Privacy Policy

Last updated: 28 March 2026

DINNR ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, why we collect it, how it is processed, and your rights under the General Data Protection Regulation (GDPR) and applicable EU/EEA data protection law.

1. Who we are (Data Controller)

The data controller responsible for your personal data is:
DINNR
Email: dinnr@derekfidler.com

2. What data we collect and why

2.1 Account & recipe data

When you create an account we collect your email address and a securely hashed password (or, if you sign in with Google, a token from Google). Your recipes, meal plans, and grocery lists are stored on our behalf by Supabase (see section 5).

Legal basis: Article 6(1)(b) GDPR — processing is necessary to perform the contract (providing the DINNR service to you).

2.2 Usage analytics (PostHog)

We use PostHog to understand how people use DINNR — for example, which pages are visited, when recipes are created, and which client (web or desktop) is being used. This helps us prioritise improvements.

We do not send your email address, name, or any other directly identifying information to PostHog.
You are identified only by a random internal ID (your Supabase user UUID).
We do not collect your IP address (PostHog is configured with ip: false).
PostHog stores a small token in your browser's localStorage to maintain session continuity across visits.
All analytics data is stored on PostHog's EU-hosted infrastructure and does not leave the European Economic Area.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in improving product quality and reliability. This processing uses no directly identifying data and is limited to aggregated behavioural signals.

2.3 Crash & error reporting (Sentry)

We use Sentry to automatically capture errors and crashes so we can fix them quickly.

Error reports include stack traces, browser/OS information, and the page you were on when the error occurred.
If you are logged in, error reports are tagged with your Supabase UUID so we can correlate errors to specific accounts if needed for support. Your email address is never sent to Sentry.
All error data is stored on Sentry's EU-hosted infrastructure (Germany) and does not leave the EEA.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in maintaining the security and stability of the service.

3. Cookies and local storage

DINNR uses browser localStorage (not traditional cookies) for:

Keeping you logged in (Supabase session token)
Storing your language preference
PostHog anonymous session identifier
A flag indicating you have previously opened the app (used for onboarding analytics only)

None of this data is shared with third parties beyond the processors listed in section 5.

4. How long we keep your data

Data	Retention period
Account & recipe data	Until you delete your account
PostHog analytics events	12 months (PostHog default)
Sentry error events	90 days (Sentry default)

When you delete your account via Settings → Delete Account, all your recipes, meal plans, and grocery items are permanently deleted from our database. Your PostHog and Sentry records are identified only by UUID; you may request deletion of those records by contacting us (see section 7).

5. Data processors (third parties)

We use the following sub-processors to deliver the service. Each has been assessed for GDPR compliance and processes data only as instructed by us.

Processor	Purpose	Data location
Supabase	Database & authentication hosting	EU (Ireland)
PostHog	Product analytics	EU (PostHog Cloud EU)
Sentry	Error & crash monitoring	EU (Germany)

We do not sell your data to any third party, and we do not use it for advertising.

6. International transfers

All of our data processors are hosted within the EEA. No personal data is transferred to countries outside the EEA.

7. Your rights under GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure — ask us to delete your data ("right to be forgotten"). You can delete your account and all associated data directly in Settings.
Right to data portability — export your recipe data as JSON at any time via Settings → Backup Recipes.
Right to restrict processing — ask us to limit how we use your data.
Right to object — object to processing based on legitimate interests (analytics and crash reporting).
Right to lodge a complaint — you may lodge a complaint with your local supervisory authority. In the EU you can find your authority at edpb.europa.eu.

To exercise any of the above rights, contact us at dinnr@derekfidler.com. We will respond within 30 days.

8. Security

Passwords are hashed by Supabase and never stored in plain text. All data in transit is encrypted using TLS. We follow industry-standard security practices and monitor for errors via Sentry.

9. Children

DINNR is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the app. The date at the top of this page reflects when the policy was last updated.

11. Contact

For any privacy-related questions or GDPR requests:
Email: dinnr@derekfidler.com