Privacy Policy

1. Who we are

NourishShape is the controller responsible for personal information processed through nourishshape.co.uk. References to “NourishShape”, “we”, “us” or “our” mean the operator of the NourishShape service.

Privacy enquiries and requests can be sent to privacy@nourishshape.co.uk.

2. Information we collect

Depending on how you use the service, we may collect:

• Account details: display name, username, email address, securely derived password data and account creation information.
• Google sign-in details: your Google account identifier, verified email address and display name when you choose Google authentication. We do not receive your Google password.
• Profile and wellness details: age, sex selection, height, weight, eating style, meal rhythm, disliked ingredients, activity level, fitness goal, planned workouts and calorie target.
• Daily records: meals, ingredient changes, water intake, steps, weight entries and meal completion.
• Your content: meals, ingredients, calorie values, cooking instructions, uploaded or imported plans and notes you add.
• Notification details: reminder choices, scheduled times, timezone and an encrypted device push-subscription address when you enable phone notifications.
• Security and technical data: session identifiers, login-attempt records, IP address used for security controls, request information and essential server logs.
• Device preferences: chosen language and light or dark theme, stored locally on your device.

3. How we use information

We use information to:

• create and protect your account;
• provide personalised meal, ingredient, hydration, activity and progress features;
• calculate general wellness estimates such as calorie guidance and BMI;
• save your preferences and records across signed-in devices;
• operate, maintain, troubleshoot and secure the service;
• prevent abuse, unauthorised access and excessive login attempts;
• respond to questions, rights requests or legal obligations; and
• improve reliability and accessibility using aggregated or de-identified observations where appropriate.

We do not use your wellness information for advertising, and we do not sell personal information.

4. Our lawful bases

We rely on the following UK data protection bases, depending on the activity:

• Contract: processing needed to provide the account and features you request.
• Legitimate interests: operating, securing and improving NourishShape, where those interests are not overridden by your rights.
• Legal obligation: where we must retain, disclose or otherwise process information to comply with law.
• Consent: where you choose to provide health-related information for personalisation, and where consent is required for special-category data or optional technologies. You can withdraw consent, although this may stop the affected personalised features from working.

Entering body, activity or health-related information is optional. You can use account features without completing every profile field, but recommendations may be less personalised.

5. Personalisation and automated calculations

NourishShape uses the details you provide to calculate general estimates and tailor meal suggestions, targets and trend summaries. These calculations do not make legal or similarly significant decisions about you. They are not medical diagnoses and should not be used as the sole basis for health or treatment decisions.

If you enable phone reminders, we use your chosen schedule and timezone to send the service prompts you request. Delivery uses the push service operated by your browser or device provider. Notifications use generic wording and do not show weight, BMI or other personal figures on your lock screen. You can turn reminders off from the dashboard or your device settings.

6. Cookies and local storage

We use strictly necessary cookies for secure sessions, login and Google OAuth protection. These include an account session cookie and short-lived state and verifier cookies during Google sign-in. We also use local browser storage for language and theme preferences. We do not currently use advertising cookies or third-party behavioural analytics.

7. Sharing and service providers

We disclose information only where needed to run the service, comply with law, protect rights and security, or complete an action you request. Relevant recipients may include:

• our VPS and infrastructure providers, which host the application and database;
• Google, when you choose Google sign-in, and the push service operated by your browser or device provider when you enable reminders, under their respective privacy terms;
• professional advisers, regulators, courts or law-enforcement bodies where legally required; and
• a successor organisation if the service is reorganised, sold or transferred, subject to appropriate protections.

8. International transfers

Some providers, including Google, may process information outside the United Kingdom. Where required, transfers must be protected using an applicable adequacy regulation, approved contractual safeguards or another lawful transfer mechanism.

9. Retention

We keep account and wellness information while your account remains active and as needed to provide the service. Security logs and login-attempt records are kept only as long as reasonably needed for protection and troubleshooting. Deleted data may remain temporarily in restricted backups until those backups rotate. We may retain limited information longer where required by law, to resolve disputes or protect legal rights.

10. Security

We use measures designed to protect information, including HTTPS encryption, restricted server access, password hashing, secure session cookies, login throttling and access controls. No internet service can guarantee absolute security. Keep your password confidential, use a unique password and tell us promptly if you suspect unauthorised access.

11. Your rights

Subject to applicable law, you may have rights to access, correct, erase, restrict or receive a copy of your information, and to object to certain processing. Where processing relies on consent, you may withdraw it at any time. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

Your right to object: you may object to processing based on our legitimate interests. We will stop unless we demonstrate compelling legitimate grounds or the processing is needed for legal claims.

12. Children

NourishShape is intended for people aged 18 and over. We do not knowingly offer accounts to children or intentionally collect children’s health-related information.

13. Changes to this policy

We may update this policy when the service, providers or legal requirements change. We will publish the revised version and update the date above. Material changes may also be brought to account holders’ attention within the service.

14. Contact

For privacy questions or rights requests, email privacy@nourishshape.co.uk. We may need to verify your identity before acting on a request.