This page explains what personal information myfoody collects when you visit the site, what we do with it, and what rights you have. We have tried to write it in plain English. If anything is unclear, please email hello@myfoody.co.uk and we will be glad to explain.
1. Who we are
myfoody is a directory of independent UK food producers. It is operated by Tom Stafford, an individual based in the United Kingdom, as a personal project. Where this policy says "we", "us", or "myfoody", it refers to Tom Stafford in that personal capacity.
Tom Stafford is the data controller for personal data collected through this site, for the purposes of the UK GDPR and the Data Protection Act 2018.
- Email: hello@myfoody.co.uk
- Postal address: available on request via the email above
If you would like to make any kind of data-protection request, please use that email.
2. What information we collect
Information you give us when you choose to use these features:
- Submitting a review. We collect the display name you provide (you can use initials), your star rating, the text of your review, an optional photograph you upload, and an optional "favourite item" tag. The display name appears publicly with your review on the site.
- Suggesting a listing. We collect the details of the business you are suggesting (name, location, type) and, if you choose, your own name and email address so that we can credit you and follow up.
- Submitting a recipe. We collect the display name you provide, the recipe content (title, ingredients, method, etc.), and an optional photograph. The display name appears publicly with your recipe on the site.
- Subscribing to the newsletter. We collect your email address and pass it to our email service provider, EmailOctopus, to add you to the myfoody mailing list. You will receive a confirmation email before any newsletters are sent. You can unsubscribe at any time via the link in every email.
Information collected automatically:
- Server logs. When you visit the site, our hosting provider (Netlify) and our backend (Google Firebase) automatically receive technical information including your IP address, your browser type and version, and the time of your visit. This is standard for any website.
- Browser storage. The site stores two pieces of information in your browser's local storage: your saved favourites and your colour-theme choice. This information stays on your device and is not transmitted to us.
We do not collect any other personal information about you. The only analytics we use is cookieless and aggregate (see section 9); we do not run advertising on the site.
3. How we use this information
- We display reviews, recipes, and (where approved) suggestions on the relevant pages of the site.
- We use suggestions to decide which businesses to add as new listings.
- We use server logs and reCAPTCHA to keep the site running, investigate problems, and prevent automated abuse.
- We use any contact details you give us (such as the optional email on the suggestion form) to follow up on your submission if needed.
We do not use your information for advertising, profiling, or automated decision-making.
4. Lawful basis for processing
Under the UK GDPR we need a lawful basis to process your personal data. The bases we rely on are:
- Consent (Article 6(1)(a)) — for reviews, suggestions, and recipe submissions. You give your consent by choosing to submit the form. You can withdraw consent at any time by emailing hello@myfoody.co.uk to ask us to remove your submission.
- Legitimate interests (Article 6(1)(f)) — for technical server logs and anti-spam measures (including reCAPTCHA). Our legitimate interest is in running a reliable, abuse-free directory. You have the right to object — see section 8.
5. Who we share your information with
We do not sell your personal information. We share it only with the third-party service providers we use to run the site:
- Google (Firebase). Hosts the database (Firestore, located in europe-west) and uploaded photos (Cloud Storage, located in the United States). Also provides admin authentication.
- Google (Maps Platform). Provides map and location-search functionality, including the "use my location" feature.
- Google (reCAPTCHA). Provides spam prevention on submission forms.
- Netlify. Provides the hosting on which the site itself runs.
- EmailOctopus. Provides our newsletter mailing list. If you subscribe to the newsletter, your email address is sent to EmailOctopus and used solely to send you the newsletter. EmailOctopus is GDPR-compliant and its privacy policy is at emailoctopus.com/legal/privacy. You can unsubscribe at any time via the link in every email.
Each of these providers operates under its own privacy terms, which we have reviewed. Useful links:
- Google privacy policy: policies.google.com/privacy
- Firebase data and security: firebase.google.com/support/privacy
- Netlify privacy policy: netlify.com/privacy
We will also disclose information if legally required to (for example, in response to a court order or a lawful request from a regulator).
6. International transfers
Some of the third-party services above process personal data outside the UK — notably, Firebase Cloud Storage holds uploaded photographs in the United States.
Where personal data is transferred outside the UK we rely on the safeguards approved by the UK Information Commissioner's Office, including the UK International Data Transfer Agreement (IDTA) and the UK extension to the EU–US Data Privacy Framework. These mechanisms are designed to give your personal data an equivalent level of protection to that it would receive in the UK.
7. How long we keep your information
- Reviews and recipes are kept indefinitely as part of the public site, unless you ask us to remove yours.
- Suggestions (whether approved or declined) are kept indefinitely as a record of submissions, unless you ask us to remove yours.
- Technical server logs are kept by Netlify and Firebase according to their own retention schedules — typically days to weeks.
You can ask us to delete any information you have submitted at any time — see section 8.
8. Your rights
Under UK GDPR you have the following rights regarding your personal data:
- Right to be informed — about how we use your data (this policy).
- Right of access — to a copy of the personal data we hold about you.
- Right to rectification — to have inaccurate data corrected.
- Right to erasure — to have your data deleted ("right to be forgotten").
- Right to restrict processing — to limit how we use your data.
- Right to object — to processing based on legitimate interests.
- Right to withdraw consent — at any time, for anything based on consent.
- Right to data portability — to receive a copy of your data in a structured, commonly-used format.
To exercise any of these rights, email hello@myfoody.co.uk. We will respond within one month, as required by law. There is no fee.
You also have the right to complain to the Information Commissioner's Office (the UK data-protection regulator) if you think we have handled your data badly:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
We would, of course, appreciate the chance to address your concerns first.
9. Cookies, analytics, and similar technologies
myfoody itself does not set any cookies for analytics or advertising. We don't use a tracking cookie banner because we don't have anything to track. Instead, the site is built so that third-party services only load — and only set their cookies — when you ask for the specific feature that needs them. The three services that may load are:
- Google Maps — loads when you click the "Load interactive map" button on the home-page placeholder. Once you've done so, your choice is saved in your browser's local storage so the map auto-loads on future visits. Used to display the map and to power live search by town or postcode.
- Google reCAPTCHA — loads when you open a submission form (review, suggestion, or recipe). The form carries a small notice above the captcha widget making this explicit. Used to detect automated spam. If you close the form without submitting, any cookies set will expire naturally.
- Firebase Authentication — only relevant if you log in to the admin dashboard. Not used by ordinary visitors.
Cloudflare Web Analytics. We also use Cloudflare's privacy-friendly analytics service to count visits and measure how quickly pages load. It runs in your browser and sends Cloudflare basic information about the visit (the page URL, the time, your IP address for approximate location and deduplication, and basic browser/device details). It does not set any cookies, does not use device fingerprinting, and does not track individual visitors across sites or build a profile of you. Full detail is in Cloudflare's privacy notice.
We also use your browser's local storage (a separate technology from cookies) to remember the favourites you have saved, your colour-theme preference, whether you have previously loaded the interactive map, and which emoji reaction (if any) you have chosen on blog posts and recipes. This information stays on your device and we never see it. When you react to a post, the only thing sent to our database is an instruction to increment one of three counters (thumbs-up, thumbs-down, heart) by one — no identifier travels with it.
If you choose to install myfoody as an app on your phone or computer (via the install prompt on the home page, or via your browser's "Add to Home Screen" menu), a small service worker runs in the background to cache the home page so it loads instantly and can show something useful when you're offline. The cache only contains the page itself and the app icon — no personal data, no tracking. You can clear it at any time via your browser's site-data settings.
If you would rather not load these services. Simply do not click the "Load interactive map" button and do not open the submission forms — the home page will continue to show the placeholder, and you can browse the sample listings, the blog, and the recipes pages without any third-party cookies being set.
Changing your mind. You can use the Cookies & tracking link in the page footer to see what cookies the site uses and to reset your saved map preference (which makes the home page show the "click to load" placeholder again on your next visit). To clear cookies that have already been set by Google, clear cookies for this site in your browser's settings.
10. Security
Steps we take to protect your information include:
- All submissions are validated by server-side rules (Firestore security rules) before being saved, with limits on field types, lengths, and file sizes.
- Photo uploads are restricted in size and file type, server-side.
- The admin dashboard is protected by Firebase Authentication, with server-side checks that gate every administrative action.
- Submission forms are protected by Google reCAPTCHA.
- The site is served over HTTPS.
No online service can guarantee 100% security, but these are the controls we have in place.
11. Children
myfoody is not directed at children and we do not knowingly collect personal data from anyone under 13. If you believe we may have inadvertently collected personal data from a child, please email hello@myfoody.co.uk and we will delete it promptly.
12. Changes to this policy
If we make material changes to this policy we will update the "last updated" date at the top of this page, and where appropriate we will surface the change elsewhere on the site. The current version is always available here.
13. Contact
For any questions, requests, or complaints about how myfoody handles your personal data:
- Email: hello@myfoody.co.uk
- Postal address: available on request via the email above
You can also contact the Information Commissioner's Office:
- Website: ico.org.uk
- Helpline: 0303 123 1113