Privacy Policy

Stew is operated by Roy Sheppard, an individual developer based in the United Kingdom. For data protection purposes, Roy Sheppard is the data controller.

Contact: support@stewplanner.com

Account information

• Email address — used for authentication and account management
• Display name — shown to family members
• Profile avatar (an emoji you choose, not a photo)

Family and sharing data

• Family group name and membership
• Your role within a family (Admin, Member, Child)
• Per-member permissions you or an admin configure
• Family invite codes

App content you create

• Recipes — titles, ingredients, method, timings, servings, tags, images
• Recipe source URLs (when imported from a website)
• Meal plan entries (which recipe is assigned to which day)
• Shopping list items and their completion status
• Votes on recipes (thumbs-up)

Managed child profiles

Administrators can create managed child profiles within a family. These profiles contain a display name and avatar chosen by the admin. Managed child profiles do not have their own email address or login credentials. See section 10 for more detail.

Notifications

• Device push tokens — collected when you grant notification permission, used only to deliver push notifications from Stew
• Your notification preferences per notification type (for example, whether you want to receive shopping-list-updated notifications)
• Activity records — a log of events in your family such as meal plan changes

Feedback

If you submit feedback through the app, we collect your message and your user ID. We use this solely to review and respond to your feedback.

Technical and diagnostic data

• Log data and error reports generated automatically when the app crashes or encounters an error
• Device type and operating system version (supplied by Expo)
• IP addresses collected at the point of API requests for security and rate-limiting purposes, stored only as an irreversible hash

• To create and manage your account
• To provide and improve the Stew service
• To enable family sharing and real-time collaboration
• To send push notifications and transactional emails you have requested or consented to
• To review feedback and improve the product
• To detect and prevent abuse and fraud
• To comply with legal obligations

We do not sell your personal data. We do not use your data for advertising or profile building beyond what is necessary to operate Stew.

• Contract — processing your account information and app content is necessary to provide the Stew service you signed up for
• Consent — sending marketing emails and push notifications (where you have opted in and can withdraw consent at any time)
• Legitimate interests — security logging, fraud prevention and product improvement, where these interests are not overridden by your rights
• Legal obligation — where required by applicable law

Supabase

We use Supabase (Supabase Inc.) to host our database and handle authentication. Your data is stored in Supabase's infrastructure. Supabase is SOC 2 Type II certified. Data is stored in the United Kingdom (London) region.

Resend

We use Resend (Resend Inc.) to send transactional and notification emails, such as join-request notifications. Resend processes your email address for this purpose. Resend stores customer data in the United States.

Expo / Expo Push Notifications

Stew is built with Expo. Push notifications are delivered via the Expo Push Notification service, which acts as a relay to Apple Push Notification service (APNs) on iOS. Your device push token is shared with Expo solely for this purpose.

Apple App Store / TestFlight

The Stew app is distributed through the Apple App Store. Apple may collect certain analytics data as described in their own privacy policy.

• Active accounts — your data is retained for as long as your account exists
• Account deletion — when you delete your account, your personal data and app content are permanently deleted within 30 days, subject to any legal retention obligations
• Inactive accounts— if your account has had no activity for 3 years, we may contact you with 30 days' notice before deleting it
• Diagnostic logs — retained for up to 12 months
• Feedback submissions — retained for up to 12 months after review

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict certain processing
• Data portability — receive your data in a structured format
• Withdraw consent at any time where we rely on consent

To exercise any of these rights, contact us at support@stewplanner.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords (managed by Supabase Auth), and row-level security on all database tables. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

The Stew mobile app does not use cookies. It stores preferences and session data in device local storage (AsyncStorage) to maintain your login and settings. This data never leaves your device unless explicitly synced to our servers.

The Stew website (stewplanner.com) uses only essential functional storage necessary to operate the site. We do not use tracking or advertising cookies.

Stew is designed for use by families. The minimum age to create an independent account is 13 years old, in line with UK GDPR Article 8.

Children under 13 may be added to a family account as managed child profiles by a parent or guardian who holds an account. Managed child profiles do not have their own credentials and cannot access the app independently.

If you believe a child under 13 has independently created an account without parental consent, please contact us at support@stewplanner.com and we will delete it promptly.

Our database is hosted by Supabase in the United Kingdom, so your account and app content are not transferred outside the UK for that purpose.

Some of our other providers are based outside the UK. Resend, which sends transactional and notification emails, stores data in the United States; transfers to Resend are protected by Standard Contractual Clauses. Expo (push notifications) and Apple (App Store, APNs) are also US-based companies and may process data in the US. Where such transfers occur, we rely on standard contractual clauses or equivalent safeguards recognised under UK GDPR.

We may update this policy from time to time. We will notify you of material changes by email or through a notice in the app. The “Last updated” date at the top of this page indicates when the policy was last revised. Continued use of Stew after changes take effect constitutes acceptance of the updated policy.

For any privacy-related questions or to exercise your rights, contact: support@stewplanner.com