Who is responsible
The controller of your personal data is Ludovit Juhasz, trading as Thrive Nutrition, Postupimska 1, 04022 Kosice, Slovakia.
Questions or requests: thrivenutritionapp@proton.me.
The short version
- You can use search and the tables without giving us your name or email.
- Your favourites, plates, shopping list and language stay in your browser on your device. They aren’t sent to us.
- If you buy Plate, we keep your email address, the state of your subscription, and the recipes you save, so we can let you in.
- Stripe handles payments. We never see your card number.
Kept on your device
Thrive saves these in your browser’s local storage so the app remembers them between visits. They stay on your device and aren’t sent to us:
- favourites, plates and saved plates, and the shopping list;
- your language and shop country;
- small settings, such as whether you’ve seen the offline tip and how many visits that counts.
The app also keeps a copy of its own files on your device so the atlas works offline, and remembers your scroll position for the current visit. To remove all of this, clear this site’s data in your browser settings.
Kept by us if you buy Plate
We store a small record on Cloudflare (Workers KV), linked to your email address:
- your email address;
- your Stripe customer and subscription ids;
- your plan (yearly or monthly), its status, the end of the current paid period, and the date a cancellation takes effect;
- single-use sign-in tokens, stored only as a scrambled (hashed) value and deleted after 15 minutes;
- recipes you save: the name, the number of servings, an optional note, and each plant with its amount in grams.
To stop sign-in emails being abused, we also keep short-lived counters keyed by a hashed form of your IP address and email address. They expire within two hours.
When you sign in, we set one cookie, __Host-plate. It keeps you signed in on that device for 30 days, or until you sign out. It’s needed for Plate to work, so there’s no consent banner for it.
Who processes data for us
- Stripe takes payments and runs the customer portal. Stripe receives your card and billing details directly; see Stripe’s privacy notice.
- Resend sends sign-in emails (EU region). It receives your email address and the sign-in link.
- Cloudflare hosts the site and our Plate record, and protects it from attacks. Like any web host, it handles your IP address and browser details when you visit. We also use Cloudflare Web Analytics, which counts page visits without cookies.
- Google Fonts: the pages load their fonts from Google (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address and browser details to Google when it fetches them.
If you tap a shop link, you go to that shop’s own website, and its own privacy notice applies.
Why we use it (lawful basis)
- Contract: to sell you Plate, sign you in, give you access and handle cancellations and refunds.
- Legitimate interests: to keep the site secure, stop abuse, understand visits in aggregate, and load fonts and photos.
- Legal obligation: to keep payment and tax records where the law requires it.
How long we keep it
- Sign-in tokens: 15 minutes. Abuse counters: up to two hours. The sign-in cookie: 30 days, or until you sign out.
- Your Plate record: while your subscription is active, and for 12 months after it ends, so we can answer questions and handle refunds. Then we delete it. Recipes you save stay until you delete them.
- Payment and tax records: as long as tax and accounting law requires. Stripe keeps its own records under its notice.
Your rights
Under the UK GDPR and the EU GDPR you can ask to see the personal data we hold about you, correct it, delete it, limit how we use it, object to how we use it, or get a copy to take elsewhere. Email thrivenutritionapp@proton.me. We’ll reply within one month.
If you’re unhappy with how we handle your data, please tell us first. You can also complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in Slovakia, the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk); or the authority where you live in the EU.
Data outside the UK and EU
Stripe, Cloudflare and Google may process data outside the UK and the EU, including in the United States. Where they do, they rely on recognised safeguards, such as adequacy decisions (including the EU-US Data Privacy Framework and its UK extension) or standard contractual clauses.
Children
Thrive is a general food reference and isn’t aimed at children. Plate needs a payment card and is meant for adults. If you think a child has given us their email address, contact us and we’ll delete it.
Changes to this notice
If we change how we use your data, we’ll update this page and the date below. If the change matters for Plate customers, we’ll email you.