Privacy Policy

1. Who we are

Service: Foray helps you create and organise recipes, plan meals, build a grocery list, shop, and cook.

Data controller: Foray App Limited, a company registered in England and Wales (company number 16501071), registered office: First Floor Office, 3 Hornton Place, London, England, W8 4LZ, United Kingdom.

Contact (privacy): privacy@forayapp.co.uk

We have not appointed a Data Protection Officer, as we are not required to do so given the nature and scale of our processing.

For UK/EU users, the relevant supervisory authority is the UK Information Commissioner’s Office (ICO) (and your local EU data protection authority for EU residents).

2. The data we collect, and why

We practise data minimisation: the only universally required personal data is your name. Everything else is collected only when a feature you use needs it, for example your account identifier, saved and AI-generated recipes, meal plans, grocery lists, shopping history, store preference (chosen manually), dietary/allergen settings, subscription status, and (with permission) notification tokens.

Diagnostics and product analytics are opt-in and off by default in the UK/EU. We do not collect your location. You choose your store manually. We do not collect unnecessary demographics or your contacts, and we do not perform tracking-based advertising.

3. How we use your data (lawful bases)

Under the UK GDPR we process personal data only where we have a lawful basis:

• Contract: to create and maintain your account, meal plans, grocery lists, Chef AI recipes you request, and other features of the Service you use.
• Explicit consent (UK GDPR Article 9(2)(a)): allergy and other health-related dietary information is special category data. We store and use it only with your explicit consent, collected when you provide those details (for example during onboarding). You can withdraw that consent in Settings or by contacting us; we will then stop that processing and delete or stop using the health data where legally possible.
• Consent: optional diagnostics and product analytics (off by default in the UK/EU); website Google Analytics (cookie banner); including allergies in Chef AI requests when you enable Personalise with Chef AI; and push notifications where your device permission is required.
• Legitimate interests: securing the Service, preventing fraud and abuse, and improving reliability where we do not rely on consent (balanced against your rights).
• Legal obligation: retaining records where UK law requires it.

4. Payments & retailer checkout

Foray is not the merchant of record for groceries. We do not collect or store your card or payment-card details. App subscriptions are billed by Apple via the App Store.

5. AI recipe creation and imported social content

When you use Chef AI (“the Chef”) to create a recipe, content you submit (links, prompts, or photos) is sent to our AI provider, Google (Gemini API), to produce a structured recipe (see the subprocessors table below). We store the result privately on your account; for social imports we keep a link back to the original and do not republish your imports to other users. Where your device supports it, limited processing may run on-device; that is not a Foray cloud subprocessor.

Dietary personalisation is off by default. Your allergies and dietary preferences are included in a Chef AI request only if you turn on Personalise with Chef AIin Settings → AI Privacy & Usage. You can turn it off at any time. Filtering of catalogue recipes by your allergies works on your device and does not depend on this setting.

AI output may be inaccurate. Always verify ingredients, and never rely on it for allergen safety.

6. Who we share data with (subprocessors)

We share the minimum necessary with vetted providers acting on our instructions under data-processing agreements or equivalent safeguards:

7. International transfers

Our primary data processing takes place in the EEA. Where data is processed outside the UK/EEA, we rely on an adequacy decision, the UK International Data Transfer Agreement / Addendum and/or EU Standard Contractual Clauses, plus supplementary measures where appropriate.

8. Retention

We keep your personal data while your account is active. When you delete your account, we delete your records, wipe local on-device data, and revoke tokens; backup copies are purged within 30 days. Diagnostics (if opted in) are retained up to 90 days; analytics up to 12 months.

9. Marketing & communications

We send transactional emails needed to operate your account (for example the 6-digit sign-in code). Those are not marketing.

Push notifications are delivered only if you grant permission on your device. You can turn them off in iOS Settings or in the app. We do not sell your data to advertisers or run tracking-based advertising.

We do not currently send promotional email or SMS marketing. If we introduce that later, we will only do so with a lawful basis (consent or soft opt-in where PECR allows) and an unsubscribe path in each message.

10. Your rights

You can access, export, rectify, and erase your data, withdraw consent (including for allergy/health data and optional analytics), and restrict or object to certain processing, from in-app Settings or by contacting privacy@forayapp.co.uk. UK/EU users have rights under UK and EU GDPR. US/California residents have rights to know, access, delete, and correct. We do not sell or share personal data as those terms are defined.

11. Automated decision-making

We use personalisation and AI to recommend recipes, plans, and baskets, but we do not make automated decisions that have legal or similarly significant effects on you.

12. Children

Foray is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. Contact privacy@forayapp.co.uk if you believe a child under 13 has provided us data.

13. Security

We use industry-standard encryption in transit and at rest, and access controls appropriate to the risk.

14. Siri, Shortcuts & widgets

If you use Foray through Siri, Shortcuts, Spotlight, or widgets, your spoken request is processed by Apple under Apple’s terms; Foray receives the resulting structured request and handles it like the equivalent in-app action. We don’t receive or store your voice audio.

15. Cookies on this website

This website sets no marketing or tracking cookies by default. When you make a choice in our cookie banner, we store it as foray-consent(a strictly-necessary cookie plus a browser localStorage entry, kept for about 6 months). Only if you choose “Accept” do we load Google Analytics. Signing in to the admin area uses strictly-necessary authentication cookies.

16. Third-party links & corporate transactions

The Service may link to external sites. Their privacy practices are their own; please review their notices.

If we sell or transfer all or part of our business, personal data relevant to that part may transfer to the buyer under appropriate safeguards, and only for purposes consistent with this policy.

17. Changes & contact

We may update this policy and will revise the “last updated” date; for material changes we will notify you in-app or by email. Questions or requests: privacy@forayapp.co.uk · Foray App Limited, First Floor Office, 3 Hornton Place, London, England, W8 4LZ, United Kingdom. UK/EU users may also contact the ICO or their local data protection authority.