Privacy policy

Last updated 8 August 2026

This policy explains what personal data the Zesd app collects, why we collect it, who else sees it, and what you can ask us to do with it. It is written to be read, not to be survived.

The controller of your personal data is ZESD LTD, a company registered in England and Wales under number 15168580, with its registered office at Flat 13, Makers House, 10 Tandy Place, London E20 3AQ, United Kingdom. Write to support@zesd.co.uk about anything in this policy.

What we collect

Your account

You sign in with Apple or Google. We store your email address and the account identifier our authentication provider gives us. We do not store a password for Zesd, because there is no Zesd password to store.

What you tell the app about your cooking

How many adults and children you shop for, the diets you follow, cuisines you prefer, and whether you would rather we optimise for price or for quality. We use this to choose which recipes and products to suggest. If you set a dietary preference that reflects a belief — for example vegetarian or halal — we treat it as part of your food preferences and use it for nothing but filtering recipes.

What you create

Recipes you write or import, photos of recipes you upload, meal plans, favourites, shopping lists, and the baskets we build from them. Support messages you send us, plus any screenshots you attach.

Your supermarket accounts

To load a basket for you, Zesd needs to be able to sign in to your account at that supermarket. Depending on the shop, that means we store either the username and password you give us, or the session cookies captured when you sign in through the supermarket's own login page inside the app. We also keep the one-time codes you enter when a shop emails one during sign-in, for as long as the sign-in takes.

They are stored encrypted, and are read only when a sign-in you have asked for needs them. We use them for one purpose: signing in as you at that supermarket, reading your basket, and adding the items you asked for. We never place an order, never enter payment details, and never buy anything. You can remove any shop's credentials from the app at any time, in Profile → Shop logins, and doing so deletes them.

Your device and how you use the app

Platform, app version, build number, operating system version, device model, language and time zone are sent with each request so we can reproduce bugs. If you turn on notifications, we store the push token your device issues. We record analytics events (screens opened, actions taken, whether a cart load succeeded) and crash reports.

Session recordings

We record replays of app sessions so we can see how the app is actually used and diagnose problems that are impossible to reproduce from a description. These recordings capture what is on screen, including recipes and photos. Screens where you enter supermarket credentials or a one-time code are masked and are not recorded. If you would rather not be recorded at all, email us and we will exclude your account.

Why we are allowed to use it

To provide the app you asked for — account, meal plans, shopping lists, basket loading and support. Without this data there is no product, so the legal basis is performance of our contract with you.
To keep the app working and improve it — crash reports, analytics and session replays. The legal basis is our legitimate interest in a product that works; you can object at any time by writing to us.
To send you notifications — only if you allow them on your device, and you can withdraw that permission in your device settings.

Who else sees it

We do not sell your personal data and we do not use it for advertising. We do rely on other companies to run the service; each one only gets what it needs for its job:

Supabase — sign-in and account identity.
Amazon Web Services — our database and servers, file storage for your photos in London (eu-west-2), and email delivery in Ireland (eu-west-1).
PostHog (EU hosting) — analytics events and session replays.
Sentry (United States) — crash and error reports.
OpenAI (United States) — when you add a recipe from a photo, the photo is sent to OpenAI so its model can read the recipe out of it. Recipe text is also sent when we translate or interpret it.
Expo (United States) — delivering push notifications to your device.
Slack (United States) — new support tickets are posted to our private support channel, including your email address and your message.
Network and anti-bot providers — supermarket sign-in traffic is routed through a UK residential proxy provider, and where a shop uses a CAPTCHA we use a solving service. These see the connection to the supermarket, not your Zesd account.
The supermarket you choose — we sign in to your account there and add items to your basket, exactly as you would.

Some of these are outside the UK. Where that happens, transfers are covered by the UK International Data Transfer Agreement or the addendum to the EU Standard Contractual Clauses in our contracts with them.

We will also disclose data if the law requires it, or to establish or defend legal claims.

How long we keep it

Your account data is kept while your account is open. Supermarket credentials are kept until you remove that shop or delete your account. Support tickets are kept for as long as we may need them to handle a follow-up, and go when your account does. Analytics and crash data are kept according to the retention settings of the providers above, which are measured in months, not years.

Meal plans and recipes outlive the account that made them, with nothing linking them back to a person. Once that link is gone they are no longer information about you, and we keep them as part of the catalogue.

Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to someone else. Ask by emailing support@zesd.co.uk. We answer within one month, and it is free.

Deleting your account. Profile → Delete account deletes your account and everything that identifies you: your email address, your sign-in, any supermarket logins you had connected, your support messages and anything you had uploaded. The meal plans and recipes you built are kept with nobody attached to them, so they no longer say anything about you. If you would rather those went too, email support@zesd.co.uk and we will remove them.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Children

Zesd is for adults doing a household food shop. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has an account, email us and we will remove it.

This website

This site sets no cookies and runs no advertising or analytics scripts. It does load its typefaces from Google Fonts, which means your browser requests them from Google and Google sees your IP address and browser version in doing so.

The public pages that show a shared recipe or meal plan record an anonymous "link opened" event and store a random identifier in your browser so one person opening a link twice is not counted as two.

Changes

If we change this policy we will update the date at the top, and we will tell you in the app if the change is one that affects you materially.