Legal · Last updated 19 July 2026
Privacy Policy
The short version: no advertising, no trackers, no cookies, no selling data — ever. The free tools keep your data on your own device. Accounts store the minimum we need to run the service, hosted in the UK.
Who's responsible
AllergenKit is operated by Common Measure, a UK sole-trader software studio (commonmeasure.co.uk), which is the data controller for the personal data described here. Contact: [email protected].
The free tools: nothing leaves your browser
The matrix builder, charts and posters run entirely in your browser. What you type is saved to your device's local storage so it's there when you come back — it is never uploaded to us. Clearing your browser data clears it.
Anonymous usage counters
We count page use with a small script of our own instead of a third-party analytics service. For each event we record: the page path (for example /allergen-matrix), the domain a visitor arrived from (just the site name, never the full address), the event type (page view, tool use, print), and a short random session number that exists only for that visit. We do not record IP addresses, names, emails or device fingerprints in our analytics, we set no cookies, and we honour your browser's “Do Not Track” setting. None of it can identify you. Legal basis: legitimate interests — knowing which pages actually help people.
Accounts
If you create an account we store your email address and sign-in records. Sign-in works by emailed magic link, so there's no password to store. Account data lives in our database, hosted by Supabase in London (AWS eu-west-2). Legal basis: performing our contract with you.
Your ingredient and recipe data (Pro)
Pro stores the ingredients, recipes and products you enter so your matrix and labels stay in sync. This data is yours, it's used only to provide the service, and it's never analysed for anything else, shared or sold. Ask us to delete your account and it goes too. Legal basis: performing our contract with you.
Payments
Subscriptions are processed by Stripe. Your card number goes directly to Stripe and never touches our servers; we store only your subscription status and Stripe's reference codes so the app knows you're a Pro member. Stripe processes your payment data under its own privacy policy. Legal basis: performing our contract with you.
The rule-change email list
If you opt in, we store your email to send short notes when UK allergen rules change, plus the occasional AllergenKit update — a few emails a year at most. Every email includes an unsubscribe link, and unsubscribing removes you promptly. Your address is never shared. Legal basis: consent, which you can withdraw anytime.
Who processes data for us
- Supabase — database and sign-in, hosted in London (AWS eu-west-2).
- Stripe — payment processing.
- Cloudflare — serves the website and app.
- Bunny Fonts — serves our display font from an EU privacy-first CDN that doesn't log personal data. No Google Fonts here.
We don't use advertising networks, third-party analytics, social pixels or any other trackers.
How long we keep things
Account and Pro data: while your account exists, then deleted on request (allow a few days, plus short-lived backups that expire automatically). Usage counters: kept as anonymous statistics. List emails: until you unsubscribe.
Your rights
Under UK GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere. Email [email protected] and we'll sort it. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this policy changes materially, we'll note it here and email account holders. This version: 19 July 2026.