What we store, and who else sees it.

What Big Shop stores

• Your account. The email address and name you signed up with, an identifier from our login provider, and when you last logged in.
• Your recipes. Names, ingredients, methods, notes, tags, and the link a recipe came from. If you import one by photographing it, the photo is sent away to be read and then deleted — it is never stored.
• Your shopping lists. What is on them, how much of each, and what you have ticked off — plus a record of lists you have made before, which is what lets Dave suggest from what you actually cook.
• Invites you send. Not the email address itself. When you invite someone, their address is scrambled into a fingerprint that cannot be turned back into an address, and only the fingerprint is stored — enough to show them the invite when they log in, and no use to anyone who got hold of the database. The invite is deleted when it is accepted or rejected, and expires after 30 days either way.
• A few preferences. Whether you have been shown the welcome screen, and how you like the shopping list laid out.
• Your timezone. The name of the timezone your browser reported when you signed up — “Europe/London”, for instance. It is recorded once, never updated, and used for one thing: sending the emails below at a reasonable hour where you are rather than where our servers are. It stays in our database and is not sent to anyone else.

There is no advertising here, no profiling, and nothing is sold or shared with anyone beyond the companies listed below that run the thing.

Recipes are shared with your account, not with the world

An account can have more than one person on it — that is the point of it. Anyone you share an account with can see and change every recipe and list on that account. Ingredient names are the one exception: they are pooled across everybody, so that “tin of chopped tomatoes” means the same thing for everyone. Your recipes are not.

Reading recipes, searching them, and Dave

When you import a recipe from a link, a photo, or pasted text, the contents are sent to OpenAI to be turned into ingredients and a method.

Dave sends more than you might assume, so it is worth being exact. To answer a question he can look up your recipes, read a whole recipe back — ingredients and method — and read the history of lists you have made. Whatever he looks up goes to OpenAI along with your messages. That is the feature working rather than a leak, but it means your recipes leave our systems when you chat to him, not just their names.

OpenAI processes it on our behalf and, on the API terms Big Shop uses, does not train on it.

Searching your recipes works slightly differently. Once you have typed three or more letters, the names of your recipes — only their names — and what you typed are sent to TypeSafe, which says which recipes are related to your search. That is how searching “curry” can find a Balti. Nothing else about your recipes, or about you, is sent.

Error reporting

Big Shop reports its own errors and performance to Grafana Cloud, and it is not something you are asked to consent to. We treat it as necessary to keep the service working, since an app that only reports errors for people who opted in is an app that does not know when it is broken. It is a deliberate choice rather than an oversight, and it is a contested one, so it is stated here rather than buried.

What it carries is limited on purpose: an account number, a login identifier, page names, timings, and error messages. It does not carry your recipes, your ingredients, your chats with Dave, or your email address. It is deleted after 14 days.

Analytics

Big Shop is not running any analytics at the moment. Nothing is counting what you do, and the only thing watching the app is the error reporting described above. The cookie banner asks anyway, because that is due to change and we would rather have your answer before anything starts than after. What follows is what your answer will mean.

Analytics is the one thing here you get a say over, and it is off until you say otherwise.

Decline and nothing loads. Not a reduced version, not a cookieless one, nothing at all — no script from Google is fetched and no request reaches them. That is stricter than the usual arrangement, where the tag loads for everyone and merely promises not to store anything.

Accept and Big Shop would useGoogle Analytics to count how the site is used: which pages get visited, and a short fixed list of actions like “a recipe was imported”. It is never told who you are. It gets a random identifier standing for your account, so that several visits from one household count as one household rather than several strangers — and it does not get your login identifier, your name, your email address, or the names of your recipes. Loading it does let Google see the usual things any website sees: your IP address, which page you came from, and what browser you are using. Advertising features are switched off permanently; Big Shop runs no ads.

You can change your mind whenever you like, using the Cookie settings link at the bottom of this page. Withdrawing stops the collection there and then — no further page is counted — and deletes the cookies Google has already set.

What deleting your account does here, precisely. That random identifier is the only thing tying Google’s copy of these counts to your account, and the table linking the two is kept here rather than by Google. When you delete your account, that link is destroyed. Being straight about the limits of that: it does not reach into Google and delete anything, and Google keeps its own cookie id and the rough location it works out from your IP address regardless. What it does mean is that nothing left in Google can be tied back to you or your account — by us or by anyone else.

What is stored on your device

All of it is needed for the site to work or to keep it working, none of it is used to track you anywhere else, and there is nothing here you are asked to consent to. Clearing your browser data for this site removes the lot.

Email we send you

When you sign up, you get four emails over your first fortnight: a welcome, some things the app does that are easy to miss, a few recipe ideas, and a note two weeks in asking how you are getting on. Then they stop. Everyone who signs up gets the same four — nothing watches what you do in the app to decide what to send you.

We send these without asking first, on the basis of legitimate interests, because they explain a service you actively signed up for rather than advertising anything. They will never carry a promotion, a referral offer or anyone else’s content — if that ever changed, we would have to ask your permission first, and we would.

Every one of them has an unsubscribe link, and it works immediately. Separately, we may email you about things you have done — an invitation to share an account, for example. Those are not marketing and cannot be unsubscribed from, though there are very few of them.

One thing worth knowing about unsubscribing. If you unsubscribe, or mark a message as spam, that decision is held by SendGrid, the company that sends our email — not by us. It is kept permanently and deliberately, so that it survives even if you later delete your Big Shop account and sign up again with the same address. It is the one piece of information about you we will not delete on request: deleting it would mean we could start emailing you again, which is the opposite of what you asked for.

We do not track whether you open these emails, and we do not rewrite the links in them to see what you click.

Who else processes it

Your recipes and lists live in Frankfurt. The parts that run in the United States are the website itself, the recipe-reading and chat endpoints, and invite emails; those transfers rely on each provider’s standard contractual clauses.

How long it is kept

Your account, recipes and lists are kept until you delete them. Error and performance data is not deleted on request — it expires on its own after 14 days, and that expiry is the mechanism rather than a promise to go and find it. Invites disappear when accepted or rejected, and any that are never answered are deleted once they expire, 30 days after they were sent — so nothing is held indefinitely for someone who never signed up.

Your rights, and how to use them

Under UK data protection law you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, or object to how it is used.

Deletion has a button. It is on your account page, and it deletes rather than deactivates: your login, your name and email address, your cookie choices, every invite you have sent or received, and — if the account is yours alone — the recipes, the shopping list and its history. The login record itself is removed from Auth0, so the account cannot be signed back into; signing up again would start a brand new, empty one.

If we have ever emailed you, we also ask SendGrid to erase what it holds about your address, and SendGrid removes recipient details after 37 days in any case. The one thing deliberately kept is a record that you unsubscribed or reported a message as spam, if you ever did: deleting that would let us lawfully email you again, which inverts the point of asking to be forgotten.

Everything else on that list is still done by hand, by email, and we would rather say so than imply a self-service flow that does not exist.

Email info@ianfeather.co.uk and it will be actioned. If you are not happy with the response you can complain to the Information Commissioner’s Office.

One honest complication, and it is worth reading before you press the button: an account can be shared, and recipes belong to the account rather than to you personally. If you are the only person on your account, deleting it takes the recipes and the shopping list with it. If you share it with someone else, they keep the recipes— including ones you added — and you are removed from the account. Either way everything about you goes: your login, your name, your email, your cookie choices and every invite in either direction. The page tells you which of the two will happen before you confirm.

Changes to this page

If something material changes — a new company processing your data, a new purpose — the version at the top changes, and we will make sure you are told rather than leaving you to notice. Smaller corrections and clarifications are made quietly and do not move it, because that version is what asks everyone the cookie question again: re-asking for a reworded sentence is how a consent prompt becomes something to click past without reading. So the date at the top is the date of the last material change, not of the last edit.