Privacy
This page contains two documents and account-deletion instructions: (1) our Website & Waitlist Privacy Notice, covering this website and the waitlist sign-up form, (2) the Fork It App Privacy Policy, covering the Fork It mobile app, and (3) Delete Your Account, how to delete your app account and its data. The two policies are separate documents with separate scopes.
Website & Waitlist Privacy Notice
Version: 1.1 (published). Covers the Fork It website and waitlist email capture only. The Fork It app has its own, separate Privacy Policy (below). ICO registration is complete (registration number ZC188197) and this notice is now live. (A solicitor review of the full legal set is still to be carried out; any resulting changes will be published as a new version.)
1. Who we are
This website (forkitapp.net) is operated by Wayne McCarten, a sole trader trading as Tacocat Technologies, of 9 Glandore Gardens, Portadown, Craigavon, BT62 3GG ("we", "us", "our"). We are the data controller for the personal data described in this notice under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration number ZC188197.
Contact for any privacy question, including to exercise your rights: support@forkitapp.net
2. What this notice covers
This notice covers personal data collected through this website — principally the Fork It waitlist sign-up form. It does not cover the Fork It mobile app, which has its own Privacy Policy (set out below on this page, and available in the app).
3. What we collect and why
Waitlist sign-up. If you join the waitlist, we collect your email address and a record of your consent (including the date and time you confirmed it). We use a double opt-in process: after you submit the form, we send a confirmation email, and you are only added to the list once you click the confirmation link.
We use this data for one purpose: to email you about Fork It — launch news, early-access information, and the founder launch offer.
Legal basis: your consent — Article 6(1)(a) UK GDPR, and Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR), which requires opt-in consent for marketing email.
Withdrawing consent: every email we send includes an unsubscribe link. You can also email us at support@forkitapp.net at any time. Unsubscribing removes you from the list.
4. Who processes the data
| Provider | Purpose | Location |
|---|---|---|
| EmailOctopus | Stores the waitlist and sends our emails (our processor) | United Kingdom |
| Cloudflare | Hosts this website and provides its network/CDN; standard server logs (IP address, request data) are processed to deliver and secure the site | Global network; subject to Cloudflare's published UK/EU transfer mechanisms |
We do not sell your data and we do not share it with advertisers.
5. Cookies and similar technologies
This site is a simple one-page site. We do not currently set marketing or analytics cookies. Cloudflare may set strictly necessary cookies for security and performance. (If analytics are added to this site — planned via Cloudflare Web Analytics — this notice will be updated to describe them before they go live.)
6. How long we keep your data
We keep your email address until you unsubscribe or ask us to delete it, or until the waitlist is retired after launch. Records evidencing your consent may be retained for as long as needed to demonstrate PECR/UK GDPR compliance.
7. Your rights
You have the rights set out in UK GDPR, including access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time. To exercise any of them, contact support@forkitapp.net. We respond within one month of a valid request.
If you are unhappy with how we handle your data, you can raise it with us first at support@forkitapp.net — we will acknowledge your complaint within approximately 30 days, in line with the Data (Use and Access) Act 2025. You can also complain directly to the Information Commissioner's Office (ICO) — ico.org.uk, 0303 123 1113 — at any time; you do not have to complain to us first.
8. Changes to this notice
If we make material changes, we will update this page and, where appropriate, email the list. The current version is always at this URL.
Fork It App — Privacy Policy
What changed in version 2.6. We added section 3.7, which describes the small amount of usage and diagnostic information we now record in order to find and fix faults in the app. We also corrected the number of servings shown in section 3.2 (1–6, not 1–4), and clarified in sections 2 and 11 that Fork It is currently in Early Access and free to use.
1. Who we are
Fork It is operated by Wayne McCarten, a sole trader trading as Tacocat Technologies, of 9 Glandore Gardens, Portadown, Craigavon, BT62 3GG, United Kingdom ("we", "us", "our").
For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, we are the data controller for the personal data described in this policy. As a sole trader, the data controller is the named individual above. We are registered with the Information Commissioner's Office (ICO) under registration number ZC188197.
For any privacy-related question, including to exercise your rights, contact us at: support@forkitapp.net
2. What this policy covers
This policy explains what personal data we collect when you use the Fork It app, why we collect it, the legal basis we rely on, who we share it with, how long we keep it, and what rights you have. Fork It V1 is offered to users in the United Kingdom only. We do not currently offer the service to users in the EU/EEA or the Republic of Ireland, and have not appointed an Article 27 EU Representative; we will appoint one before any future EU/EEA launch.
Fork It is currently in Early Access and is free to use. Paid subscriptions are planned. When a payment mechanism is introduced, this policy will be updated to describe subscription and billing data before that feature goes live.
3. The data we collect and why
3.1 Account data
When you create a Fork It account, we collect:
- Your email address
- A password, which is stored only in hashed form
- Authentication metadata generated by our authentication provider (Supabase), including IP address, sign-in timestamps, and device or browser information used to access your account
We use this data to create your account, authenticate you, secure the service against unauthorised access, and contact you about your account or support requests.
Legal basis: Article 6(1)(b) UK GDPR — performance of a contract.
3.2 Preference and profile data
During onboarding and at any time afterwards in settings, you provide some or all of the following:
| Field | Required to use Fork It |
|---|---|
| Region | Yes |
| Dietary preferences | Yes (can be set to "none") |
| Number of servings (1–6, chosen when you generate a plan; a household default can also be saved in settings) | Yes |
| Allergens | Optional — but see section 3.3 |
| Favourite cuisines | Optional |
| Maximum cook time | Optional |
| Foods you dislike | Optional |
| Nutritional information display | Optional |
We use this data to generate your personalised weekly meal plan. The optional fields improve the quality of your plan but the app functions without them.
Legal basis: Article 6(1)(b) UK GDPR — performance of a contract.
3.3 Allergen and allergy data (special category data)
Information you provide about food allergies and intolerances is data concerning health under Article 9(1) UK GDPR — a special category of personal data that receives stronger protection in law.
We collect this data only because you choose to provide it. We use it for one purpose only: to instruct our AI engine to exclude those ingredients (and their derivatives) from every recipe we generate for you, and to run a deterministic ingredient scan on every generated recipe to verify the output against your declared allergens. Any recipe that fails the scan is automatically regenerated. The data is included in the prompt sent to the Anthropic API (see section 4) for the duration of plan generation, and is stored against your profile so that future plans continue to exclude those allergens.
We will never use your allergy data for any purpose other than keeping those ingredients out of your recipes. We will never share it with third parties for advertising, profiling, research, or any other purpose. It is never included in the usage and diagnostic records described in section 3.7.
Legal basis: Article 9(2)(a) UK GDPR — your explicit consent, captured at the point you enter allergen data during onboarding or in settings.
Withdrawing consent. You can remove allergens from your profile at any time in settings, which will withdraw your consent and stop further processing of that data. Meal plans previously generated will remain in your account as they belong to you, but no new plans will include the removed allergens — and importantly, no new plans will exclude them either, so re-add anything still relevant.
3.4 Meal plan and recipe data
The weekly meal plans, recipes, and shopping lists generated for you are stored in your account so you can access them across devices. Your current week's plan is also cached locally on your device so you can view it without an internet connection. This local cache is cleared when you delete the app or log out.
Legal basis: Article 6(1)(b) UK GDPR — performance of a contract.
3.5 Partner sharing data (V1.5 feature — not active in V1)
Partner sharing is planned for a future release (V1.5) and is not available in V1. No partner-linking data is collected while it is not active. This section will be completed when the feature launches.
3.6 Reminders (local notifications)
If you opt in to reminders, Fork It schedules them locally on your device. We send two reminders, both on a recurring weekly schedule at a day and time you choose: a weekly meal-planning reminder, and a mid-week nudge.
Because these reminders are scheduled on your device by the app itself, we do not collect or store a push notification token (such as an Apple APNs or Google FCM token), and no reminder data is sent to or held on our servers. You can withdraw consent at any time in app settings or in your device's notification settings.
Legal basis: Article 6(1)(a) UK GDPR — consent.
3.7 Usage and diagnostic data
To understand how Fork It is actually used — and in particular to find out where people get stuck or hit an error — we record a small, fixed set of app events against your account.
What we record. Only these events:
- when you finish onboarding;
- when you open the plan generation screen;
- when you press the generate button;
- whether that generation succeeded or failed, and if it failed, a short technical error code (for example, that you had reached the daily generation limit).
Each record contains only the event name, the date and time, your account identifier, and, for a failure, the error code.
What we deliberately do not record. These records never contain:
- any allergen, health, dietary or preference data;
- the content of your meal plans, recipes, or shopping lists;
- your IP address, device identifier, advertising identifier, or location;
- anything you type.
No third-party analytics. We do not use a third-party analytics provider, analytics SDK, or advertising network for this. The records are stored in our own database (Supabase, EU — Ireland) alongside the rest of your account data, and are not shared with anyone. They are never used to advertise to you, to build a profile of you, or to make any decision about you.
Why we do this. Without it, we can see that some people sign up and never generate a plan, but not why — whether they hit an error, could not find the button, or simply left. We cannot fix a problem we cannot locate.
Legal basis: Article 6(1)(f) UK GDPR — legitimate interests. Our legitimate interest is understanding and repairing faults and obstacles in our own app.
Balancing. We have considered your interests and rights against ours. The data is minimal and non-sensitive, is limited to a fixed list of events we chose in advance, involves no third party, no cross-app or cross-site tracking, no profiling, and no automated decision-making. It tells us that an action happened, not anything about you as a person. On that basis we consider this processing to be within your reasonable expectations of an app you have chosen to use, and not to override your rights.
Your right to object. You can object to this processing at any time under Article 21 UK GDPR by emailing support@forkitapp.net. If you do, we will stop recording these events for your account and delete the records already held for you. Objecting has no effect on your ability to use Fork It.
4. How AI is used in Fork It
The core function of Fork It is to generate meal plans and recipes using an AI model. We use the Anthropic Claude API for this purpose. When you generate a plan, your region, dietary preferences, allergens, and other preferences are sent to Anthropic, which returns the generated meal plan and recipes.
Two things to be clear about:
- This is not "automated decision-making" within the meaning of Article 22 UK GDPR. Recipe generation does not produce legal effects on you, nor does it significantly affect you in a similar way. You retain full control: you can regenerate any meal, regenerate a day, edit your preferences, or simply ignore a suggestion.
- Anthropic does not use your prompt data to train its AI models. Under Anthropic's commercial API terms, data sent through the API is not used for model training. You can read Anthropic's commercial terms at anthropic.com.
5. Who we share your data with
We do not sell your data. We do not share it with advertisers. We share it only with the service providers we need to operate Fork It, each of whom acts as our processor under Article 28 UK GDPR pursuant to a written data processing agreement.
| Service provider | Purpose | Location of processing |
|---|---|---|
| Supabase | Database and user authentication | EU (Ireland — eu-west-1) |
| Anthropic (Claude API) | Generating meal plans and recipes | United States |
| Apple / Google | App distribution and in-app billing | United States (with regional infrastructure) |
The usage and diagnostic data described in section 3.7 is held in our own Supabase database and is not sent to any additional provider.
International transfers
Some of these providers are located outside the United Kingdom. For transfers to the European Economic Area (the EU Supabase region in Ireland) we rely on the UK's adequacy regulations for the EEA. For transfers to the United States we rely on the following:
- Anthropic (US): the UK International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as incorporated into Anthropic's commercial API terms.
- Apple / Google: subject to those providers' own published UK transfer mechanisms.
We have carried out transfer risk assessments where required and apply supplementary measures where appropriate.
6. How we secure your data
We implement appropriate technical and organisational measures under Article 32 UK GDPR, including:
- TLS encryption of all data in transit between the app, our backend, and our processors
- Encryption of stored data at rest where supported by the relevant provider
- Hashed (one-way) password storage; we never see your password in readable form
- Restricted access to production systems and data
- Multi-factor authentication on administrative accounts
- Regular review of processor security and certifications
No system is perfectly secure. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where the risk is high, we will notify you directly without undue delay.
7. Tracking and identifiers
Fork It is a mobile app, not a website, and does not use cookies. We do use the following on-device identifiers:
- Authentication tokens issued by Supabase, which keep you signed in.
Reminders are scheduled locally on your device, so no push notification token is stored on our servers (see section 3.6).
The usage and diagnostic records described in section 3.7 are linked to your existing account identifier. We do not create, read, or store an advertising identifier, a device identifier, or any other tracking identifier on your device for this or any other purpose.
We do not track you across other apps or websites. Fork It does not use cross-app tracking technologies, and we do not display Apple's App Tracking Transparency permission prompt because we do not engage in cross-app tracking.
8. How long we keep your data
| Data type | Retention period |
|---|---|
| Account data (email, hashed password, auth metadata) | While your account is active, plus up to 30 days after deletion request to allow for backup cycles |
| Preference and profile data | While your account is active; deleted with your account |
| Meal plan history | While your account is active; deleted with your account |
| Allergen data | While your account is active; deleted immediately on removal from settings |
| Usage and diagnostic data (§3.7) | 12 months from the date of the event, or until your account is deleted, or until you object under §3.7 — whichever comes first |
When you delete your account, we delete your personal data in line with the above periods. Aggregated and irreversibly anonymised data, which is no longer personal data, may be retained for product and statistical purposes.
9. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access (Article 15) — request a copy of the personal data we hold about you
- Right to rectification (Article 16) — ask us to correct inaccurate data
- Right to erasure (Article 17) — ask us to delete your data; you can also delete your account directly from within the app
- Right to restriction of processing (Article 18) — ask us to pause certain processing
- Right to data portability (Article 20) — receive your data in a portable, machine-readable format
- Right to object (Article 21) — object to processing carried out on the basis of our legitimate interests. This applies to the usage and diagnostic data described in section 3.7, and we will act on any such objection
- Right to withdraw consent (Article 7) — withdraw consent for any processing that is based on consent (allergen data, reminders), at any time, without affecting processing already carried out
To exercise any of these rights, contact us at support@forkitapp.net. We will respond within one month of receiving a valid request, as required by Article 12(3). For complex or numerous requests, we may extend this by up to two further months and will let you know if so. We may need to verify your identity before actioning a request.
10. Complaints
We would prefer the chance to address any concern directly first — please contact us at support@forkitapp.net before escalating to a regulator. In line with the Data (Use and Access) Act 2025, we will acknowledge a data-protection complaint within 30 days.
If you remain unhappy, you have the right to complain to the Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113. You do not have to complain to us first.
11. Children
Fork It is intended for adults. The app is not directed at, and we do not knowingly collect personal data from, anyone under the age of 18. If you believe a person under 18 has provided us with personal data, please contact us and we will delete it promptly.
This is a stricter age limit than UK GDPR (which sets the age of consent for information society services at 13) requires, but we have set it deliberately: meal planning involves nutritional and allergen decisions we consider an adult matter, and Fork It is intended to be offered on a paid subscription basis.
12. Changes to this policy
If we make material changes to this policy, we will notify you in the app or by email before the change takes effect. The current version is always available at this URL, and previous versions are available on request. Continued use of Fork It after a change takes effect constitutes acceptance of the updated policy.
13. Contact
Delete Your Account
To delete your Fork It account and all associated data, email support@forkitapp.net from the email address registered to your account, with the subject line "Delete my account".
We will then delete the following within 30 days of your request:
- Your account login (email and password)
- Your profile and preferences (region, dietary preferences, allergens, cuisines, cook time, dislikes, nutrition settings)
- Your meal plan and recipe history
- Your favourited recipes
Billing and subscription records are not yet applicable, as Fork It does not currently process payments. Aggregated, anonymised data that can no longer identify you may be retained for product statistics.
You can also remove individual pieces of data (such as allergens) at any time without deleting your whole account, by editing your preferences in the app's Settings.
Fork It is operated by Wayne McCarten trading as Tacocat Technologies. See our App Privacy Policy above for full detail.