This policy explains what personal data the plated app collects, why we collect it, how it is stored, and the rights you have over it. plated is a nutrition and macro tracking app operated by Fraser Analytics.
1. Who we are
plated is operated by Fraser Analytics ("we", "us", "our"), based in Newcastle, United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Fraser Analytics is the data controller for the personal data described in this policy.
If you have any questions about this policy or how your data is handled, you can reach us at robbie@fraseranalytics.com .
2. What data we collect
We collect only the data needed to run the app and provide its features:
Account information
- Your email address and authentication details, used to create and secure your account.
- An optional username and profile details if you choose to use the social features that let you connect with other users.
Nutrition and food data
- The foods and meals you log, including quantities, serving sizes, and the associated macro and nutrient values (calories, protein, carbohydrates, fat, saturated fat, salt, fibre, and sugar).
- Barcodes you scan and any custom foods you create.
- Photos of food or nutrition labels, if you choose to use photo-based features. These may be processed to estimate nutritional content (see section 5).
- Your personal nutrition goals and targets.
Connected health data (optional)
- If you connect your WHOOP account, we access your recovery, sleep, cycles, and workouts so the app can show correlations between your nutrition and your recovery. Strain figures reach us as part of your cycles and workouts rather than as a separate category.
- We also access your basic WHOOP profile , from which we read and store a single item: the account identifier WHOOP uses for you. This is what links your WHOOP account to your plated account, so that data arriving from WHOOP is matched to the right person. We do not store the name or email address held on your WHOOP account.
- We request no other categories of WHOOP data — in particular, we do not request your body measurements. This is only collected with your explicit consent and can be disconnected at any time (see section 4).
Technical data
- Basic information needed to operate the service reliably, such as authentication tokens and app diagnostic information. Diagnostic reports about crashes and errors are processed by Sentry (see section 5) and are configured to exclude personal information. We do not use any of this to build advertising profiles.
3. How and why we use your data
We use your data to provide and improve the app's core functions. Under UK GDPR we rely on the following legal bases:
| What we do | Legal basis |
|---|---|
| Run your account and store your food logs, goals, and custom foods | Performance of our contract with you (providing the app you signed up for) |
| Access and display your WHOOP health data | Your explicit consent |
| Store your WHOOP account identifier to link the two accounts | Your consent, given when you connect WHOOP, and our legitimate interests in matching incoming data to the correct account |
| Process food or label photos to estimate nutrition | Your consent, given when you use the feature |
| Connect with other users and share or copy logs | Your consent, given when you use the social features |
| Keep the service secure and working correctly | Our legitimate interests in operating a reliable, secure app |
We do not sell your personal data, and we do not use it for third-party advertising.
4. Health data and WHOOP
Nutrition information and data from WHOOP (such as recovery and sleep) can reveal information about your health. Under UK GDPR this is special category data , which is subject to stronger protections.
- We only access your WHOOP data if you actively choose to connect your WHOOP account and grant permission through WHOOP's own secure authorisation screen.
- We request access to your recovery, sleep, cycles, and workouts , and to your basic profile , and nothing further. We do not request your body measurements. You choose whether to grant that access at the point of connection.
- Why we need your profile. The profile permission exists solely so we can read the account identifier WHOOP uses for you. Without it we have no reliable way to tell which plated account a piece of incoming WHOOP data belongs to. We read that identifier once, when you connect, and store nothing else from your profile — not your name, and not the email address on your WHOOP account.
- You can disconnect WHOOP at any time, from within the app or from your WHOOP account settings. Once disconnected, we stop receiving new data from WHOOP.
- What happens to data already synced. Disconnecting stops future syncing but does not by itself erase the WHOOP data already held in your plated account. We keep it so that the nutrition-and-recovery history you have built up stays available to you. If you would rather it was removed, you can delete your account (section 8), which erases it along with everything else, or email us and we will delete your synced biometric data while leaving the rest of your account intact.
- We use this data solely to provide the nutrition-and-recovery features within plated. We do not share it with third parties for their own purposes.
WHOOP is an independent company and its handling of your data is governed by its own privacy policy.
5. Who we share data with
We use a small number of trusted service providers ("processors") to run the app. They process data only on our instructions and are bound by appropriate data protection terms. They are:
| Provider | Purpose |
|---|---|
| Supabase | Secure hosting of your account, database, and stored files (such as food photos) |
| Open Food Facts | Looking up product and nutrition information from barcodes and searches |
| WHOOP | Providing your recovery, sleep, cycles, and workouts, together with the account identifier that links your WHOOP account to plated, only if you connect your account |
| Anthropic | Processing food or nutrition-label photos to estimate nutritional content, only if you use photo features |
| Sentry | Collecting crash and error diagnostics so we can find and fix faults. Hosted in the European Union. Configured not to send personal information, and error details are stripped before they are transmitted |
Your data is not used to train anyone's AI models. Content sent for AI processing is used only to return a result to you, and is not retained by us or our provider for model training.
Some of these providers, or their infrastructure, may be located outside the UK. Where data is transferred internationally, we rely on appropriate safeguards recognised under UK data protection law (such as the UK International Data Transfer Agreement or an adequacy decision) to keep your data protected.
We may also disclose data where we are legally required to do so, for example in response to a valid legal request.
6. Where your data is stored
Your account data and content are stored using Supabase infrastructure hosted on Amazon Web Services in the eu-west-2 (London) region. This means your primary data is held within the United Kingdom. Limited processing may occur elsewhere where a provider listed in section 5 operates outside the UK, subject to the safeguards described above.
7. How long we keep your data
We keep your personal data for as long as your account is active. If you delete your account using the in-app deletion feature (see section 8), your account and its associated data are deleted immediately, except for the minimal deletion record described in section 8 and any information we are required to retain to meet legal obligations. You can also request deletion by email (see section 8).
8. Deleting your account
You can permanently delete your plated account and its data at any time, from within the app: open Settings , then under Account tap Delete account , type your account's email address to confirm, and tap Permanently delete my account . This happens immediately and cannot be undone.
This removes:
- Your account, and your ability to sign back in with it.
- All logged nutrition — every meal, plan, and entry across your history.
- Your WHOOP connection, the stored WHOOP account identifier, and all synced biometric data (recovery, sleep, cycles, and workouts). Access is revoked at WHOOP as part of the same process — you can independently confirm this from the WHOOP app at any time.
- Custom foods you created, including their photos.
- Your profile, username, and follow relationships.
- Your daily goals and saved ingredients.
It does not remove entries that someone you're connected with copied from your log into their own — those became their record the moment they copied it, carry no link back to your account, and aren't ours to delete on your behalf.
If you no longer have the app installed or can't sign in, email robbie@fraseranalytics.com from the email address associated with your account. It has to come from that address — that's how we confirm the request is genuinely yours before we act on it.
We respond to and complete deletion requests within 30 days , in line with UK GDPR Article 12(3) — in practice we aim to handle them within the same week.
We keep a minimal internal record that a deletion took place — an account identifier and the date, with no email address and no health or nutrition data — so we can demonstrate compliance with erasure requests if ever required to. This record is pseudonymised : it remains personal data under UK GDPR, but it holds nothing about your health or nutrition and cannot be linked back to you by anyone outside our own systems.
See also our dedicated account deletion page .
9. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data ("right to be forgotten").
- Restrict or object to certain processing.
- Withdraw consent at any time, where we rely on your consent (such as WHOOP connection or photo features). Withdrawing consent does not affect processing carried out before you withdrew it.
- Data portability — receive a copy of the data you provided in a portable format. plated also offers CSV export of your logs from within the app.
To exercise any of these rights, email robbie@fraseranalytics.com . We will respond within the timeframes required by law (normally within one month).
If you believe we have not handled your data properly, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO) , at ico.org.uk . We would appreciate the chance to address your concerns first.
10. Security
We take reasonable technical and organisational measures to protect your data. Access to your data is protected by authentication, and database access is governed by row-level security so that users can only reach data they are permitted to see. Connections to our services are encrypted in transit. No system can be guaranteed to be completely secure, but we work to protect your information appropriately.
11. Children
plated is not directed at children. The app is intended for users aged 13 and over. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
12. Changes to this policy
We may update this policy from time to time to reflect changes to the app or to legal requirements. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify you within the app.
13. Contact us
Fraser Analytics
Newcastle, United Kingdom
Email:
robbie@fraseranalytics.com