← Back to home

Privacy Policy

Last updated: 18 July 2026

1. Introduction

Crumbify ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our mobile application ("the App") and website at crumbify.co.uk ("the Site"). Crumbify is operated by Crumbify LTD, a company registered in England and Wales (company number 17288992), registered office 60 Millmead Business Centre, Millmead Road, London, United Kingdom, N17 9QU. Crumbify LTD is the data controller for personal data processed through the Crumbify app and this website.

2. Information We Collect

When you use Crumbify, we may collect:

  • Account information: Name, email address, username, and profile photo when you create an account via Apple Sign In, Google Sign In, or email OTP. Sign in with Apple or Google is used to authenticate you only, it does not give us access to your Apple or Google account data.
  • Restaurants you add: When you share a TikTok or Instagram post into Crumbify, paste in a Google Maps list link, or search and add a place manually, we store the restaurant, your been-to and want-to-try status, and any score or note you attach. Crumbify does not connect to delivery-platform accounts or APIs, and it does not read your order history from screenshots.
  • Reviews and private notes: Scores out of 10 and personal notes you write about places you have been to.
  • Profile photo: If you upload an avatar, it is automatically scanned by Google Vision SafeSearch to detect inappropriate content before being stored.
  • Posts and photos: When you post about a place to your profile wall or the home feed, with an optional photo, we store it and run automated safety screening (Google Vision SafeSearch) before it is shown to others.
  • Social activity: Reactions and comments on posts, friend connections and requests, groups you create or join and their shared lists and shared photos, direct messages you send, and leaderboard participation.
  • Location: With your permission, we use your device location to power the Discover map and to help you find and add nearby places via Google Places.
  • Advertising identifiers: We show ads via Google AdMob and, with your consent, use your device advertising identifier to personalise them. You can decline via the in-app consent prompt and, on iOS, the App Tracking Transparency prompt.
  • Usage analytics: Device and usage analytics about screens visited and features used in the App, and anonymous performance metrics collected via Vercel Speed Insights on the website.
  • Founding-member checkout: If you buy a founding-member place through the website, Stripe processes the payment and we store your email address to grant the tier to your account. We never see or store your card details.
  • Referral link visits: See section 9 below.

3. What We Do NOT Collect

  • We never access, store, or see your delivery-platform or other third-party account passwords.
  • We do not connect to delivery-platform accounts or APIs, and we do not read order history from screenshots. Places are added by sharing a TikTok or Instagram post into the app, pasting a Google Maps list link, or manual search.
  • We never share your personal data with third parties for their own marketing purposes.
  • We do not sell your data to advertisers or data brokers.
  • We do not show spend, price, or currency figures anywhere in the App or Site.

4. How We Use Your Information

  • Run the home feed: showing friends' posts, reactions, comments, and leaderboards.
  • Power Discover: the map, nearby places, and taste-matched recommendations.
  • Maintain your Reviews history: been-to places, want-to-try lists, scores, and private notes.
  • Enable Social features: friends, groups, shared lists, shared photos, and direct messages.
  • Run your Profile wall: posts, achievements, and tiers, and the monthly Challenge.
  • Moderate uploaded content (avatars, post photos) for safety.
  • Process reports submitted by users about inappropriate content or behaviour.
  • Show relevant ads to free-tier users via Google AdMob.
  • Grant and manage Crumbify Premium and founding-member access.
  • Measure referral-link effectiveness (see section 9).
  • Improve and maintain the App and Site.

5. Data Storage and Security

Cloud data is stored with Supabase, using row-level security (RLS) policies that enforce per-user data isolation. All API communication uses HTTPS with TLS.

  • Auth tokens are stored on-device only using secure storage.
  • Passwords are never stored - authentication uses Apple/Google Sign In or email OTP.
  • Avatar and post-photo moderation logs are automatically deleted after 30 days.
  • Account deletion removes your cloud data as described on our delete-account page.

6. Third-Party Services

  • Supabase: Cloud database, authentication, and storage provider for the App and website.
  • Google Places: Used to search for and fetch restaurant details (photos, ratings, addresses) when you add a place or use Discover.
  • Google Vision API: SafeSearch moderation for uploaded avatar images and post photos.
  • RevenueCat: Manages Crumbify Premium subscriptions. Receives your anonymous user ID only.
  • Google AdMob: Displays ads to free-tier users. May use device identifiers for ad personalisation. You can decline via the in-app consent prompt, or opt out via your device settings. Premium users see no ads.
  • Stripe: Processes founding-member payments on the website only. We never see or store your card details.
  • Sentry: Error monitoring for the App and website, to help us find and fix bugs.
  • Vercel: Hosts the website and collects anonymous performance metrics via Speed Insights.

7. Social Features and Visibility

Crumbify includes social features with the following visibility controls:

  • You can set your profile to private, hiding your posts and reviews from non-friends.
  • Friend requests require mutual acceptance.
  • You can block or report any user. Blocked users cannot see your profile or send requests.
  • Group membership and shared group content are visible to other group members only.
  • Direct messages are visible only to the people in the conversation.
  • You can unfriend, leave groups, or delete your account at any time.

8. Content Moderation

Uploaded avatars and post photos are automatically scanned using Google Vision SafeSearch. Images flagged as containing adult, violent, or racy content are rejected. Users can report other users or content, which is reviewed and actioned. Moderation logs are retained for 30 days, then automatically deleted.

9. Referral Link Tracking

Some creators share tracking links in the form crumbify.co.uk/referral?code=CODE. When someone visits such a link, we record the referral code and the visitor's device platform (iOS, Android, or other), and store a salted SHA-256 hash of the visitor's IP address before redirecting them to the relevant app store. The raw IP address is never stored, only the hash, and only one record is kept per unique visitor per code. We use this solely to measure how many people a creator's link brings in, on the basis of our legitimate interest in measuring marketing effectiveness.

10. Advertising

Free-tier users see ads via Google AdMob. AdMob may use device identifiers for ad personalisation. You can decline personalised ads via the in-app consent prompt shown on first launch and via your device privacy settings at any time. Premium users see no ads.

11. GDPR and Your Rights

Under GDPR and UK data protection law, you have the right to:

  • Access all data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and all associated data.
  • Object to processing of your data.
  • Withdraw consent for optional data collection at any time.

To exercise any of these rights, use the in-app account settings or contact us at the email below.

12. Data Retention

  • Account data is retained until you delete your account.
  • Avatar and post-photo moderation logs: 30 days.
  • Waitlist signups: the email waitlist form has been removed from the website, but emails collected while it was live may still be retained for launch notifications; contact us if you would like one removed.
  • Referral-link records: kept as an IP hash with no way to reverse it to an address, retained for as long as we need it to measure referral performance.
  • When you delete your account, your cloud data is removed as described on our delete-account page.

13. Children's Privacy

Crumbify is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we discover that a child under 16 has provided us with personal information, we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes via in-app notification or email. Your continued use of the App after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, contact us at support@crumbify.co.uk.