RecalldRecalld
Privacy Policy
About this policy
This policy explains what personal information the Recalld app collects, why, who it is shared with and the rights you have. It applies to the Recalld mobile app for iOS and Android.
Effective date: 1 November 2026
Who we are: Recalld is provided by James Aston ("we", "us"), of Recalld, First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW. We are the data controller for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: hello@recalld.co.uk. We aim to reply within 5 working days, and will respond to rights requests within one month.
ICO registration number: [ICO registration number – to follow]
What Recalld does: Recalld shows UK food recall and allergy alerts published by the Food Standards Agency (FSA) and highlights the ones that match the allergens and supermarkets you choose. Recall information comes from the FSA's public data, used under the Open Government Licence. We do not send any of your information to the FSA.
Important: Recalld helps you stay informed but is not a medical service and cannot guarantee every alert reaches you in time. Always read product labels and follow official FSA guidance.
Information we collect
We collect only what Recalld needs to work, plus limited device data used for advertising and security.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Email address, display name, a unique user ID, account creation date. With Google sign-in, also your Google profile name and photo link. | You, or Google when you choose Google sign-in |
| Login credentials | Your password is handled by Google Firebase Authentication and stored in hashed form. We never see it. | You |
| Allergy profile | The allergens you select (for example peanuts, milk, gluten) | You |
| Preferences | Chosen supermarkets, notification settings (push alerts on/off, allergy alerts only), whether you finished setup, light or dark mode | You |
| Saved recalls | Recalls you bookmark, including the recall details and the date you saved them | You |
| Notification token | A device token that lets us send push alerts, only if you turn notifications on | Your device |
| Device and advertising data | Advertising ID, IP address, device model, operating system, app version, ad interactions | Your device, collected by Google AdMob and Firebase |
| Messages to us | Anything you send when you contact us | You |
We do not collect your location, contacts, photos, payment details or health information beyond the allergens you choose to enter.
Your allergy information
We process your allergy profile only with your explicit consent, because the law treats allergy information as health data ("special category data" under Article 9 UK GDPR).
- How we ask: before your allergy profile is first saved, you tick an unticked box that says: "I agree to Recalld storing the allergens I select so it can show me relevant recall alerts. I can change or delete them at any time. See the Privacy Policy." We record that you agreed and when. Your allergens are not saved unless you tick it, and you can skip this step and select no allergens at all.
- What we use it for: only to match recalls to your allergens, highlight them in your feed and, if you turn them on, send you relevant alerts.
- What we never do: we never use your allergy profile for advertising, never share it with advertisers, never sell it and never use it to make decisions about you that have legal or similarly significant effects.
- Who can see it: only you, through your account. Our database rules block other users from reading it.
- Changing your mind: you can edit or clear your allergens at any time in Settings, or withdraw consent by deleting your account. Withdrawing consent does not affect processing that happened before.
- Someone else's allergies: if you add allergens on behalf of a family member, please only do so with their agreement, or as their parent or guardian. Do not enter their name or other identifying details.
How we use your information
Each use of your information has a lawful basis under Article 6 UK GDPR, and allergy data also has an Article 9 condition.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Create and run your account, let you sign in | Account details, login credentials | Contract: needed to provide the app you signed up for |
| Show recalls that match your allergens | Allergy profile | Explicit consent (Article 6(1)(a) and Article 9(2)(a)) |
| Highlight recalls from your supermarkets, apply your settings | Preferences | Contract |
| Keep your saved recalls | Saved recalls | Contract |
| Send push alerts | Notification token, allergy profile, preferences | Consent: you turn notifications on, and can turn them off in Settings or your phone's settings |
| Show personalised ads | Device and advertising data | Consent, collected through the consent message shown on first launch |
| Show non-personalised ads, measure ads, prevent ad fraud | Device and advertising data | Legitimate interests: funding a free app. Consent where the law requires it for storing or reading data on your device |
| Keep the app and accounts secure, fix faults | Account details, device data | Legitimate interests: protecting you and the service |
| Reply to you | Messages to us, email address | Legitimate interests: answering your query |
| Meet legal obligations, handle disputes | Any relevant information | Legal obligation, or legitimate interests in defending legal claims |
Where we rely on legitimate interests, we have checked that our interests are not outweighed by yours. You can object at any time (see "Your rights").
Advertising and device identifiers
Recalld is free and shows ads through Google AdMob, and you choose whether those ads are personalised.
- Your choice: on first launch, a consent message from Google lets you accept or decline personalised ads. If you decline, you still see ads, but they are based on general context, not your profile. You can change your choice at any time in Settings > Privacy choices.
- What AdMob uses: your advertising ID, IP address and device information. Google is an independent controller for some of this data. See how Google uses information from apps that use its services at policies.google.com/technologies/partner-sites.
- iPhone users: we only access your device's advertising ID if you allow tracking when iOS asks. You can change this in Settings > Privacy & Security > Tracking.
- Android users: you can reset or delete your advertising ID in your device's Google or Privacy settings.
- What ads never use: your allergy profile, saved recalls and supermarket choices are never passed to AdMob.
Who we share it with
We do not sell your personal information. We share it only with the service providers below, who act on our instructions under written data processing terms, plus Google as an independent controller for advertising.
| Recipient | Role | What they receive | Where |
|---|---|---|---|
| Google Firebase (Authentication, Cloud Firestore, Cloud Messaging) | Processor: sign-in, database, push alerts | Account details, allergy profile, preferences, saved recalls, notification token | Database stored in London (europe-west2). Some sign-in and messaging processing may take place in the US |
| Google AdMob | Processor for non-personalised ads; independent controller for personalised ads | Device and advertising data only | UK, EU and US |
| Apple and Google app stores | Independent controllers for app downloads and updates | Whatever their own terms cover; nothing from inside Recalld | Worldwide |
We may also disclose information if the law requires it, to protect someone's safety, or if Recalld is sold or transferred, in which case the new owner must honour this policy.
International transfers: where information goes outside the UK, for example to Google servers in the US, it is protected by UK-approved safeguards: the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Addendum to the EU Standard Contractual Clauses. Contact us for a copy of the relevant safeguards.
How long we keep it
We keep your information while your account is open and delete it when you delete your account.
| Information | Kept for |
|---|---|
| Account details, allergy profile, preferences, saved recalls | Until you delete your account, then erased from our live systems within 30 days |
| Notification token | Until you turn notifications off, uninstall the app or delete your account |
| Messages to us | 24 months after our last reply |
| Advertising data | As set by Google's retention policies |
| Accounts unused for 3 years | We email you, then delete the account if you don't reply within 30 days |
How we protect it
Your information is encrypted in transit (HTTPS) and at rest on Google's servers. Database rules mean only you can read or change your own allergy profile and saved recalls. Passwords are never visible to us. No system is completely secure; if a breach puts you at high risk, we will tell you and the ICO as the law requires.
Children
Recalld is not designed for children under 13, and we do not knowingly collect their information. A parent or guardian can use their own account to track a child's allergies. If you think a child under 13 has created an account, contact us and we will delete it.
Your rights
Under UK GDPR you have the right to:
- Access a copy of your information
- Correct inaccurate information (most of it you can edit in Settings)
- Delete your information, including by deleting your account in Settings
- Restrict how we use it
- Object to uses based on legitimate interests
- Port your information to another service in a machine-readable format
- Withdraw consent at any time, for allergy data, notifications or personalised ads
To use any right, email hello@recalld.co.uk. It is free, and we respond within one month (extendable by two months for complex requests, in which case we will tell you). We may ask you to confirm your identity.
Complaints
Please contact us first so we can try to put things right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We will update this page and its effective date when this policy changes. For significant changes, such as a new use of your allergy information, we will tell you in the app and ask for fresh consent where required.
Contact us
James Aston, Recalld, First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW
Email: hello@recalld.co.uk