Privacy policy

This policy explains what personal data Starterwise and this website collect, why, who it is shared with and what choices you have.

Last updated: 12 October 2026

Who we are

The Starterwise app and this website are run by [Owner name] ("we", "us"). We are the controller of the personal data described here, which means we decide how and why it is used.

Questions or requests about your data: support@starterwise.com. We handle personal data in line with the UK GDPR and the Data Protection Act 2018 and, for people in the United States, the state privacy laws that apply to us.

This policy covers the Starterwise app for iPhone, this website (including shared recipe pages) and our support email. It does not cover other companies' services that we link to, such as Apple and Amazon. They have their own privacy notices.

The data we collect and why

We collect what the app needs to work and nothing we do not use. We do not collect your precise location and we do not read your contacts. Your shopping region (UK or US) is a setting you choose, not something we detect.

• Account

  What it includes

  Your email address, or your Apple ID identifier (with the name and private relay email address you choose to share) if you sign in with Apple. Sign-in is provided by Clerk.

  Why we use it

  To create and secure your account and sign you in.

  Legal basis

  Contract: providing the app you asked for.

• Household and baking records

  What it includes

  Your household's name, region, time zone and members with their roles; your starters with their feeding and observation records; recipes you create or import; bakes, plans, step times, temperatures and feedback; your pantry, shopping lists and reminder settings; notes you write. These are stored on our servers at Cloudflare and synced to your devices.

  Why we use it

  To run the app, keep your devices and household in step, and let you look back at past bakes.

  Legal basis

  Contract.

• Photos

  What it includes

  Photos you choose to add: on share cards and public recipe pages, in your photo history (Premium) or in Bake Circle posts. Location data in a photo's metadata (EXIF) is removed before the photo is stored. Photos are kept in Cloudflare R2 storage.

  Why we use it

  To show photos where you put them and to keep your photo history.

  Legal basis

  Contract. Consent for AI analysis of photos (see AI features).

• AI features (Premium)

  What it includes

  The text, questions and photos you choose to send, with the bake details you select (such as the recipe, times and temperatures), and a record of each request, its result and the credits used.

  Why we use it

  To produce the answer, analysis or recipe you asked for, apply your monthly allowance and keep your AI history.

  Legal basis

  Consent, which we ask for before your first AI request. Contract.

• Safety checks on shared content

  What it includes

  Text and photos in Bake Circle posts and comments, and photos on public recipe pages, are checked automatically by an AI provider before other people see them. If the check says no, the item goes back to you with a short reason and nobody else sees it. If you ask for a second look, a person reviews it. If the check cannot run, the item is held until a person has reviewed it.

  Why we use it

  To keep the community safe and meet our responsibilities for content that people post.

  Legal basis

  Legitimate interests, and our legal obligations.

• Sharing and Bake Circle

  What it includes

  What you choose to share: recipe snapshots, a display name if you choose to show one, photos, notes, posts, comments and reactions; your friends; reports you make or that are made about you; items the automatic check sent back to you, the reason it gave, any request you made for a second look (with your note) and what the person decided; strikes and bans.

  Why we use it

  To let you share, to show your content to the people you chose and to moderate.

  Legal basis

  Contract. Legitimate interests (moderation).

• Purchases

  What it includes

  Your subscription status: the product, whether you bought it or receive it through Family Sharing, and the renewal and expiry dates. Apple takes the payment; we never see your card or Apple payment details. RevenueCat processes purchase information for us, identified by an internal ID rather than your name or email.

  Why we use it

  To give you Premium, restore it on a new device and prevent fraud.

  Legal basis

  Contract. Legitimate interests (preventing fraud).

• Referrals

  What it includes

  When someone installs the app through your share link and starts using it, we link that install to your household so we can give you a reward. We use Apple's DeviceCheck so that a device counts as a referral only once; it does not tell us who the device belongs to.

  Why we use it

  To give referral rewards and stop repeated claims.

  Legal basis

  Legitimate interests.

• Attribution

  What it includes

  AppsFlyer helps us see which share link or invite an install came from and opens the right recipe after install. We send it a small set of events: onboarding, first starter, first bake, share created, share install, paywall, trial and conversion. They never include photos, notes, household member identities or shopping contents. We do not use Apple's advertising identifier (IDFA) unless you allow tracking when the app asks, and nothing in Starterwise depends on your answer.

  Why we use it

  To make share links and invites work and to understand whether sharing helps people.

  Legal basis

  Legitimate interests.

• Crash and error reports

  What it includes

  Sentry receives crash and error reports: the app version, an anonymised operation ID, sync and plan revision numbers and alarm error codes. Tokens, signed links, email addresses, photos, AI inputs, notes and share tokens are removed from these reports.

  Why we use it

  To find and fix faults.

  Legal basis

  Legitimate interests.

• Notifications

  What it includes

  Reminders and alarms for feeds and bake steps are set on your iPhone. If you turn on notifications about friends in Bake Circle, we keep a push token for your device and send notifications through Apple's push service, using Expo's push service.

  Why we use it

  To remind you and to tell you about friend requests, posts, reactions and comments, if you want that.

  Legal basis

  Contract. Your permission in iOS settings.

• Website visits

  What it includes

  Our hosting provider, Cloudflare, sees the technical details your browser sends, such as your IP address and browser type, to deliver and protect the site. Public recipe pages count how many times they are viewed. If you report a page, we keep your reason, any details you write and a one-way, salted hash of your network address that changes each day (not the address itself) to limit abuse. This website sets no cookies and has no analytics or advertising trackers.

  Why we use it

  To deliver the site, keep it secure and handle reports.

  Legal basis

  Legitimate interests.

• Support

  What it includes

  Your emails to us and our replies. Support email reaches us through email forwarding and our email providers.

  Why we use it

  To help you and keep a record of what we agreed.

  Legal basis

  Contract. Legitimate interests.

Amazon links. The app can suggest ingredients and equipment with links to Amazon. We do not send Amazon any information about you. When you tap a link, Amazon opens in its app or your browser and Amazon's own privacy notice applies. We earn a commission on qualifying purchases (see the terms of use).

Where data comes from. Mostly from you. Members of your household can also add information about you, such as your name on a task or a record of who did what. Apple and RevenueCat tell us your subscription status.

What other people can see

• Your household. Members can see the household's starters, bakes, pantry and shopping lists, and who did what and when. What each member can change depends on their role.
• Your friends in Bake Circle. Friends can see the posts, comments and reactions you make there. Bake Circle is never public. Friends are added only through a personal invite link, and you can remove or block anyone.
• Anyone with a public recipe link. A public recipe page shows the recipe, the photo you chose and a display name only if you chose to show one. It never shows your household name or members, other starter details, your location, photo metadata or notes you did not select. The page is a snapshot. You can stop sharing in the app, and the link then stops working.

Once someone has seen or copied a recipe or photo you shared, we cannot take their copy back.

Who we share data with

We use service providers who process data on our behalf. We give each only what it needs for its job:

• Clerk for sign-in and account security.
• Cloudflare for hosting, databases, file storage, job queues and email forwarding, for the app's servers and this website.
• RevenueCat for subscriptions, and Apple for App Store purchases, Family Sharing and Sign in with Apple. Apple handles its own data for those services under its privacy policy.
• AppsFlyer for install attribution and deep links.
• Sentry for crash and error reports.
• Our AI provider for AI features and safety checks. We will name the provider here before AI features are available.
• Expo to deliver push notifications.
• Our email providers for support email.

We may also share data with authorities, courts or professional advisers where the law requires it or to protect people, our rights or our service, and with a buyer if the app is ever sold. We do not sell your personal information, and we do not share it with advertisers.

Transfers outside the UK

Some of our providers process data outside the UK, including in the United States. When they do, we use a safeguard the law recognises, such as the UK's adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified providers) or contract terms approved for UK transfers.

How long we keep data

• Account, household and baking records: while you have an account, then deleted as described below.
• Public recipe pages and their photos: until you stop sharing or delete your account. A share photo is deleted when the share is stopped.
• Bake Circle posts and comments: until you delete them or delete your account. This includes items the automatic check sent back to you and any second-look request about them, which are deleted with the item.
• Photo history and AI history: kept with your account so you can read them again, and deleted with it.
• Purchase records: for as long as the law requires us to keep accounting records.
• Support emails: for as long as needed to help you and deal with any follow-up.
• Crash reports and attribution events: for a limited period set in our accounts with those providers.
• Backups: deleted data can remain in backups until they expire, and is then erased.

Deleting your account and exporting your data

You can export your data and delete your account in the app: open Settings, then Your data. How to delete your account explains the steps.

Deleting your account removes your sign-in, revokes your public recipe links, removes your Bake Circle posts (with any second-look requests about them) and deletes your photos. If a person published something the automatic check had blocked, we may keep a copy of its words, without your name or account, to improve the check; any pointer to a photo is removed when the original is deleted. Deletion runs as background jobs that are retried until they finish. Copies of AI requests held by our AI provider follow that provider's retention terms. Deleting an account is separate from deleting a household: records that other members of your household still use stay with the household. The owner of a household can delete it in the app (Delete household), which removes its records, photos, AI history and public links for everyone and leaves the other members' accounts as they are.

Your rights under the UK GDPR

You have the right to:

• be told how your data is used (this policy)
• get a copy of your data (access) and receive it in a portable form
• have wrong data corrected
• have your data erased, in many cases
• restrict how we use your data, or object to uses based on our legitimate interests
• withdraw consent at any time, for example for AI analysis, without affecting what happened before

Use the export and delete options in the app, or email support@starterwise.com. We reply within one month and may need to check it is you. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office. We would like the chance to put things right first.

United States privacy rights

If you live in California, Colorado, Connecticut, Virginia or another state with a privacy law, you may have the right to know what personal information we hold, get a copy, correct it, delete it, and opt out of its sale, of targeted advertising and of profiling. You will not be treated worse for using these rights.

• In the past 12 months we have collected these categories: identifiers (email address, Apple ID identifier, device push token, IP address), commercial information (subscription status), internet and app activity (the events listed above), photos you add, and the content you create.
• We do not sell personal information, we do not share it for targeted advertising, and we do not use it for profiling that has legal or similarly significant effects.
• We do not ask for sensitive personal information such as precise location or health information. Please do not put sensitive details in notes.
• This website does not track you across sites, so there is no browser signal to honour.

To use your rights, use the in-app options or email support@starterwise.com. We will check your request against your account and reply within the time the law allows (generally 45 days). You can ask someone to act for you. If we refuse a request, you can appeal by replying to our email.

AI and automated checks

AI features give suggestions and explanations. They do not schedule alarms, mark dough as ready, change a plan you are using, or decide that a starter or any food is safe. Automatic safety checks can send a post back to you with a reason, or hold it for review, but a person decides whether it is published after a second look, removed, or whether someone is banned from posting. Nothing here produces a decision with legal or similar effect on you without a person being involved.

Children

Starterwise is not directed to children under 13 and we do not knowingly collect personal data from them. If you think a child under 13 has given us data, email support@starterwise.com and we will delete it.

Keeping data safe

We use encrypted connections, keep photos in private storage that is served through short-lived links, check household membership on every request, verify signed messages from our providers and limit repeated attempts on invitations and share links. No system is perfectly secure. If you find a security problem, please email support@starterwise.com.

Changes to this policy

We will update this page when our practices change and change the date at the top. For significant changes we will give notice before they take effect.

Contact us

[Owner name], support@starterwise.com.