Privacy Policy

Effective date: 3 October 2026

1. Who we are

Nomology is operated by Nomology Ltd, a company registered in England and Wales (company number 17107398).

2. What data we collect

Before you create an account

When you first open Nomology, the first thing we ask is when you were born (see "Your age" below). Your answer stays on your device and is only stored with us if you go on to create an account. Then we ask you a few quick questions about your tastes — for example, which dishes you like the look of and any foods you would rather avoid — so we can show you a personalised sample of recipes before you decide whether to sign up. You answer by tapping and swiping. At this stage we do not ask for your name, email address, or any free-typed text.

Your taste answers are held against a temporary, anonymous profile — not a named account, and your age is not part of it. If you go on to create an account, this profile becomes part of it. If you leave before signing up, we aim to delete these abandoned answers within 30 days.

Account information

When you create an account, we collect your email address and display name. You may optionally add a profile photo. If you sign in using Apple or Google, we receive basic profile information from those services (but not your password).

Your age

We ask when you were born at the very start of the app, before anything else. Nomology is for ages 13 and over, so we need your age before you can register — if you don't give it, you can't create an account, and if you are under 13 you cannot register and nothing you entered is kept. Your answer stays on your device and is only stored with us when you create an account. We store your birth year. If you are under 18, we also ask for your full date of birth, so we can check you are old enough — and so we know exactly when you turn 18, because recipes that contain alcohol stay hidden until then.

We use your age for two things. First, some recipes contain alcohol, and we don't show those recipes to anyone under 18. Second, we group users into age ranges (for example 25-34 for adults, or 13-14 for younger users) to improve recommendations. We do not use your age for advertising, and we do not send your birth year or date of birth to any analytics service.

Your food preferences

To recommend recipes you'll enjoy, we collect information about your tastes, including recipe ratings, ingredient preferences, cuisine preferences, cooking skill level, and equipment you have available. If you choose to exclude certain ingredients (for any reason—allergies, dietary requirements, or personal preference), we store those exclusions to filter your recommendations. You can also add a food you would rather avoid while you change a recipe with our AI chef; we store it with your other exclusions, and you can remove it in your profile.

Content you create

If you use our premium features, we store recipes you create or import, recipe collections, meal plans, shopping lists, and notes you add to recipes. If you join or create a Circle (a shared group), we store content you share within that group.

Usage information

We collect information about how you use the app, including which features you access, recipes you view, and actions you take (such as swiping, bookmarking, or starting a cooking session). We also collect technical information such as your device type, operating system version, app version, and general location (city-level, derived from your IP address). We do not track your search queries or the specific ingredients you exclude.

We use crash reporting to identify and fix problems. Crash reports include technical information about your device and what happened before the crash, but are sanitised to remove any personal information such as authentication tokens.

To link your activity across sessions (for example, to understand your journey from signing up to subscribing), we associate analytics data with your account. This is used solely for internal product improvement and is not shared for advertising purposes.

Information stored on your device

Like most apps, Nomology and the services we use store and read small amounts of information on your device — for example, to keep you signed in, to remember your settings, and, through our analytics and crash-reporting tools, to recognise your device between sessions and to detect and fix technical faults. Before you create an account, product analytics are switched off by default, so this early activity is mainly what the app needs to run and to recover from crashes. You can manage app permissions, such as notifications, in your device settings.

Subscription information

If you subscribe to a paid plan, we track your subscription status and AI feature usage (to enforce usage limits). We do not see or store your payment card details—payments are handled entirely by Apple or Google.

Share link attribution

When you click a share link from a friend (e.g., an invitation to join their Circle), we collect device signals to connect you to that invitation after you install the app. This includes your device type, screen resolution, timezone, browser language, browser type, and a partial network identifier (not your full IP address). This data is used solely to complete the referral you initiated, is stored for a maximum of 24 hours, and is automatically deleted after a successful match or when the 24-hour period expires—whichever comes first. We do not use this data for advertising or cross-site tracking.

Taste Buds matches

When you and another person compare tastes, we store a record of the match: who the two of you are, the scores we worked out, and the recipe we suggested. If you both choose to compare your tastes in more detail, we also store a record of that choice.

3. How we use your data

We use your information to provide and improve Nomology, including to give you personalised recipe recommendations based on your taste profile, to enable features you've chosen to use (meal planning, shopping lists, Circles, Taste Buds), to process your subscription and enforce usage limits, to send you important service messages (such as password resets or subscription confirmations), to fix bugs and improve the app, and to prevent fraud and abuse.

We do not use your personal data for advertising. We do not sell your personal data to third parties.

Anonymised analytics

We may retain de-identified data — including individual taste profiles and ratings that have been irreversibly stripped of information identifying you — to improve our recommendation models and for analytics. Once de-identified in this way, the data can no longer be linked back to you and is no longer personal data. We may also report aggregated trends (for example, "40% of users prefer spicy food"), but never information about any individual.

4. Our legal basis for processing

Under UK data protection law, we need a lawful basis to process your personal data. Our bases are as follows:

Processing activity	Legal basis
Providing the app and its features	Contract (necessary to deliver the service you've signed up for)
Personalising recommendations	Legitimate interests (improving your experience)
Checking your age, and not showing recipes that contain alcohol to under-18s	Contract (we need your age before you can create an account) and legitimate interests (protecting under-18s, in line with UK licensing law and the ICO's Children's Code)
Subscription management	Contract
Fixing bugs and improving the app	Legitimate interests
Preventing fraud	Legitimate interests
Sending service messages	Contract / Legitimate interests
Anonymised analytics	Legitimate interests
Share link attribution	Legitimate interests (completing user-initiated referrals)
Taste Buds matching (compatibility score and suggested recipe)	Contract (a feature you chose to use by sharing or opening a Taste Buds link)
Comparing your tastes with someone in Taste Buds (the flavour dials and the flavours you have in common)	Consent (you can withdraw at any time; nothing is shown unless you both agree)

5. Who we share your data with

Other people who use Nomology

Taste Buds. Taste Buds compares your food preferences with someone else's. You start it by sending them a Taste Buds link. When someone opens your link, we create a match.

In a match, you are both shown how well your tastes match overall, how well the suggested recipe suits each of you, each other's display name, and a recipe we think you'd both enjoy — along with the words that describe how that recipe tastes (for example "smoky" or "zesty"). Those words describe the recipe, not either of you.

We do not share your taste profile itself, your individual recipe ratings, or the list of ingredients you've chosen to exclude. We don't show your email address or your profile photo. We do use both people's exclusions when choosing the recipe, so the suggestion works for both of you.

Your Taste Buds link is reusable and doesn't expire, and it can be passed on. Anyone who has it — including someone it was forwarded to — can create a match with you, without being asked to check with you first. So only share it with people you're happy to compare tastes with. You'll see any new match in the app, and we'll send you a notification about it.

Comparing your tastes in more detail. Within a match, the two of you can also choose to compare your tastes more closely. This happens only if you and the other person both choose to; if only one of you does, nothing is revealed. It's available only between adults.

When you both agree, each of you sees two things. First, a set of dials across five flavour dimensions — HEAT, UMAMI, SWEET, HERBAL and BRIGHT — each showing where you sit and where the other person sits. These show how strongly a flavour comes through in your tastes: an intensity, not whether you like or dislike it. Second, a short list (up to eight) of the specific flavours you have in common, such as "smoky" or "zesty". We never show a shared dislike of a flavour linked to a common allergen — such as nuts, soy or fish — because two people avoiding the same one could suggest an allergy; a shared liking for one of those flavours can still appear.

You can also share a picture of your match with other people. That picture shows only the dials, with the other person labelled simply "them" and never named; the list of flavours you have in common stays inside the app.

You can stop at any time by tapping "Stop sharing" on the match. The comparison is then hidden from both of you immediately. We don't notify the other person, though they will see that it is no longer showing. We never store the dials or the flavours you have in common — they're worked out afresh each time you open a match.

Service providers

We use trusted third-party services to operate Nomology. These providers process data on our behalf and are contractually required to protect it.

Service	Purpose	Data shared
Supabase	Database and authentication	All account and preference data (encrypted, stored in EU)
Render	Backend hosting	Data processed by our backend services (hosted in EU)
RevenueCat	Subscription management	User ID, subscription status
Apple App Store / Google Play	Payment processing	Purchase transactions (we don't see card details)
Anthropic (Claude AI)	AI recipe features	Recipe text, prompts you submit, and a coarse preference signal (no user identifiers)
Google Cloud (Imagen)	AI image generation	Recipe descriptions (no user identifiers)
Firebase	Push notifications	Device tokens
Firebase Analytics	App analytics	Usage events, device info, city-level location, user ID
Firebase Crashlytics	Crash reporting	Crash logs, device info, user ID (for correlation)
Resend	Email delivery	Email address, email content

AI features and your prompts

When you use AI features (such as creating a recipe from a URL, refining a recipe, or describing a dish to our AI chef), the text you provide is sent to our AI providers. In addition to the text you type, we may send a coarse preference signal derived from your settings — for example, how adventurous you would like your recommendations to be (a simple "conservative", "balanced" or "bold" level) — so the AI can tailor its suggestions. We never send your user ID, name, or other personal identifiers with any of this data. Please be aware that if you include personal information in your prompts (for example, "my husband John is allergic to..."), that text will be processed by the AI service.

When you change a recipe with our AI chef, you can tap the parts you want changed and say why — by picking a reason or typing your own words. Those picks and words are sent to our AI provider only to make that one change. We do not store them, and we do not use them for your recommendations. If you tap "I can't eat it", we also send the names of closely related foods, so the AI can leave them out too. If you type something about someone else's health (for example, "my partner is pregnant"), please only do so if that person is happy for you to share it.

When you describe a dish to our AI chef, the prompts you send and the recipe options it returns to you are also stored on our own servers (hosted by Supabase in the European Union), linked to your account, so that we can show you your past conversations. We keep this content while your account is active, and it is deleted when you delete your account (within 30 days).

6. International data transfers

Your main account data is stored by Supabase in the European Union (Stockholm, Sweden). Some of our other service providers are based in the United States, including Anthropic, RevenueCat, Firebase, and Google Cloud.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place. Our US-based providers operate under the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum issued by the Information Commissioner. These are the transfer mechanisms recognised under UK data protection law, and they place contractual protections on your data.

7. How long we keep your data

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days. Some data may be retained for longer if required by law (for example, financial records for tax purposes) or if anonymised for analytics.

Onboarding answers from people who leave before creating an account: we aim to delete these within 30 days.

Share link attribution data is retained for a maximum of 24 hours and is automatically deleted after a successful match or when the period expires.

A Taste Buds match, and the record of whether you chose to compare your tastes, last until either of you deletes their account — at which point both are deleted. We keep an anonymous note that a consent choice was made, with the account it belonged to removed, so that we can show we handled consent properly. The flavour dials and the flavours you have in common are never stored — they are worked out afresh each time you open a match.

8. Your rights

Under UK data protection law, you have the following rights:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct inaccurate data.
• Erasure: You can ask us to delete your data (the "right to be forgotten").
• Portability: You can request your data in a portable format.
• Objection: You can object to processing based on legitimate interests.
• Restriction: You can ask us to restrict processing in certain circumstances.
• Withdrawing consent: Where we rely on your consent — for example, to compare your tastes with someone in Taste Buds — you can withdraw it at any time in the app. For Taste Buds, that's "Stop sharing" on the match.

To exercise any of these rights, please email privacy@nomology.food. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

9. Data security

We take reasonable measures to protect your data, including encryption of data in transit and at rest, secure authentication (including support for Apple and Google sign-in), access controls limiting who can access user data, and regular security reviews.

However, no system is completely secure. If you become aware of any security issues, please contact us immediately at privacy@nomology.food.

10. Children's privacy

Nomology is for ages 13 and over. You have to be at least 13 to make an account. We ask when you were born as the very first question in the app, and we don't let you make an account if you are under 13 — and in that case nothing you entered is kept.

If you are 13 to 17, we don't show you recipes that contain alcohol. We ask for your full date of birth as well as your birth year, so we can be sure how old you are — and so alcohol recipes only appear from your 18th birthday. When you change a recipe with our AI chef, you can pick from the list of reasons, but anything you type is not sent to the AI.

If you have questions about your data, or you want a copy of it or want it deleted, email us at privacy@nomology.food. You can ask a parent or another grown-up to help you.

If you are a parent or carer: we do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, please contact us at privacy@nomology.food and we will delete it.

11. Changes to this policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you through the app or by email before the changes take effect. The "effective date" at the top of this page shows when the policy was last updated.

The Taste Buds section added on 2 August 2026 describes a feature that was already in the app — that sharing was already happening, and this policy had not explained it before.

This update adds the "Before you create an account" and "Information stored on your device" sections and clarifies our international-transfers wording, to describe onboarding and device-storage practices this policy had not previously set out.

On 10 August 2026 we expanded the Taste Buds section to describe comparing your tastes in more detail: the flavour dials (HEAT, UMAMI, SWEET, HERBAL and BRIGHT) that show how strongly each flavour comes through for each of you, the fact that a shared picture shows only the anonymised dials and never names the other person, that the flavours you have in common stay inside the app, and that none of it is stored.

Also on 10 August 2026 we added the "Your age" section, updated the "Children's privacy" section, and added a row to the legal-basis table to explain that we ask your age when you create an account, why we need it, and what we do with it. This describes collection that was already happening; this policy had not explained it before.

On 12 August 2026 we updated the "Your age", "Before you create an account" and "Children's privacy" sections: the age question now comes at the very start of the app, before anything else (your answer stays on your device and is only stored if you create an account); if you are under 18 we now ask for your full date of birth — not only when your birth year means you might not yet be 13 — so we can be sure how old you are and know exactly when you turn 18; and if you are under 13, you cannot register and nothing you entered is kept.

On 3 October 2026 we updated the "Your food preferences" and "AI features and your prompts" sections to explain the reasons and words you can give when you change a recipe with our AI chef: they are sent to our AI provider only to make that change and are not stored, and if you are 13 to 17 anything you type there is not sent. We also updated "Children's privacy" to say this.

12. Contact us

If you have any questions about this privacy policy or how we handle your data, please contact us: