This policy explains what personal data plated collects, why we collect it, how it is stored, and the rights you have over it. It covers both the plated app and this website at platedapp.uk, including the early access sign-up form. plated is a nutrition and macro tracking app operated by Fraser Analytics.
1. Who we are
plated is operated by Fraser Analytics ("we", "us", "our"), based in Newcastle, United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Fraser Analytics is the data controller for the personal data described in this policy.
If you have any questions about this policy or how your data is handled, you can reach us at robbie@fraseranalytics.com .
2. What data we collect
We collect only the data needed to run the app and provide its features:
Account information
- Your email address and authentication details, used to create and secure your account.
- An optional username and profile details if you choose to use the social features that let you connect with other users.
Early access sign-ups (website)
- If you ask for early access on this website, we collect your email address and which platform you use (Android, or iPhone / iPad), so that we can send you the right store invitation.
- On Android, the address you give us has to be the Google account you use on the Play Store, because a Google Play closed-test invitation only works for the account on the testers list. That address may be a different one from the address you later use to sign in to the app.
- Signing up for early access does not create a plated account. We use the address only to issue your store invitation and to send you messages about getting into the test (see sections 5 and 7).
Nutrition and food data
- The foods and meals you log, including quantities, serving sizes, and the associated macro and nutrient values (calories, protein, carbohydrates, fat, saturated fat, salt, fibre, and sugar).
- Barcodes you scan and any custom foods you create.
- Photos of food or nutrition labels, if you choose to use photo-based features. These may be processed to estimate nutritional content (see section 5).
- Your personal nutrition goals and targets.
Receipt and spending data
- If you choose to scan a supermarket receipt, we save the details you review and confirm: the store name, the date of purchase, the printed total, the currency, and the items on the receipt with their quantities, prices and any discounts.
- We do not keep the receipt photos. They are sent for processing (see section 5) and discarded once the details have been read.
- Receipts can show payment card details, loyalty card numbers and the store's address. The scanner is designed to leave these out, and you see every line before anything is saved, so you can remove anything you don't want kept.
- Receipts are used only to track your grocery spending. They are not added to your food log.
Connected health data (optional)
- If you connect your WHOOP account, we access your recovery, sleep, cycles, and workouts so the app can show correlations between your nutrition and your recovery. Strain figures reach us as part of your cycles and workouts rather than as a separate category.
- We also access your basic WHOOP profile , from which we read and store a single item: the account identifier WHOOP uses for you. This is what links your WHOOP account to your plated account, so that data arriving from WHOOP is matched to the right person. We do not store the name or email address held on your WHOOP account.
- We request no other categories of WHOOP data — in particular, we do not request your body measurements. This is only collected with your explicit consent and can be disconnected at any time (see section 4).
Technical data
- Basic information needed to operate the service reliably, such as authentication tokens and app diagnostic information. Diagnostic reports about crashes and errors are processed by Sentry (see section 5) and are configured to exclude personal information. We do not use any of this to build advertising profiles.
3. How and why we use your data
We use your data to provide and improve the app's core functions, and to get you into the test if you have asked for early access. Under UK GDPR we rely on the following legal bases:
| What we do | Legal basis |
|---|---|
| Run your account and store your food logs, goals, and custom foods | Performance of our contract with you (providing the app you signed up for) |
| Access and display your WHOOP health data | Your explicit consent |
| Store your WHOOP account identifier to link the two accounts | Your consent, given when you connect WHOOP, and our legitimate interests in matching incoming data to the correct account |
| Process food or label photos to estimate nutrition | Your consent, given when you use the feature |
| Read receipt photos and store your grocery spending | Your consent to process the photos, given when you scan a receipt; storing the saved receipts is part of providing the app (performance of our contract with you) |
| Connect with other users and share or copy logs | Your consent, given when you use the social features |
| Keep the service secure and working correctly | Our legitimate interests in operating a reliable, secure app |
| Send you a Google Play or TestFlight invitation after an early access sign-up | Your consent, given when you submit the early access form. You can withdraw it at any time by emailing us, and we will delete the sign-up |
We do not sell your personal data, and we do not use it for third-party advertising.
4. Health data and WHOOP
Nutrition information and data from WHOOP (such as recovery and sleep) can reveal information about your health. Under UK GDPR this is special category data , which is subject to stronger protections.
- We only access your WHOOP data if you actively choose to connect your WHOOP account and grant permission through WHOOP's own secure authorisation screen.
- We request access to your recovery, sleep, cycles, and workouts , and to your basic profile , and nothing further. We do not request your body measurements. You choose whether to grant that access at the point of connection.
- Why we need your profile. The profile permission exists solely so we can read the account identifier WHOOP uses for you. Without it we have no reliable way to tell which plated account a piece of incoming WHOOP data belongs to. We read that identifier once, when you connect, and store nothing else from your profile — not your name, and not the email address on your WHOOP account.
- You can disconnect WHOOP at any time, from within the app or from your WHOOP account settings. Once disconnected, we stop receiving new data from WHOOP.
- What happens to data already synced. Disconnecting stops future syncing but does not by itself erase the WHOOP data already held in your plated account. We keep it so that the nutrition-and-recovery history you have built up stays available to you. If you would rather it was removed, you can delete your account (section 8), which erases it along with everything else, or email us and we will delete your synced biometric data while leaving the rest of your account intact.
- We use this data solely to provide the nutrition-and-recovery features within plated. We do not share it with third parties for their own purposes.
WHOOP is an independent company and its handling of your data is governed by its own privacy policy.
5. Who we share data with
We use a small number of trusted service providers ("processors") to run the app and this website. They process data only on our instructions and are bound by appropriate data protection terms. They are:
| Provider | Purpose |
|---|---|
| Supabase | Secure hosting of your account, database, and stored files (such as food photos) |
| Open Food Facts | Looking up product and nutrition information from barcodes and searches |
| WHOOP | Providing your recovery, sleep, cycles, and workouts, together with the account identifier that links your WHOOP account to plated, only if you connect your account |
| Anthropic | Processing food, nutrition-label and receipt photos to estimate nutritional content or read receipt details, only if you use photo features |
| Sentry | Collecting crash and error diagnostics so we can find and fix faults. Hosted in the European Union. Configured not to send personal information, and error details are stripped before they are transmitted |
| Formspree | Receiving the forms on this website — early access sign-ups and tester reports — and forwarding them to our email. Formspree, Inc. hosts its service on Amazon Web Services in the United States |
Store invitations. If you sign up for early access, we pass the email address you gave us to Google , to add you to the plated closed test on Google Play, or to Apple , to send you a TestFlight invitation — whichever platform you chose. There is no other way for a store invitation to be issued. Google and Apple are not acting only on our instructions here: they handle that address under their own privacy policies and for their own purposes as well as ours, and we have no control over what they do with it beyond issuing the invitation.
Your data is not used to train anyone's AI models. Content sent for AI processing is used only to return a result to you, and is not retained by us or our provider for model training.
Some of these providers, or their infrastructure, are located outside the UK — Formspree processes data in the United States, as do Google and Apple when they issue a store invitation. Where data is transferred internationally, we rely on appropriate safeguards recognised under UK data protection law (such as the UK International Data Transfer Agreement or an adequacy decision) to keep your data protected.
We may also disclose data where we are legally required to do so, for example in response to a valid legal request.
6. Where your data is stored
Your account data and content are stored using Supabase infrastructure hosted on Amazon Web Services in the eu-west-2 (London) region. This means your primary data — everything held in your plated account — is held within the United Kingdom.
Anything you submit through a form on this website is not. Early access sign-ups and tester reports are received by Formspree, which hosts its service on Amazon Web Services in the United States , and are forwarded from there to our email. Limited processing may also occur elsewhere where another provider listed in section 5 operates outside the UK, subject to the safeguards described above.
7. How long we keep your data
We keep your personal data for as long as your account is active. If you delete your account using the in-app deletion feature (see section 8), your account and its associated data are deleted immediately, except for the minimal deletion record described in section 8 and any information we are required to retain to meet legal obligations. You can also request deletion by email (see section 8). Saved receipts are kept for as long as your account is active, and you can delete any receipt yourself at any time from the Spending section of the app.
Early access sign-ups. If you ask for early access and never take the invitation up, we keep your email address and platform choice for up to 12 months from the day you signed up, and then delete them. If you do take it up, we delete the sign-up once you are in the test. You can ask us to remove it sooner at any time by emailing robbie@fraseranalytics.com . Deleting a sign-up does not remove you from a Google Play testers list or from TestFlight — those are managed by Google and Apple, and you can leave a test from the Play Store or the TestFlight app.
8. Deleting your account
You can permanently delete your plated account and its data at any time, from within the app: open Settings , then under Account tap Delete account , type your account's email address to confirm, and tap Permanently delete my account . This happens immediately and cannot be undone.
This removes:
- Your account, and your ability to sign back in with it.
- All logged nutrition — every meal, plan, and entry across your history.
- Your WHOOP connection, the stored WHOOP account identifier, and all synced biometric data (recovery, sleep, cycles, and workouts). Access is revoked at WHOOP as part of the same process — you can independently confirm this from the WHOOP app at any time.
- Custom foods you created, including their photos.
- Your profile, username, and follow relationships.
- Your daily goals and saved ingredients.
- Your saved receipts and their items.
It does not remove entries that someone you're connected with copied from your log into their own — those became their record the moment they copied it, carry no link back to your account, and aren't ours to delete on your behalf.
If you no longer have the app installed or can't sign in, email robbie@fraseranalytics.com from the email address associated with your account. It has to come from that address — that's how we confirm the request is genuinely yours before we act on it.
We respond to and complete deletion requests within 30 days , in line with UK GDPR Article 12(3) — in practice we aim to handle them within the same week.
We keep a minimal internal record that a deletion took place — an account identifier and the date, with no email address and no health or nutrition data — so we can demonstrate compliance with erasure requests if ever required to. This record is pseudonymised : it remains personal data under UK GDPR, but it holds nothing about your health or nutrition and cannot be linked back to you by anyone outside our own systems.
See also our dedicated account deletion page .
9. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data ("right to be forgotten").
- Restrict or object to certain processing.
- Withdraw consent at any time, where we rely on your consent (such as WHOOP connection, photo features or receipt scanning). Withdrawing consent does not affect processing carried out before you withdrew it.
- Data portability — receive a copy of the data you provided in a portable format. plated also offers CSV export of your logs and of your grocery spending from within the app.
To exercise any of these rights, email robbie@fraseranalytics.com . We will respond within the timeframes required by law (normally within one month).
If you believe we have not handled your data properly, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO) , at ico.org.uk . We would appreciate the chance to address your concerns first.
10. Security
We take reasonable technical and organisational measures to protect your data. Access to your data is protected by authentication, and database access is governed by row-level security so that users can only reach data they are permitted to see. Connections to our services are encrypted in transit. No system can be guaranteed to be completely secure, but we work to protect your information appropriately.
11. Children
plated is not directed at children. The app is intended for users aged 13 and over. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
12. Changes to this policy
We may update this policy from time to time to reflect changes to the app or to legal requirements. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify you within the app.
13. Contact us
Fraser Analytics
Newcastle, United Kingdom
Email:
robbie@fraseranalytics.com