Privacy policy

Who we are

Nomstash is a product from TraitSpan. This Privacy Policy explains how we handle personal data on:

• our marketing website at nomstash.com
• our app at app.nomstash.com

We are based in the United Kingdom and aim to process personal data in line with UK GDPR, EU GDPR (where applicable), and other applicable privacy laws.

Privacy at a glance

• We use analytics on the website and app to improve Nomstash. It is on unless you turn it off.
• We use required technologies for authentication, security, and core app operation.
• We do not sell personal data.
• You can accept or turn off analytics in the consent banner or from Cookie choices at any time.

Data we collect

Information you provide

• Account details such as name and email address.
• Registration preferences, including terms acceptance and email marketing preference.
• Content you create in the app, such as recipes, meal plans, shopping lists, freezer inventory, and settings.
• Images you upload, for example photographs of freezer labels for text recognition.
• Messages you send us (for example, support emails).

Authentication and security data

• Sign-in uses one-time codes sent to your email through Amazon Cognito/SES.
• Session and token data needed to keep you signed in and protect your account.
• Kiosk mode stores session token data in browser local storage for kiosk continuity.

Third-party account connections

If you choose to connect a third-party account (for example, Google Calendar), we receive limited access tokens and the specific data needed to provide the feature (such as calendar event times to help plan meals around busy days). We only request the minimum permissions required, and you can disconnect at any time from your account settings.

Usage and technical data

We use a first-party analytics setup (PostHog via Nomstash domains) to understand performance and product usage. This may include page views, interaction events and diagnostics, linked by an analytics identifier shared between the website and the app. They are collected unless you turn analytics off. Session recording only runs if you accept analytics.

How we use data

• Provide, secure, and maintain the service.
• Authenticate users and manage account access.
• Operate core app features and sync your data.
• Process images you upload to extract text (for example, reading freezer label text).
• Use AI services to help extract and structure recipe data you import from external sources.
• Send automated service emails such as defrost reminders, account invitations, and one-time sign-in codes.
• Improve reliability, performance, and usability.
• Send marketing emails only where you have opted in.

Legal bases we rely on

• Contract: to provide the service you request.
• Legitimate interests: for security, fraud prevention, and service improvement, including analytics you have not turned off.
• Consent: for session recording and marketing emails (where required by law).
• Legal obligations: where we must retain or disclose data by law.

Cookies and similar technologies

We use cookies and local storage for consent, authentication, analytics, and kiosk session continuity. See our Cookie Policy for details, including cookie names and durations.

How we share data

We share data with service providers only where needed to operate Nomstash, such as:

• AWS services (including Cognito, DynamoDB, SES, S3, Rekognition, and IoT) for account management, storage, authentication, image processing, and device communication.
• OpenAI for AI-assisted recipe extraction and ingredient matching. Recipe text you import may be sent to OpenAI for processing. OpenAI's data usage is governed by their own policies.
• Google (if you connect Google Calendar) for calendar-aware meal planning. We request read-only calendar access and store OAuth tokens securely.
• Cloudinary for image hosting and processing related to label images.
• PostHog for analytics, to help us improve the service.

We do not sell personal data or share it for third-party advertising profiles.

Shared accounts

Nomstash supports multi-user accounts (for example, household members). When you join a shared account, other members of that account can see shared content such as recipes, inventory items, meal plans, and shopping lists. The account lead can invite or remove members. Your name and email are visible to other members of your account.

Physical labels and QR codes

Nomstash uses physical label stickers with QR codes to track freezer inventory. Each label contains a short code linked to your account. Scanning a label retrieves the associated inventory item within your account. Label codes do not contain personal information, but they are associated with your account data within the app.

International transfers

Your data may be processed in the UK, EEA, and other countries where our providers operate. Where required, we use contractual or legal safeguards for international transfers.

Data retention

We keep personal data only as long as necessary for service delivery, legal obligations, dispute resolution, and legitimate business needs. Cookie lifetimes are listed in the Cookie Policy.

Your rights

Depending on your location, you may have rights to:

• access a copy of your personal data
• correct inaccurate data
• request deletion of your data
• restrict or object to certain processing
• withdraw consent for optional analytics or marketing
• lodge a complaint with a relevant supervisory authority

Security

We use technical and organizational measures designed to protect personal data. No method of transmission or storage is completely secure, but we continuously work to protect service data and account access.

Children

Nomstash is not intended for children under 13. If you believe a child has provided personal data, contact us and we will review and remove data where appropriate.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the latest version on this page.

Contact us

For privacy requests or questions, email privacy@nomstash.com.