Privacy Policy

Effective date: July 2026

Last updated: September 2026

1. Introduction

This Privacy Policy describes how DECODED.IO LIMITED ("RustleUp", "we", "us", "our") collects, uses, stores, and shares information about you when you use the RustleUp mobile applications (iOS and Android), the read-only web viewer at app.rustleup.xyz, and any related services (together, the "Service").

By creating an account and using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

We are based in the United Kingdom. The Service is operated globally, but data is processed primarily in the United States (see Section 9 on international transfers).

2. Data we collect

We collect only what we need to run the Service. The table below summarises every category, why we collect it, and where it is stored.

Account information

You can sign in by email magic-link, Google Sign-In, or Apple Sign-In. We do not collect or store passwords ourselves — authentication is handled by Supabase Auth on our behalf.

Profile information

User-generated content

Usage and analytics data

We use PostHog (see Section 4) to capture a defined set of product-analytics events. The complete list of events we capture, and the properties attached to each, is documented internally in our event taxonomy (ADR-038). The high-level summary:

• Authentication events (sign-in, sign-out)
• Recipe actions (saved, cooked, shared, planned)
• Shopping actions (item added, item purchased)
• Pantry actions (item added)
• Collection actions (collection created)
• Subscription events (paywall shown, purchase initiated, purchase succeeded, purchase failed, subscription restored)
• Invite events (invite link copied, shared, resolved)
• Recipe view events on the web viewer
• Diagnostic events (e.g., when local sync recovers from an offline period, or when local-database encryption needs to be re-initialised)
• Screen views (which screens you visit; we capture the screen's logical name, not URLs that contain identifiers)
• Feature-flag evaluations (which experimental features you see)

Every event we capture is also tagged with:

• The app version you are running
• The environment (development, staging, or production)
• A pseudonymous device identifier assigned by PostHog (not your account ID, and reset on sign-out)
• A session identifier (PostHog-generated, reset between sessions)
• Coarse device information (operating system, device type, screen density) auto-captured by the PostHog SDK

What we deliberately do NOT capture as analytics properties (this is enforced in code at the point of capture):

• Email address (other than as a person-profile attribute — see below)
• Recipe text, ingredient text, instruction text, or notes
• Chat messages
• Search queries
• Feedback content
• Any free-text you type

If you have a paid subscription, the type of subscription (monthly or annual) is captured at purchase time so we can analyse conversion. Your payment card details are never captured (see Section 4).

Person-profile attributes

Tied to your account, not to individual events, we attach: email, display name, current subscription tier (free or premium), and language. These are used to enable filtered analytics (e.g., "how many premium users used the chat feature this week") without exposing individual events to PII.

Diagnostic and crash data

We use Sentry (see Section 4) to capture application crashes and unhandled errors. Sentry receives:

• The stack trace of the crash
• Your device's operating system, OS version, and CPU architecture
• The app version
• A breadcrumb trail of the last few actions you took before the crash (e.g., "opened recipe screen", "tapped save") — these breadcrumbs do not contain free-text or PII
• Your pseudonymous Sentry user identifier (tied to your account ID so we can correlate crashes per user)

Sentry retains crash reports for approximately 90 days by default.

Subscription and payment data

If you subscribe to RustleUp Premium, payment is processed entirely by Apple (App Store) or Google (Play Store). We do not collect, store, or have access to your payment card or bank account details. RevenueCat (see Section 4) acts as our subscription-management layer: it receives a receipt from the store, validates it, and tells our backend whether your subscription is active. Your purchase receipt and entitlement state (premium / free, expiry date) are stored on our servers; payment instruments are not.

Device and install attribution

We use Branch.io (see Section 4) to attribute deep links and share links. Branch may collect a pseudonymous device identifier and limited install-attribution data (e.g., that you tapped a particular share link before installing) so that we can deliver the right recipe context when you first open the app. We do not use Branch for advertising attribution.

We also rely on PostHog's anonymous device identifier ($device_id) for analytics. This is generated by the PostHog SDK on first launch and is reset when you sign out.

Photos and camera

If you use the "scan a recipe from a photo" feature, the photo you select is uploaded to our backend and processed by an AI extraction service (currently routed through OpenRouter to OpenAI / Anthropic / Google models — see Section 4). The original photo is stored on our backend with your request history and is retained after extraction completes (see Section 5; the AI provider may also retain the request under its own policy — see Section 3). Extracted recipe text is then saved as part of your recipe library (see "User-generated content" above).

If you grant camera access for QR-code scanning or photo capture, photos are processed in-memory on your device unless you explicitly choose to use them in a feature that uploads to our backend.

Cookies and web storage

The mobile apps do not use cookies (cookies are a browser concept).

The web viewer at app.rustleup.xyz uses one PostHog analytics cookie (typically named _ph or similar) to maintain a session identifier across pages. No other cookies are set by us. The web viewer is read-only and does not support sign-in, so it does not store authentication tokens.

3. How we use your information

We use the information we collect to:

• Provide the Service: authenticate you, sync your data across your devices, generate shopping lists, run AI recipe extraction and chat
• Improve the Service: understand which features are used, identify bugs, prioritise development
• Communicate with you: send sign-in links by email, send important Service notices
• Protect the Service: detect and prevent abuse, fraud, and violations of our Terms
• Comply with legal obligations

We do not sell your personal information, and we do not use your content to train our own models. AI model requests (recipe extraction, generation, and chat) are sent per request through OpenRouter, and our OpenRouter account is configured to exclude providers that train on submitted inputs. That is an account-level routing configuration we control — not a warranty about any individual model provider's internal practices, which OpenRouter's terms expressly disclaim. Separately, short ingredient-name text derived from recipes (names and synonyms only — never photos, chat, or personal data) is sent directly to OpenAI to compute search embeddings; under OpenAI's API terms, API content is not used to train their models by default. We do not currently have a zero-retention arrangement in place with either, so a provider may retain request data under its own policy (see Section 4).

4. Third-party processors

We rely on the following processors to operate the Service. Each is engaged under terms requiring them to handle your data only for the purposes we direct (the App Store and Play Store rows below act under their own terms). Where a processor routes requests on to sub-processors — see the AI row below — those terms bind our direct counterparty, not every downstream provider.

The full list of integrations is also documented in our internal architecture decision records. We will update this Policy if we add, remove, or materially change a processor.

We do not currently use a transactional email provider, push-notification provider, or third-party moderation tool. If we add one in the future, we will update this list before the integration goes live.

5. Data retention

• Account data (email, profile, recipes, plans, shopping lists, pantry, collections, ratings, notes): retained for as long as your account is active. If you delete your account, we delete this data within 30 days, except for the recipes described in the next item and where we are required by law to retain certain records.
• Recipes you added: when you delete your account, what happens to each recipe you added depends on how you added it. A recipe you added from a web link or a social-media post is kept, with your identity removed from it, because it comes from a publicly available source. A recipe you added any other way (from a photo or scan, from pasted text, generated by AI, or saved from the recipe chat) is deleted with your account, together with its images, unless another user has saved it or added it to one of their collections; in that case it is kept for them, with your identity removed from it. A recipe whose origin we cannot determine is also kept, with your identity removed from it. This happens automatically when you delete your account; there is no extra step for you to take.
• Chat conversations: stored on our servers for the lifetime of your account so you can resume them. We may add automatic expiry (e.g., 7 days for unused conversations) in a future release; if we do, you will be notified.
• Uploaded scan photos: photos you submit for recipe extraction are stored with your request history and are currently retained after extraction completes. We may add automatic cleanup of processed photos in a future release; if we do, you will be notified.
• Analytics events (PostHog): retained according to PostHog's default retention policy, currently up to 7 years for our plan tier. We may shorten this in the future.
• Crash reports (Sentry): retained for approximately 90 days by default.
• Subscription records: retained for the lifetime of your account, plus any period required for tax, accounting, or fraud-prevention purposes.
• Backups: routine backups of our database are retained on a rolling 30-day window. Deleted account data is removed from backups within that window.

You can request immediate deletion of your account at any time — see Section 6.

6. Your rights

Depending on where you live, you have the following rights over your personal information.

EU / UK (GDPR / UK GDPR)

• Access: ask for a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Deletion ("right to be forgotten"): ask us to delete your account and associated data
• Portability: ask for your data in a machine-readable format
• Restriction: ask us to limit how we process your data
• Objection: object to processing based on our legitimate interests (analytics, fraud prevention)
• Withdraw consent: where we rely on consent, you can withdraw it
• Complaint: lodge a complaint with your local data-protection authority (in the UK, the ICO at ico.org.uk)

California (CCPA / CPRA)

• Right to know what categories of information we collect, why, and to whom we disclose it
• Right to delete personal information we hold about you
• Right to correct inaccurate personal information
• Right to opt-out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of, but we provide this notice for completeness
• Right to non-discrimination — exercising your rights will not affect the price or quality of the Service

How to exercise your rights

Email us at [email protected]. We will respond within 30 days (or longer if permitted by law for complex requests).

You can also delete your account directly from within the app: Account → Settings → Delete Account. If you cannot access the in-app flow for any reason, email us at the address above and we will process the deletion on your behalf. What happens to the recipes you added is described in Section 5.

7. Children's privacy

The Service is not directed at children under the age of 13 (or under 16 in the European Economic Area and the United Kingdom). You must self-attest that you are at least 13 (or 16 in the EU/UK) when you create an account.

If we learn that we have collected personal information from a child under the applicable age without verified parental consent, we will delete it as quickly as possible. If you believe a child has provided us with personal information, please contact us at the email address in Section 6.

8. Security

We protect your data through a combination of technical and organisational measures:

• Encryption in transit: all communication between the app, our backend, and our processors uses TLS 1.2 or higher.
• Encryption at rest on your device: the local copy of your data (recipes, plans, etc.) on your phone is encrypted using AES-256 (via the sqlite3mc cipher). The encryption key is generated on your device and stored in your platform's secure hardware-backed storage (iOS Keychain / Android Keystore).
• Encryption at rest on our servers: handled by our database providers (Supabase, PostHog, Sentry).
• Authentication: managed by Supabase Auth, with support for email magic-links, Google Sign-In, and Apple Sign-In (which include their own security guarantees such as two-factor authentication on the underlying account).
• Least privilege: only the engineers and operators who need access to production systems have it, and access is logged.

No system is perfectly secure. If you suspect your account has been compromised, contact us immediately at the address in Section 6.

9. International data transfers

We are based in the United Kingdom, but your personal data is processed mainly in the United States. That covers our database, sign-in and file storage (Supabase), backend hosting (Google Cloud), product analytics (PostHog), crash reporting (Sentry), backend and AI observability (Pydantic Logfire, Langfuse), subscription management (RevenueCat), link attribution (Branch.io), and AI processing (OpenRouter and the model providers it routes to, OpenAI for ingredient-name embeddings, and fal.ai for images). Our sync service (PowerSync) runs in the European Economic Area (Ireland), and Cloudflare serves content from its global edge network. Section 4 lists each processor and where it processes data.

For users in the United Kingdom, the European Economic Area and Switzerland, transfers to the United States are covered by each processor's data-processing agreement with us. Depending on the processor, that agreement relies on the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework) where the processor is certified, or otherwise on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. Transfers from the UK to the European Economic Area rely on the UK's adequacy regulations. You can ask for more information about these safeguards at [email protected].

10. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or applicable law. Material changes will be notified to you by in-app notice and/or email before they take effect. The effective date at the top of this Policy reflects the most recent change.

Continuing to use the Service after a change takes effect means you accept the updated Policy. If you do not accept it, you can delete your account at any time.

11. Contact us

For privacy questions, data-subject requests, or any other matters covered by this Policy:

• Email: [email protected]
• Postal address: DECODED.IO LIMITED, 39 Ludgate Hill, London, EC4M 7JN, United Kingdom