NibbleCheck Privacy Policy

Last updated: 3 October 2026

Who we are

NibbleCheck is operated by Oliver Kirkman, a sole trader trading as NibbleCheck, based in the United Kingdom (“we”, “us”). We are the data controller for the personal data described here. Contact: [email protected]. If you need a postal address for a formal request, ask and we will give you one.

Is there a Data Protection Officer?

No, and here is why. UK GDPR only makes a Data Protection Officer compulsory in three situations (Article 37(1)): you are a public authority; your core activity is monitoring people regularly and systematically on a large scale; or your core activity is processing special category data on a large scale. We are not a public authority, we do not monitor anyone, and while children’s allergy information is special category data, NibbleCheck is one person and the number of households using it is not large scale. So we have not appointed a DPO. We will keep this under review as the app grows, and appoint one if that changes.

That is not the same as having nobody to ask. Oliver Kirkman is the named contact for anything to do with data protection — questions, requests to see or delete your data, or a complaint. Email [email protected] and it reaches him directly.

What NibbleCheck does

NibbleCheck helps families and childcare settings check food products against children’s allergy profiles. It is a label-reading and decision-support tool — it does not provide medical advice and it cannot guarantee any food is safe.

What we collect

Your account: email address and the display name you choose.

Your household: household name, members you invite, shopping lists, kitchen items, meal plans and food diary entries you create.

Children’s profiles (special category data): for each child you add — first name, optional date of birth, optional photo, allergies and their severity, and optional care-card details you choose to add (rescue pen/auto-injector details, medication notes, emergency contact name and phone number). Allergy information is health data about a child. We only process it with your explicit consent, which you give when you create a child profile, and you can withdraw it at any time by deleting the profile.

Your activity: products you scan or search for, the per-child results we showed you, and products you save. We keep this so you can re-check products and see your history.

An anonymous count of the products we couldn’t answer: when you scan a barcode, we add one to a weekly count of scans and, if we found no product or no ingredient list for it, one to a weekly count for that barcode. That is everything stored: the week, the barcode and the number. It is not linked to you, your household, your children or your phone, and it is never matched against your scan history. It tells us which products to fill in first. You can turn it off in the app under Settings → Privacy & data → “Count barcodes we can’t answer”. Scans in Child Mode are never counted.

Community contributions (optional): if you submit a product verification or label photo, we store it with your contributor profile to keep the shared product catalogue trustworthy.

If you filled in the “register your interest” form: the waitlist form on this website (interest.html) collects your email address and, only if you choose to answer, the rest of the survey: whether you are a parent, childminder, nursery or other; the name of your setting; roughly how many children are in your care and how many have allergies; which allergens matter to you; whether you would use or pay for a nursery version; and any free-text feedback you write. The form also records the browser user-agent string your device sends, and which page you arrived from, so we can tell real submissions from bot spam. This list is separate from the app: filling it in does not create an account, and we do not link it to one.

If you just visit this website: we set no cookies and there is no analytics, tag manager or tracking script on any page of nibblecheck.com — if you view the page source you will see one script we did not write, called email-decode.min.js. Cloudflare adds it at the edge to scramble the email addresses on the page so spam harvesters cannot read them. It is served from this domain, sets no cookie and does not track you — but we would rather name it here than have you find it and wonder. Two things still happen that you should know about. First, the site is delivered through Cloudflare (see below), and like any web server Cloudflare necessarily sees your IP address, the page you asked for, and your browser’s user-agent in order to deliver it and filter attacks. Our own web server sits behind that tunnel and keeps an ordinary access log, and today that log does record the IP address Cloudflare passes to it. It stays on that machine, is never used for analytics or profiling and goes nowhere else; in practice it is wiped each time we publish an update to the site, which is days rather than months. We are changing the server so it stops recording the address at all — a site you can read without logging in has no need to know who read it. At Cloudflare’s end, request records that include your IP address are available to us for 8 days, and security-filtering records for 15 days, after which we can no longer retrieve them. Second, the pages use two typefaces, Baloo 2 and Nunito. Until 12 September 2026 our home, about, reviews and open-data pages fetched those typefaces from Google Fonts, which meant your IP address and browser details were sent to Google in the United States whenever one of those pages loaded. That no longer happens. We now serve the font files from our own server, so no request goes to Google (or to any other third party) when you read this site, and nothing about a visit reaches Google at all. If you visited those four pages before that date, Google received your IP address, your user-agent and the address of the page you were on; we never received anything back from it, it was never used for tracking or analytics, and nothing about your account or your children was ever involved.

What we do NOT collect: medical histories or diagnoses, children’s contact details, location data, advertising identifiers. We do not profile you or your children and we never use allergy data for marketing.

Why we process it (lawful bases)

Children are profiles in a parent’s account, not account holders. Accounts are for adults. There are no nursery or childcare accounts in this version and you cannot share a child’s profile with a setting through the app (see Terms, section 5). A child’s profile can be shared only with another adult you invite — a co-parent or a household member — and you can revoke that share at any time.

Do you have to give us any of this?

No law requires you to give NibbleCheck anything. There is no statutory requirement here. Some of it is needed for the app to work at all, though, so it is effectively a requirement of using the service, and here is exactly what happens if you leave it out:

• Your email address — needed to create an account and sign back in. Without it we cannot give you an account.
• Accepting the Terms and this policy — needed at sign-up. Without it, sign-up does not complete.
• A name for each profile, and at least one allergen — needed for a check. A profile with no allergens on it has nothing for the app to check against, so it will not produce a result.
• Your explicit consent to store health data — needed before any profile can be created. If you do not give it, the profile is not created (the app deliberately fails closed rather than saving anything).

Everything else is genuinely optional, and nothing breaks if you skip it: a child’s date of birth (it is used only to suggest which size of adrenaline pen is usually prescribed at that age — leave it blank and you just do not get that suggestion; it plays no part in the allergy check itself), a photo, the care-card details (rescue pen, medication note, emergency contact), community contributions, and the whole of the waitlist form beyond an email address.

How the allergy check works — and what that means for automated decisions

You are entitled to know when a computer is making a judgement from your data, so: yes, the allergen check is automatic, and here is how it works.

The check runs on your own phone. It compares the product’s ingredient list, its “contains” statement and its “may contain” warning against the allergens recorded on the profile you picked, using a fixed set of written-down rules and a curated list of allergen words — the sort of thing that would be a very long checklist if you did it by hand. There is no AI and no machine learning anywhere in that decision. That is deliberate: a model that guesses cannot be explained to a parent or to a regulator, and a wrong answer here matters far too much. The same product and the same profile always give the same answer, and we can always point at the exact word that matched.

It produces two separate things. A result — one of: an allergen was found, it may contain one, there might be a hidden one, none were found in the ingredients, no allergens are set on this profile, the ingredients are missing, or unknown. And, kept deliberately apart from it, a confidence level (high, medium, low or unknown) describing how good the underlying product information is. Old, stale or cached data lowers the confidence rather than being quietly hidden — and only ever downwards for a reassuring answer, because time passing is evidence a recipe might have changed, never evidence it changed in your favour. There is no “safe” result and no tick, and a reassuring result is never shown as high confidence.

What the check does not use: your child’s age or date of birth plays no part in it, and the severity you record affects only how prominently a warning is displayed — it never makes a warning weaker or stronger. Nothing about your child is scored, ranked or profiled.

NibbleCheck does not make a decision about your child. It reads a label faster and more consistently than a tired person in a supermarket aisle, and then you decide. Nothing is done to anyone as a result of the answer: no access is granted or refused, no eligibility, price or service changes, and no record follows your child anywhere. The one thing a result does change inside the app is which products appear in the Free-From Finder and the “alternatives” suggestions — a product is only offered there if the check found nothing for the allergens you chose. For those reasons we do not treat the check as the kind of solely-automated decision with legal or similarly significant effects that Article 22 of the UK GDPR restricts. We have set it out here in full anyway, because you should be able to see how it works.

And you are not stuck with what it says:

• Every result shows why — a written explanation naming the exact words that matched, the allergens that drove it, the confidence level, and a reminder that an ingredients list cannot tell you about shared equipment.
• You can ignore it. It is advice on a screen; the app never stops you doing anything.
• You can fix the input — photograph or type the real label yourself and run the check again on that.
• You can tell us the product data is wrong by submitting a verification or label photo. Other users and then a moderator look at it, and corrections feed back into the shared catalogue.
• You can ask a human. Email [email protected] about any result you think is wrong and we will look at it ourselves, explain it, and correct it if it is wrong. There is no “report this result” button in the app yet; the email address is the route until there is.

If it ever turned out that this should be treated as an Article 22 decision, the condition we would rely on is the same explicit consent you give for the health data itself (Art. 22(4)(a) with Art. 9(2)(a)), and the safeguards above — an explanation, a human to ask, and the ability to contest the answer — are the ones Article 22(3) requires.

The result, the confidence level, the words that matched and the explanation are saved to your scan history so you can look back at them; they are not recalculated later. Meal planning for a childcare setting uses a separate, simpler check that just compares the allergens tagged on a meal against the allergens on the children eating it.

The camera works the same way. Reading text off a label uses Google’s ML Kit text recognition running on the device itself — it turns a picture into words and does not decide anything, and neither the picture nor the words are sent anywhere. A label photo only leaves your phone if you deliberately submit it as a community contribution.

Where your data lives

Data is stored with Supabase (our database and authentication provider) in the EU (Ireland, eu-west-1). Supabase is our processor under Article 28 of the UK GDPR: it holds and serves the data on our written instructions, under Supabase’s Data Processing Addendum, and it is not allowed to use it for its own purposes. Access is restricted with row-level security: only members of your household (and anyone you explicitly share a child with) can see your data. Child photos are stored in a private bucket and served via short-lived signed links. Data is encrypted in transit and at rest.

The website you are reading is a separate thing from the app. It is served from a computer we run ourselves, published to the internet through a Cloudflare tunnel — so Cloudflare sits between you and our server. Cloudflare is our processor for that traffic and handles it under Cloudflare’s Data Processing Addendum. It sees the requests you make for pages and their connection details, including your IP address, and keeps its own logs of them. It receives nothing from your NibbleCheck account: the app talks to Supabase directly and never passes through our website. Nor does the waitlist form — that posts straight to Supabase from your browser.

When you scan a barcode our own product database can’t fully answer, or open a product’s page, we send the barcode to Open Food Facts (the open product database) to look the product up. When you search by name, we send what you typed. Nothing that identifies you or your child is attached to either. Two things worth saying plainly, because “barcode only” would not be the whole truth: product images are fetched by your device directly from Open Food Facts’ image servers, so they see your device’s IP address the way any website you load does; and the barcode is sent whether or not they turn out to hold the product. Product data shown in the app comes from Open Food Facts under the Open Database License. Food recall alerts come from the UK Food Standards Agency API; again, no personal data is sent. Open Food Facts and the FSA are independent organisations who decide their own use of the data they hold — they are not our processors.

Sending data outside the UK

UK law only lets us send personal data abroad if there is a proper safeguard in place. Here is each one, honestly:

Ask us and we will point you to a copy of any of these safeguards.

What changed on 12 September 2026. This table used to carry a fifth row: Google, United States, for the typeface on the home, about, reviews and open-data pages. Those pages fetched the font from fonts.googleapis.com and fonts.gstatic.com, so every visitor’s IP address and browser details went to Google, with no consent step and, for most of the site’s life, no disclosure. We have removed it by serving the same two typefaces from our own server. The row is gone because the transfer is gone, not because we stopped mentioning it. Both typefaces are used under the SIL Open Font Licence 1.1 — Baloo 2, Nunito.

Who we share it with

Nobody, except: our processors (Supabase, which holds the app’s data and sends its account emails, and Cloudflare, which delivers this website), people you share with in-app (household members, and child-share recipients such as a co-parent), and authorities where the law requires it. Nobody who is not on that list gets your data, no processor may use it for their own ends, and we do not sell data, full stop.

One practical thing worth saying plainly: our contact address is a Gmail address, so anything you put in an email to us — including anything about your child — is held in Google’s mail service. Please do not email us your child’s health details unless you need to; if you are asking about a result, the product and the allergen are usually enough.

How long we keep it

These limits are enforced by scheduled jobs, not by us remembering to run one. The main retention sweep runs nightly; deletions you ask for are processed hourly; the label-photo cleanup runs weekly, so a photo can outlive the 90 days below by up to a week before the job removes it.

• Your account, children, allergies and lists: for as long as your account exists.
• Scan history: deleted 24 months after the scan.
• Food diary entries: deleted 12 months after the day they record.
• Pending invite and share codes: deleted 30 days after they are created.
• Shares that have expired (for example a babysitter’s temporary access): the access stops the moment it expires; the record is deleted 30 days later.
• Label photos you send us to verify a product: deleted 90 days after upload, and within 7 days if the upload never completed.
• Anonymous weekly counts of scans and of products we couldn’t answer: deleted 24 months after the week they count.
• Waitlist entries (the “register your interest” form): deleted 24 months after you submit them, or sooner if you ask. The purpose runs out once we have launched and told you.
• Community contributions (verifications): kept to protect other families, but anonymised (de-linked from you) when you delete your account. The photo files themselves are deleted with your account.
• Records of the consents you gave and withdrew: kept after the data itself is gone, because they are the proof of what you agreed to. They hold the wording, the version and the date — not the health data.

Deleting your data

You can delete a child profile, a household, or your whole account in the app (Settings → Delete account). Deletion is real: child profiles, allergies, photos, scans, saved products, lists, meal plans and diary entries are removed, including photo files in storage. If you own a household that other people have joined, you can’t delete your account until you make one of them the owner (Members & sharing → Make owner) or remove them; nobody takes it over automatically. If nobody else is in your household, deleting your account deletes the household and the children in it — the app warns you first.

The waitlist is separate from the app, so deleting an account does not touch it and there is no account to delete it from. Email [email protected] and we will remove your entry.

Your rights

Under UK GDPR you can ask us for access, rectification, erasure, restriction, portability (Settings → export your data), and to object to processing we do on the basis of legitimate interests. You can withdraw consent at any time — this stops the related feature working, e.g. a child profile without allergy data cannot be evaluated. You can also ask a human to look at any automated result, as described above. Contact [email protected]. You can complain to the Information Commissioner’s Office (ico.org.uk) — you do not have to come to us first, though we would rather have the chance to put it right.

Changes

We will notify you in-app of material changes and ask for fresh consent where the law requires it.