Privacy
Privacy Policy
Who we are
The Fern Basket ("the app", "we", "us") is a sole trader based in Aotearoa New Zealand. For any privacy question or to exercise your rights, contact us at support@thefernbasket.com. Our full registered name and postal address are available on request, and to any supervisory authority.
We are the data controller for the personal data described below.
The short version
The app works on your device by default. There are no analytics, no ads, and we never sell or share your data for marketing. You only get an account if you choose to sign in. Four features send data off your device when you use them: importing a recipe (from a link, text, a photo or a video), comparing prices, finding your store, and signing in. A fifth is your choice and off unless you turn it on: sharing what a shop cost, without your name or account, to improve the price estimates for everyone. You can export or delete everything at any time.
What we process, why, and our lawful basis
| Data | When | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Recipes you add, your basket, app settings | Always — stored on your device | Core functionality | Contract |
| The text or link of a recipe you import | When you import a recipe | Sent to our server and an AI provider to pull out the ingredients | Contract |
| Recipes you import from a link or video (the ingredient list we made from it) | Only if you're signed in | Kept for 14 days so importing the same link again is instant and doesn't count against your allowance | Contract |
| How many recipes and videos you imported this month | Only if you're signed in on the free plan | Holding the free plan to its monthly allowance | Contract |
| A photo you choose to import | Only when you pick "Photo" and select an image | Sent to our server and an AI provider to read the recipe in it | Contract |
| A YouTube link you paste | Only when you import from a video | Our server fetches that video's page from YouTube to read its title and description | Contract |
| Your basket items and locality | When you compare prices | Sent to our server and an AI provider to estimate store prices | Contract |
| What a shop cost (the total, the supermarket chain, the date, how many items) | Only if you enter it when you finish a shop | Shown back to you beside later price checks. Stored on your device only; not synced to your account | Contract |
| A shared shop total: the supermarket chain, the week, the total, our estimate for the same basket, and how many items it had | Only if you turn on "Share it anonymously" (or "Share shop totals" in Settings) and are signed in | Correcting price estimates against what people really paid. Stored without your account, name, suburb or the items you bought | Consent — off by default, withdrawable in one tap |
| Your precise location (GPS) | Not by the current app, which never asks for it. Builds made before 10 October 2026 had a "Use my location" button: only when you tapped it, after the OS permission prompt | Was sent to our server and on to OpenStreetMap to find the nearest Pak'nSave, Woolworths and New World | Consent (the OS prompt) |
| A suburb, postcode or store name you type | When you search for your store | Sent to our server and on to OpenStreetMap to find Pak'nSave, Woolworths and New World branches nearby | Contract |
| Email address | Only if you sign in | Creating and authenticating your account; syncing across devices | Contract |
| Recipes, the crates you sort them into, basket, settings (cloud copy) | Only if you sign in | Sync across your devices | Contract |
| Dietary preference (vegetarian, vegan, gluten-free or dairy-free) | Only if you set one | Pre-filling dietary adaptations | Explicit consent (Art. 9 — health-adjacent) |
| Consent records (what, when, and which policy version) | When you change a consent choice | Accountability | Legal obligation / legitimate interest |
| Marketing consent | Only if you turn on "Product news" | Sending occasional emails about new features | Consent — off by default, withdrawable in one tap |
| Subscription status and purchase token | Only if you buy Premium | Granting Premium; validating the purchase | Contract |
| A pseudonymous subscriber ID (via RevenueCat) | On every native-app launch, unconditionally | Running the subscription system, so entitlement checks work even before a purchase | Legitimate interest / contract |
| That subscriber ID linked to your account | When you sign in | So a purchase made on one device is recognised on another | Contract |
| Records of account deletions and exports | When you use those features | Proving we did what you asked, when | Legal obligation |
What we deliberately don't collect
No analytics, no advertising identifiers, no contacts, no device identifiers, no location from your phone, and no IP addresses or user agents in our own consent records. We ask for photo library / camera access only at the moment you use the feature that needs it, and declining leaves the rest of the app fully working: you can import recipes by link or text instead of by photo. We ask to show notifications only when you set a cooking timer or the weekly reminder, and the app works without them. (Builds made before 10 October 2026 could also ask for location, for "Use my location".)
Things that stay on your phone
Some data is deliberately never synced to your account, even when you're signed in:
- Dietary and allergy tags (halal, kosher, nut-free and so on). These can reveal religion or a medical condition, so they stay on the device.
- The specific store branch you picked, and your basket text size.
- What your shops cost, if you enter it. It is included in your data export and removed when you delete your data. Sharing a total is a separate choice, described above, and what is shared does not include who you are.
This is an architectural decision, not an accident. If it ever changes, this policy changes with it and we would ask for your explicit consent first.
Where price estimates come from
Store prices in the app are estimates made by an AI provider, not live shelf prices. Since version 2026-10-04 the estimate is guided by Stats NZ's monthly average retail prices for everyday foods. Estimates include Stats NZ's data, which are licensed by Stats NZ for reuse under the Creative Commons Attribution 4.0 International licence. Stats NZ receives nothing from the app.
A note on shopping lists
A basket can imply things you never typed — a religious observance, an allergy, a medical condition. We don't analyse baskets for anything beyond sorting them into aisles and estimating prices, and we don't build profiles. But it's more honest to say that a shopping list isn't neutral data than to pretend it is.
Who else processes your data
In summary — the parties below, what they handle, and where:
| Processor | What they handle | Purpose | Location |
|---|---|---|---|
| Supabase | Account email, synced recipes (with the crates they are sorted into)/basket/settings, consent records, and shared shop totals (stored without an account identifier); also creates your sign-in codes | Authentication and database | Sydney, Australia (ap-southeast-2) |
| Resend | Your email address and the sign-in email we send you, which contains the one-time code. No open or click tracking is enabled | Delivering sign-in codes | Tokyo, Japan |
| Google (Gemini) and/or Anthropic (Claude) | Recipe text, basket labels, locality, and any photo you import — transient, not stored by them, not used for training under their API terms | Recipe parsing, adaptations, price estimates | United States |
| OpenStreetMap (Overpass, Nominatim) | What you typed into the store search (a suburb, postcode or store name) and the coordinates of that place. From builds made before 10 October 2026, your own coordinates if you tapped "Use my location". No account identifier is attached | Finding nearby supermarkets | Europe, community-run |
| Google (YouTube) | The video URL you paste | Reading the video's description | United States |
| RevenueCat | Pseudonymous subscriber ID, purchase tokens | Subscription management | United States |
| Apple App Store / Google Play | Purchase and billing details — we never see your card | Payment processing | Per store |
| Render | Transient API request data | Running our backend | Singapore |
| Sentry (only if enabled) | Server error reports — no request bodies, emails or coordinates | Finding crashes | Per account region |
International transfers
Some of these are outside the EU/EEA, notably in the United States. Where that happens, transfers rely on the EU Standard Contractual Clauses and/or an adequacy mechanism such as the EU–US Data Privacy Framework where the processor is certified.
OpenStreetMap is the exception worth naming. It is a volunteer project with no company to contract with, so there is no formal data processing agreement or standard transfer clause. What reaches it is what you typed into the store search and the coordinates of that place, with nothing identifying attached.
How long we keep it
- On your device: until you delete it or uninstall the app.
- Cloud account data: while your account exists.
- After you delete your data: erased immediately across our systems; soft-deleted rows are purged within 30 days; provider backups age out on their own schedule (roughly 7–35 days).
- Recipes you import from a link or video, if you're signed in: 14 days, linked to your account, then deleted. Recipes you paste as text, and photos, are never kept.
- Import counts (free plan): the current month and the two before, then deleted.
- Price estimates: a basket's items and suburb with the estimate, not linked to you, deleted within a day.
- What a shop cost: on your device until you delete your data or uninstall the app. The app keeps the last 100.
- Shared shop totals: kept without a time limit. A shared total holds nothing that identifies you (no account, name, suburb, items or time finer than the week), which also means we cannot find yours again to delete it. Turning sharing off stops any more being sent.
- Store searches: what you typed, where that is, and the stores found around it (kept against a position rounded to about a kilometre). Not linked to you, deleted after 30 days.
- What AI and map providers receive: the provider's own API retention terms apply.
- Consent records: while your account exists, as proof of what was agreed; deleted with your account.
- Deletion records: kept as proof of what was erased. They deliberately survive the account and hold only an ID that no longer maps to a person.
- Security audit log: who accessed or deleted personal data, with values hashed rather than stored. Kept for 2 years.
- Never-verified and long-dormant accounts: the app supports automatically clearing these out, but that job is currently switched off, so no automatic deletion period applies to them yet.
Your rights
You can access, correct, erase, restrict, port and object to the processing of your data, and withdraw consent at any time. Under the NZ Privacy Act 2020 you have equivalent rights of access and correction (IPPs 6 and 7); Australian users have them under APPs 12 and 13.
In the app:
- Access / portability: Settings → Export my data. Gives you readable JSON with two parts: what's on this device, and what's in your account — including your consent history and any deletion requests.
- Erasure: Settings → Data & privacy → Delete my account and data ("Delete my data" if you're not signed in). Wipes the device and, if you're signed in, deletes your account and your RevenueCat subscriber record. Deleting doesn't cancel a Premium subscription: cancel it in the App Store or Google Play too.
- Erasure without the app: email support@thefernbasket.com from the address you signed in with, and we'll delete your account within 30 days. See Delete your account.
- Correction: edit anything directly in the app.
- Withdraw consent: sign out to stop sync; clear your dietary default; turn off "Product news"; turn off "Share shop totals" in Settings; revoke photo access in your phone's settings at any time.
We'll respond to any request sent to support@thefernbasket.com within 30 days.
If you're unhappy with how we've handled your data you can complain to your local authority: in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz); in Australia, the OAIC; in the EU/EEA, your national supervisory authority.
Children
You must be at least 16 to use The Fern Basket. The app isn't directed at children under 16, and we don't knowingly collect their data.
Security
Everything is encrypted in transit (HTTPS/TLS). Access to cloud data is enforced per-user by database row-level security, so one account can never read another's rows. There are no passwords to leak — sign-in is a one-time code by email. Secret keys live only on our server, never in the app. Actions taken on personal data are recorded in an append-only audit log.
Changes to this policy
We'll update this page and the version stamp at the top when our practices change, and surface material changes in the app. Because every consent is recorded against a policy version, we can always tell what you agreed to.
Contact
The Fern Basket — support@thefernbasket.com — Aotearoa New Zealand. Full registered name and postal address on request.