Information you give us

When you create an account, we collect details such as your first name, email address and login credentials. Password sign-in is handled through Supabase Auth. We do not display or store your password in plain text in the food analyser database.

When you submit a food experience, we collect the food name, rating, preparation method, portion size, ostomy type, selected symptoms and any notes you choose to provide.

To reduce spam and protect the reliability of community submissions, we may store a hashed technical fingerprint for anonymous submissions. This can be based on limited technical information such as IP address and browser/device information. We do not store the raw IP address in this anti-spam log.

We also record basic first-party site activity, such as page views, sign-ins and sign-ups, so En Route Living can understand usage and maintain the service. This analytics record does not store your email address or raw IP address.

Health-related data

Your ostomy type, selected symptoms, tolerance ratings and free-text food experience notes may reveal information about your health. When this information is linked to your account or email address, we treat it as health-related personal data and special category data under UK GDPR.

We use this information to let you keep a personal food history, show combined community patterns, moderate submissions and improve the food database. We do not use this information to provide medical advice, diagnose conditions or make automated decisions about you.

We also use submission and technical information to prevent spam, duplicate submissions, abuse and manipulation of community scores.

How submissions are shown

Public food pages show combined community results, such as average suitability scores, report counts and reported issue percentages. They may also show a small number of written experience notes, but they do not show your email address.

Admin users can view account details and individual submissions so they can moderate the database, remove inappropriate content and keep the information useful.

Service providers

Supabase provides the database and account authentication. Supabase may process account, authentication and submitted content data as part of providing those services.

Vercel hosts the website. Vercel may process technical information needed to serve and protect the site, such as request logs, IP-derived location information, browser/device information and error logs.

If the food analyser is embedded into enrouteliving.com, Shopify may also process information connected to your visit to the Shopify-powered website. Shopify customer account, order or checkout information is handled under the main En Route Living privacy policy and Shopify's privacy terms.

How your data is stored, processed and protected

The food analyser uses Supabase to provide account authentication and database storage, Vercel to host and run the website, and GitHub to store the application code. Supabase stores account details, profile information and food experience submissions. Passwords are handled by Supabase Auth and are not stored in plain text by En Route Living.

Vercel may process technical information needed to host, secure and run the website. Vercel also stores environment variables and service keys that allow the website to connect securely to Supabase, Resend and other services. These keys should not be published in GitHub or shown publicly.

GitHub stores the website code and database migration files. It should not contain user submissions, passwords, health-related profile data or secret service keys.

Access to user data is restricted to authorised En Route Living admin users and service providers who need to process the data to provide hosting, authentication, database, email or security services. Food experience data may include health-related information, so we treat it as sensitive information and use access controls to limit who can view it.

No online system can be guaranteed to be completely risk-free, but the food analyser uses provider security controls, restricted admin access, Supabase row-level security policies and private environment variables to reduce the risk of unauthorised access.

Cookies and login sessions

The site uses cookies or similar browser storage to keep you signed in, remember that you accepted the disclaimer and support password reset/account flows.

The site may also use quiet anti-spam checks, such as hidden form fields, form timing checks and hashed technical fingerprints for anonymous submissions. These checks help protect the community database without requiring every visitor to log in before contributing.

We may use browser storage to avoid counting the same page repeatedly in a single browsing session.

Your choices and rights

You can update your profile details from your dashboard. You can delete individual submissions from your dashboard, and you can request account deletion from your profile page. Account deletion is designed to remove your account and food experience entries from the food analyser.

You can also contact us to ask for access, correction, deletion, restriction or objection relating to your personal data. We may need to keep limited records where required for security, legal or operational reasons.

You can start this process from the privacy requests page.