytics off from its Options panel, clearing your browser's site data brings the banner back, and your browser can block or clear cookies whenever you choose. The site also uses essential browser storage for signing in and for remembering your cookie choice. Legal basis: legitimate interests — understanding what helps visitors and improving the product.

Accounts

If you create an account we store your email address and sign-in records. Sign-in works by emailed magic link, so there's no password to store. Account data lives in our database, hosted by Supabase in London (AWS eu-west-2). Legal basis: performing our contract with you.

Your ingredient and recipe data (Pro)

Pro stores the ingredients, recipes, products and matrix/QR visibility choices you enter so your outputs stay in sync. This data is yours, it's used only to provide the service, and it's never analysed for anything else, shared or sold. Ask us to delete your account and it goes too. Legal basis: performing our contract with you.

Your Pro label-print preferences — including the business name and optional address you choose to print — stay in your browser's local storage and are not uploaded to us. Packed, best-before and optional-content choices are kept only for the current app session. While you edit, an unfinished ingredient or product draft is also kept in session storage for your signed-in account so it can survive a refresh; it is never uploaded as a draft and is removed when you save, discard or sign out. Clearing your browser data clears these browser-held preferences and drafts.

Payments

Subscriptions are processed by Stripe. Your card number goes directly to Stripe and never touches our servers; we store only your subscription status and Stripe's reference codes so the app knows you're a Pro member. Stripe processes your payment data under its own privacy policy. Legal basis: performing our contract with you.

The rule-change email list

If you opt in, we store your email to send short notes when UK allergen rules change, plus the occasional AllergenKit update — a few emails a year at most. Every email includes an unsubscribe link, and unsubscribing removes you promptly. Your address is never shared. Legal basis: consent, which you can withdraw anytime.

One-bake setup requests

If you ask for personal help with one bake, we store the bake name, your email address, the page and campaign source, and your contact consent. We use those details only to reply about the bake, provide the requested setup help and understand whether the request progresses. They are not added to the rule-change email list or another marketing list. Legal basis: your consent, which you can withdraw by emailing us.

Privately, we may record practical follow-up stages such as whether we notified Finn, replied, began a conversation, agreed a setup, linked the request to an account, saw the business return later, or closed the request and why. If an account is linked, the first useful output and any later payment are read from the account and subscription records rather than inferred from browsing. Facebook or email conversations that you start may be recorded in the same private workflow. None of these details is sent to analytics of any kind.

Who processes data for us

• Supabase — database and sign-in, hosted in London (AWS eu-west-2).
• Stripe — payment processing.
• Cloudflare — serves the website and app.
• PostHog — product analytics, hosted in the EU (Frankfurt). PostHog's privacy policy.
• Resend — sends Finn a private alert when the website receives a setup request; replying starts a personal email conversation. We do not send an automated customer acknowledgement.
• Bunny Fonts — serves our display font from an EU privacy-first CDN that doesn't log personal data. No Google Fonts here.

We don't use advertising networks, social pixels or data brokers, and we never sell data.

How long we keep things

Account and Pro data: while your account exists, then deleted on request (allow a few days, plus short-lived backups that expire automatically). Setup requests that do not progress: up to 90 days; requests that do progress are kept only as needed to provide the setup and handle related support. Usage counters: kept as anonymous statistics. Analytics data: kept for up to seven years. List emails: until you unsubscribe.

Your rights

Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere. Email [email protected] and we'll sort it. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes materially, we'll note it here and email account holders. This version: 21 August 2026.