Privacy Policy
Effective date: 7 July 2026 · Last updated: 6 October 2026
This policy explains what personal data Foray App Limited (“Foray,” “we,” “us”) collects, why, who we share it with, and the rights you have. It covers the Foray iOS app, this website, and related services.
1. Who we are
Service: Foray helps you create and organise recipes, plan meals, build a grocery list, shop, and cook.
Data controller: Foray App Limited, a company registered in England and Wales (company number 16501071), registered office: First Floor Office, 3 Hornton Place, London, England, W8 4LZ, United Kingdom.
Contact (privacy): privacy@forayapp.co.uk
We have not appointed a Data Protection Officer, as we are not required to do so given the nature and scale of our processing.
For UK/EU users, the relevant supervisory authority is the UK Information Commissioner’s Office (ICO) (and your local EU data protection authority for EU residents).
2. The data we collect, and why
We practise data minimisation: the only universally required personal data is your name. Everything else is collected only when a feature you use needs it, for example your account identifier, saved and AI-generated recipes, meal plans, grocery lists, shopping history, store preference (chosen manually), dietary/allergen settings, subscription status, and (with permission) notification tokens.
Diagnostics and product analytics are opt-in and off by default in the UK/EU. We do not collect your location. You choose your store manually. We do not collect unnecessary demographics or your contacts, and we do not perform tracking-based advertising.
3. How we use your data (lawful bases)
Under the UK GDPR we process personal data only where we have a lawful basis:
- Contract: to create and maintain your account, meal plans, grocery lists, Chef Fluffy recipes you request, and other features of the Service you use.
- Explicit consent (UK GDPR Article 9(2)(a)): allergy and other health-related dietary information is special category data. We store and use it only with your explicit consent, collected when you provide those details (for example during onboarding). You can withdraw that consent in Settings or by contacting us; we will then stop that processing and delete or stop using the health data where legally possible.
- Consent: optional diagnostics and product analytics (off by default in the UK/EU); website Google Analytics (cookie banner); including allergies in Chef Fluffy requests when you enable Personalise with Chef Fluffy; and push notifications where your device permission is required.
- Legitimate interests: securing the Service, preventing fraud and abuse, and improving reliability where we do not rely on consent (balanced against your rights).
- Legal obligation: retaining records where UK law requires it.
4. Payments & retailer checkout
Foray is not the merchant of record for groceries. We do not collect or store your card or payment-card details. App subscriptions are billed by Apple via the App Store.
5. AI recipe creation and imported social content
When you use Chef Fluffy (“the Chef”) to create a recipe, content you submit (links, prompts, or photos) is sent to our AI provider, Google (Gemini API), to produce a structured recipe (see the subprocessors table below). We store the result privately on your account; for social imports we keep a link back to the original and do not republish your imports to other users. Where your device supports it, limited processing may run on-device; that is not a Foray cloud subprocessor.
AI personalisation is off by default. One setting, Personalise with Chef Fluffy in Settings → AI Privacy, controls it. Foray asks before turning it on, including the first time you tap Auto-generate. When it is on, Auto-generate plans your meals and learns from what you cook, swap, rate and save in Foray; that learning is worked out on your phone and is not sent to our AI provider. Chef Fluffy also includes your foods to avoid and dietary preferences in your recipe requests. When it is off, Auto-generate is hidden and these preferences are not shared. Chef Fluffy always uses your household size to set how many servings a new recipe makes, and filtering of catalogue recipes by your allergies works on your device whatever this setting says.
AI output may be inaccurate. Always verify ingredients, and never rely on it for allergen safety.
7. International transfers
Our primary data processing takes place in the EEA. Where data is processed outside the UK/EEA, we rely on an adequacy decision, the UK International Data Transfer Agreement / Addendum and/or EU Standard Contractual Clauses, plus supplementary measures where appropriate.
8. Retention
We keep your personal data while your account is active. When you delete your account, we delete your records, wipe local on-device data, and revoke tokens; backup copies are purged within 30 days. Diagnostics (if opted in) are retained up to 90 days; analytics up to 12 months. Moderation reports you filed are retained for admin review with your account identifiers replaced. A picture you choose to attach to a report is deleted when you delete your account.
To keep the free trial to one per person, when you start a trial we store a one-way coded value (a keyed hash) made from your sign-in email and, if you use them, your Apple or Google sign-in identifier, together with the trial start date. It cannot be turned back into your email or identifier and is not linked to your profile. We keep it after you delete your account, under our legitimate interest in preventing abuse of the trial, so that signing up again resumes your original trial rather than starting a new one.
9. Marketing & communications
We send transactional emails needed to operate your account (for example the 6-digit sign-in code). Those are not marketing.
Push notifications are delivered only if you grant permission on your device. You can turn them off in iOS Settings or in the app. We do not sell your data to advertisers or run tracking-based advertising.
If you start a trial, we email you about that trial. We do so only with a lawful basis (consent or soft opt-in where PECR allows), and each message has an unsubscribe link. Sign-in codes are separate and still arrive. We do not send SMS marketing.
10. Your rights
You can access, export, rectify, and erase your data, withdraw consent (including for allergy/health data and optional analytics), and restrict or object to certain processing, from in-app Settings or by contacting privacy@forayapp.co.uk. Turn notifications off in Settings. Unsubscribe from a trial email using the link in that message. UK/EU users have rights under UK and EU GDPR. US/California residents have rights to know, access, delete, and correct. We do not sell or share personal data as those terms are defined.
11. Automated decision-making
We use personalisation and AI to recommend recipes, plans, and baskets, but we do not make automated decisions that have legal or similarly significant effects on you.
12. Children
Foray is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. Contact privacy@forayapp.co.uk if you believe a child under 13 has provided us data.
13. Security
We use industry-standard encryption in transit and at rest, and access controls appropriate to the risk.
14. Siri, Shortcuts & widgets
If you use Foray through Siri, Shortcuts, Spotlight, or widgets, your spoken request is processed by Apple under Apple’s terms; Foray receives the resulting structured request and handles it like the equivalent in-app action. We don’t receive or store your voice audio.
16. Third-party links & corporate transactions
The Service may link to external sites. Their privacy practices are their own; please review their notices.
If we sell or transfer all or part of our business, personal data relevant to that part may transfer to the buyer under appropriate safeguards, and only for purposes consistent with this policy.
17. Changes & contact
We may update this policy and will revise the “last updated” date; for material changes we will notify you in-app or by email. Questions or requests: privacy@forayapp.co.uk · Foray App Limited, First Floor Office, 3 Hornton Place, London, England, W8 4LZ, United Kingdom. UK/EU users may also contact the ICO or their local data protection authority.