Privacy Policy

This Privacy Policy explains how TrustCrumb (“TrustCrumb”, “we”, “us”) handles your personal information when you use the TrustCrumb app and website (the “Service”). We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We have tried to write it plainly.

1. Information we collect

• Selection & allergy settings: what you avoid and your strictness preference, so we can produce your verdicts.
• Your check results: the product name and the verdict we produced, so you can look back at recent checks without checking again.
• Your diary entries: what you had, how you felt afterwards, and any note you write, so the app can show you what sits well with you.
• Your shopping list: the items on it, which ones you have ticked off, and the recipes it was built from, so it is still there when you open the app again or on another phone.
• Account details: such as your name or email, if you create an account, and the country and shop you pick so the items you browse match where you shop.

2. What we do not keep

• Barcodes: when you scan a barcode we use it to look the product up, then discard it. We do not store the barcodes of products you check.
• Label photos: a photo of a label is read on your device. Only the text your device extracts is sent to us to run the check; the image itself never leaves your device and is never uploaded to or stored by us.
• Analytics, crash reports and tracking: there are none. The app and the website contain no analytics, crash-reporting or advertising software, so we do not collect your app version, the screens you open, or any advertising identifier, and nothing you do is tracked across other apps or websites.

3. How we use your information

• To check foods against what you avoid and show a verdict per selection.
• To provide recipes, meal plans, and shopping lists tailored to your preferences.
• To maintain, secure, troubleshoot, and improve the Service.
• To respond to you when you contact us.

We do not sell your personal information, and we do not use your selection or allergy data for advertising.

4. Consent

We rely on your consent to collect and handle your health-related food data, given when you set up your selections. You can withdraw consent at any time by deleting your account, which stops future processing.

5. Disclosure and overseas storage

We share personal information only with service providers who help us run the Service (our hosting, our database host and our email delivery provider), under contracts or terms that require them to protect it, or where the law requires it. Some of these providers, including our database host, store and process data on servers located outside Australia (currently in the European Union). We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs. If our business is transferred, information may pass to the new owner under this Policy.

One further provider sits outside that European hosting. When you save a recipe, the words you wrote and any photo you added are sent to OpenAI to be screened for unsuitable content, so that what reaches other members is safe. This happens whether or not you share the recipe. OpenAI is based in the United States, so that content is processed there. Nothing else is sent to OpenAI: your selections, your allergies, your checks and your diary stay with our own hosting.

6. User-generated content

Recipes, photos, and other content you upload are handled under our Terms & Conditions. You are responsible for what you upload, and you should not include other people’s personal information in it without their consent.

To keep shared content safe, recipes and photos are screened by automated checks, including the OpenAI screening described in section 5, before they are shared. If you report a recipe, we record your report, including the reason and any note you add, and keep it to review the content and act on it.

7. Security

We use reasonable technical and organisational measures to protect your information, including encryption in transit and hashed passwords. No system is perfectly secure, so we cannot guarantee absolute security.

8. Access, correction, and retention

You may ask us to access or correct the personal information we hold about you, as provided by the APPs. We keep your information for as long as your account is active or as needed to provide the Service, unless we must keep it longer to meet a legal obligation.

What happens when you delete your account. You can delete your account at any time in the app. We do not erase everything, so it is worth being plain about what goes and what stays.

Deleted or destroyed:

• Your email address, your name, your password, and your two-factor secret and recovery codes. Your account row is kept but emptied: the name becomes “DELETED_ACCOUNT” and the address is replaced with an unreachable placeholder that can never be signed in to, which also frees your old address to register again.
• Your sessions and any sign-in or verification links, so no one can get back in.
• Your country and the place you set, and every free-text note you wrote (diary notes and notes on the things you avoid), because a note can say anything.
• Your shopping list, including everything you added to it by hand.

Kept:

• The checks you ran and their verdicts, your diary entries (what you had and how you felt), the selections and allergies behind them, any recipe you shared, and the items you marked as safe. We keep these to understand how foods and labels behave across everyone who uses the Service, and to see which selections and allergies need more work.

To be plain about what that means: these kept records no longer carry your name, address or any note you wrote, but they are still joined to the same internal account number, so they are pseudonymous rather than fully anonymous: records belonging to one former account can still be told apart from another’s. We do not use them to contact you or to re-identify you, and the information needed to do that is gone. If you have a question about these records, or would rather they were removed too, reach us through the contact form.

9. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their personal information. If you believe someone under that age has given us their information, contact us and we will delete it.

10. Complaints

If you have a concern about how we handle your personal information, contact us first (below) and we will try to resolve it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Changes & contact

We may update this Policy from time to time; the “last updated” date shows the current version. Questions about your privacy? Reach us through our contact form.