Privacy Policy | Silflay

Effective: 30 October 2026

Controller: Silflay Ltd ("Silflay", "we", "us", "our")

Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom

Company number: 17091581

This notice explains how we collect, use, share and protect personal data when you use Silflay's mobile apps, website and related services (the "Services"). We act as a controller under the UK GDPR and the Data Protection Act 2018.

1) Data we collect

We collect the information needed to provide and improve the Services, including:

Account information: your authentication user ID, guest or registered account status and, when you register or sign in, your email address, email verification status and related account information.
Meal planning and shopping content: meal plans, delivery settings, saved recipes, user-defined meals, serving preferences, shopping list items, selected products, product substitutions, preferred supermarkets and products you choose not to buy.
Price alert information: watched products, alert thresholds, notification preferences and records of alerts sent.
Supermarket basket information: basket contents, selected products and requested basket actions where you choose to connect a supermarket account. We do not collect or store your supermarket username or password.
Subscription information: whether your account has an active subscription, trial or entitlement.
Usage and analytics information: screens and features used, searches and search outcomes, recipe and product views, favourites, shortlists, meal selections, recipe-mix interactions, product comparisons and replacements, shopping-list actions, and related app interaction context. Where you allow usage analytics, selected events are also sent to Google Analytics for Firebase and associated with your Silflay account identifier.
Recommendation history: account-linked records of relevant actions such as recipe or product selections, favourites, searches, comparisons and shopping actions that we use to personalise and improve recommendations.
Communications: messages you send us by email or through support channels.
Technical information: app version and build, device model and platform, operating system version, locale, time zone, request timing and outcome categories, crash traces, error types, installation identifiers, Silflay account identifier and stable screen or operation context needed to operate, secure and debug the Services.

Cookbook scanning: If you scan a recipe from a cookbook, the page image and text recognition are processed on your device. The image is not uploaded to or stored by Silflay. Only the text extracted from the image is sent to Silflay so that we can create the recipe, identify its ingredients and provide the related planning and shopping features. If you save the recipe, the extracted recipe content may be stored as part of your Silflay account data.

The mobile app uses Firebase Crashlytics to collect crash and diagnostic information automatically. We associate Crashlytics reports with your Silflay account identifier, including when you use a guest account, so that we can investigate a report you make.

If you choose Share diagnostic report in the app, the app creates a text report on your device containing your account identifier, app version and build, device model, operating system version, locale, time zone, current screen and operation context, and recent sanitised activity. The report does not include passwords, authentication tokens, cookies, request or response bodies, complete URLs, typed text, searches, product identifiers, delivery details or screenshots. It is not uploaded automatically; you choose where to send it using your device share sheet.

Search terms and other relevant interaction details may be retained in your Silflay recommendation history so that we can understand preferences and improve recommendations. If you allow usage analytics, selected search and shopping interaction data may also be sent to Google Analytics for Firebase.

We do not collect or store your payment card details.

2) Authentication

Silflay uses Google Firebase Authentication for guest access, email/password, Google and Apple sign-in, and to send verification and password-reset emails. Passwords go directly to Firebase; Silflay does not store them. Firebase Authentication processes authentication data in the United States.

When you choose Get started without signing up, Firebase creates a guest identity with a unique user ID. Silflay saves your meal plans, shopping content, preferences and other app data on its servers under that identity. The data collection, recommendation history, diagnostics and optional usage analytics described in this policy also apply to guest accounts.

Creating a new account from your guest session adds email/password, Apple or Google sign-in to the same identity and preserves its data. If you sign in to an existing account instead, the app opens that account after confirmation; the guest data is not merged into it.

For email alerts and some account features, we may require a verified email address.

3) Supermarket integrations

Silflay may allow you to connect to supermarket websites or apps so that the app can read basket information, prepare basket updates or add products to your supermarket basket.

Where this is supported, you log in through the supermarket's own login page. Silflay does not collect or store your supermarket username or password.

The app may store supermarket authentication tokens, cookies or similar session information securely on your device. These are used by the app to make supermarket requests on your behalf. They are not transmitted to Silflay's server.

Checkout and payment for supermarket orders always take place through the supermarket's own website or app.

4) How we use your data

We use personal data to:

create and manage your account;
provide meal planning, recipe, shopping list and product matching features;
save your preferences and app settings;
prepare, review or update supermarket basket actions requested by you;
provide price alerts and product notifications;
manage subscriptions, trials and entitlements;
provide support and respond to messages;
measure how features are used, understand user journeys and search quality, and improve the Services where you have allowed usage analytics;
personalise and improve recipe, product and shopping recommendations using your Silflay preferences and recommendation history;
maintain, secure, debug and improve the Services;
comply with legal obligations.

Our lawful bases are:

Contract: where processing is needed to provide the Services you request.
Legitimate interests: where processing is needed to maintain, secure, debug and improve the Services, respond to support requests, prevent misuse, or understand whether the Services are working correctly.
Consent: where we ask for consent, including optional Google Analytics for Firebase usage analytics, marketing messages or push notifications where required.
Legal obligation: where processing is needed to comply with the law.

5) Sharing your data

We do not sell your personal data.

We share personal data only where needed to run, secure or provide the Services, including with:

Authentication providers: Google Firebase Authentication, Google and Apple.
Hosting and infrastructure providers, such as AWS.
Analytics, crash and diagnostic service providers, such as Google Analytics for Firebase and Firebase Crashlytics.
App stores and platform providers, such as Apple and Google.
Subscription management providers, such as RevenueCat.
Website hosting, security and performance providers, such as Cloudflare.
Email and business communication providers, such as Zoho.
Notification providers, such as Apple Push Notification service or Firebase Cloud Messaging.

We may also interact with supermarket websites or services at your request. Examples may include Ocado, Sainsbury's, Tesco, Asda, Waitrose and Morrisons. These integrations may change over time.

Silflay is not affiliated with, endorsed by or sponsored by these supermarkets unless we explicitly say otherwise. Their own privacy policies and terms apply when you use their services.

We may also share information if required by law, to protect rights or security, or in connection with a business sale, merger, restructuring or similar transaction.

6) International transfers

Silflay aims to store its own backend and database information in the UK. Firebase Authentication processes account authentication data in the United States.

Some service providers may process information outside the UK or European Economic Area as part of their global services. Where this happens, we expect appropriate safeguards to be used as required by data protection law.

7) Retention

We keep personal data only as long as needed for the purposes above.

In general:

account, meal planning, shopping list, preference, alert and recommendation-history data is kept while your account remains active;
server logs are kept for around one week;
Google Analytics for Firebase data is retained according to the retention controls configured for our Analytics property; turning usage analytics off stops future Analytics collection but does not automatically erase data already collected;
Firebase Crashlytics keeps crash traces and associated identifiers for 90 days before starting removal from its live and backup systems;
the in-app diagnostic journal keeps at most two rotating files with a combined limit of 2 MiB, and generated diagnostic report files older than 24 hours are removed when the app next starts or creates a report;
Silflay backups may be kept for up to 35 days before being overwritten or deleted;
Firebase Authentication deletion can take up to 180 days across its live and backup systems;
limited records may be kept for longer where required for legal, security, tax, accounting or dispute purposes.

Guest accounts follow the same retention arrangements. Expiry of free access, uninstalling the app or losing access to a guest session does not automatically delete its server-held data. We do not automatically delete guest accounts after a fixed period. When you switch from a guest session to an existing account, the app requests deletion of the guest account and its associated data; if that request cannot reach the server, the guest data may remain.

When you delete your account, we will delete the personal data stored under your Silflay account, including meal plans, shopping lists, saved recipes, user-defined meals, preferences, product selections, price alerts and recommendation history, subject to the limited exceptions above. If you granted Analytics consent, we will also submit a request to Google Analytics to delete Analytics data associated with your Silflay Analytics user ID; Google may take up to 63 days to complete that deletion.

Guests and registered users can request account deletion in Silflay Settings. Registered users can also sign in at https://silflay.co.uk/account/delete. If you cannot access your account, contact [email protected]; for guest accounts, we may need your Silflay account identifier to locate the data because no email address is attached.

8) Emails, notifications and choices

Silflay may send emails or push notifications, including price alerts, product alerts, account messages, service updates and product updates.

You can opt out of non-essential marketing messages.

You can manage push notifications through your device settings and, where available, app settings.

Google Analytics for Firebase usage analytics is off until you choose to allow it. You can change this choice at any time in Silflay Settings. Turning it off stops future Google Analytics collection.

The usage analytics setting controls data sent to Google Analytics. It does not disable Silflay's own recommendation history, which is used to personalise and improve meal, recipe, product and shopping recommendations.

9) Cookies and SDKs

Our website does not use advertising cookies or cookie-based analytics.

Cloudflare may process technical information needed to provide website hosting, security and performance.

The mobile app uses SDKs or platform services for authentication, subscriptions, notifications, analytics, diagnostics, app distribution and related functionality. If you allow usage analytics, Google Analytics for Firebase processes selected app events, screen views, user properties and your Silflay authentication user ID on Google's infrastructure. Firebase Crashlytics separately processes crash and diagnostic data to identify, group and help us investigate app failures.

10) Your rights

Depending on your circumstances, you may have rights to access, correct, delete, restrict, object to or receive a copy of your personal data.

You may also withdraw consent where we rely on consent.

To exercise your rights, contact [email protected].

You can also complain to the UK Information Commissioner's Office if you are unhappy with how we handle your personal data.

11) Security

We use technical and organisational measures designed to protect personal data, including encrypted connections, access controls and secure storage where appropriate.

No system is completely secure. You are responsible for keeping your devices, Silflay account and supermarket accounts secure.

12) Children

Silflay app accounts, including guest accounts, are intended for adults aged 18 and over.

In future, Silflay may allow adult account holders to share simple one-time meal voting links with family members. These links may be opened in a browser and do not require the recipient to create a Silflay account. Where voting links are used, we may process the voting link, meal options, selected vote, timestamp and any name or label the voter provides.

We do not knowingly allow children to create Silflay app accounts.

13) Automated decision-making

Silflay may use personalisation, ranking and classification to recommend meals, recipes, products, substitutions or baskets. This may use your saved preferences and recommendation history, including actions such as searches, views, favourites, selections and product comparisons, to infer which choices are likely to be useful to you.

We do not make automated decisions that have legal or similarly significant effects.

14) Third-party links

The Services may link to external websites or apps, including supermarkets and app stores. Their privacy practices are their own, and you should review their policies.

15) Changes to this notice

We may update this policy from time to time. We will post updates here and change the effective date. For material changes, we will provide reasonable notice where appropriate.

Contact

Silflay Ltd - [email protected]

Address: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom