Privacy Policy
Last updated 20 October 2026
This policy says what Scrandella collects about you, why, who else sees it, and what you can tell us to do about it. It covers the Scrandella app and scrandella.com.
Who we are and how to contact us
Scrandella is operated by Three Dudes Limited, a company registered in England and Wales, company number 16714605. Our registered office is on the public register at Companies House.
We are the data controller for the information described in this policy. That means we decide what is collected and why, and we are answerable for it.
To contact us about your information, use the Help page in the Scrandella app, or write to hello@scrandella.com.
We have not appointed a Data Protection Officer, and based on the size and nature of Scrandella we do not believe one is required.
What we collect
When you sign up
- Your email address
- Your password, stored as a hash, never as the password itself. We cannot read it
- Your username
- The date you joined, and when you last signed in
Your profile
- Display name, bio, avatar image and website link, if you add them
What you post
- Photographs you upload, and the shape you cropped them to
- Dish name, caption, cuisine, cooking time, difficulty, and a calorie figure if you add one
- Ingredients and method steps, if you add a recipe
What you do in the app
- Posts you like, and how many of your three likes you spent on each
- Posts you saved
- Comments you write, and comments you like
- Accounts you follow, and whether you asked to be told when they post
- Accounts you blocked
- Direct messages you send, who is in each conversation, and whether a message has been read
- Notifications generated for you
Moderation and safety
- The automated content score for each photo you post, and whether it was approved, held or refused
- Reports you make about posts or accounts, including the reason and anything you typed. Reports are not anonymous to us, only to the person reported
- Reports other people make about you
- Whether your account has been suspended or banned
Support
- Messages you send through the Help page, and our replies
Technical
- Your IP address and basic device information, recorded by our hosting provider in server logs as a normal part of running a service
What we do not collect
- Payment details. Scrandella does not take payments
- Location data. We do not ask for or record where you are
- Your contacts, photo library, or anything else on your device beyond the photos you choose to upload
- Analytics or advertising trackers
Why we use it, and our legal basis
UK data protection law requires us to have a specific lawful reason for each use. Ours are these.
| What we do | Why | Legal basis |
|---|---|---|
| Create and run your account | You cannot use Scrandella without one | Performance of a contract |
| Show your posts, likes and comments to other users | That is the service you signed up for | Performance of a contract |
| Deliver your direct messages | Same | Performance of a contract |
| Send you a confirmation email, and password reset emails | To prove the address is yours and let you back in | Performance of a contract |
| Send in-app notifications about likes, comments and follows | Part of using a social app | Performance of a contract |
| Check every photo with an automated content filter before it appears | To keep sexual and violent images off a food app that anyone can open | Legitimate interests |
| Review reports, and suspend or ban accounts | To protect users from harassment and illegal content | Legitimate interests |
| Keep a record of reports and bans | So the same account cannot simply return | Legitimate interests |
| Answer your support messages | To help you | Legitimate interests |
| Keep server logs | To keep the service running and secure | Legitimate interests |
| Respond to a legal request or report a crime | Because we have to | Legal obligation |
On legitimate interests
Where we rely on legitimate interests, we have weighed our reason against your privacy. Content moderation is the clearest case: checking photographs is intrusive, but an unchecked feed on an app with no age gate is worse, and the check is automated and brief rather than a person browsing your photos.
You can object to any use based on legitimate interests. See your rights below.
Who else sees your information
Other users
Your username, avatar, bio, website and posts are visible to anyone using Scrandella. So are your comments, and the fact that you liked or follow something. Treat anything you post as public.
Your email address, your password, your saved posts, your blocks and your direct messages are not visible to other users.
Companies that process it for us
We use four third parties. None of them are allowed to use your information for their own purposes.
| Who | What they handle | Where |
|---|---|---|
| Supabase | The database, your photos, and sign-in. Effectively everything | France (Paris) |
| OpenAI | Each photo and its dish name and caption, sent to an automated moderation check | United States |
| Resend | Your email address, to deliver confirmation and password reset emails | United States |
| Apple and Google | App distribution, and crash reporting if enabled | United States |
About the OpenAI check
When you post, the photograph and its text are sent to OpenAI's moderation service, which returns a score for sexual and violent content. OpenAI states that data submitted to this endpoint is not used to train its models. The check is automated and no person at OpenAI reviews your photo.
Our own access
Scrandella administrators can see posts held by the filter or reported by users, including the photograph, in order to decide them. Administrators can also read support messages you send. Administrators cannot read your direct messages.
Law enforcement
We will disclose information where we are legally required to. We will report sexual content involving children to the relevant authorities, and preserve the associated account data, without waiting to be asked.
Where your information is stored
Our database, your photographs and our sign-in system are hosted by Supabase in France, in their Paris region.
France is in the European Economic Area, which the UK recognises as providing an adequate level of data protection. That transfer therefore needs no additional safeguards.
Some of the companies above are in the United States, which does not have that recognition. Where information is transferred there, we rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum, depending on the provider, together with their own contractual commitments on security and confidentiality.
In practice this means:
- Photographs and captions are sent to OpenAI in the United States for the automated content check
- Email addresses are sent to Resend in the United States to deliver sign-up and password emails
- Everything else stays with Supabase
How long we keep it
| What | How long |
|---|---|
| Your account, profile and posts | Until you delete them, or delete your account |
| Direct messages | Until the conversation is deleted by a participant, or the account is deleted |
| Deleted posts and photographs | Removed from our storage when you delete them |
| Reports you made or that were made about you | 12 months after the report is closed |
| Records of a ban | Kept after account deletion, as a record that the account was banned and why |
| Support messages | 24 months |
| Server logs | 30 days |
When you delete your account
Deleting your account from Settings removes your profile, posts, photographs, comments, likes, saves, follows, blocks, messages and notifications, and the account itself. It cannot be undone and we cannot restore it.
Two things survive deletion:
- Comments you left on other people's posts may remain visible with your username removed, because deleting them would break conversations other people took part in
- If your account was banned, we keep a record of that, so that the ban cannot be escaped simply by deleting and signing up again
Backups are kept by our hosting provider on a rolling basis and deleted information disappears from those within 30 days.
Your rights
Under UK data protection law you have the following rights, free of charge.
See what we hold. You can ask for a copy of your personal information. We will respond within one month.
Correct it. Your username, display name, bio, avatar and website are editable in the app. Anything else, ask us.
Delete it. Delete your account from Settings, which removes almost everything immediately. You can also ask us to delete specific information. Where we are keeping something for a reason set out above, for example a ban record, we will tell you so and why.
Take it with you. You can ask for your posts, captions, recipes and comments in a machine-readable file.
Restrict what we do with it. You can ask us to stop using your information while a dispute about its accuracy or our use of it is resolved.
Object. Where we rely on legitimate interests, you can object. Note that we will refuse an objection to content moderation while your account is active, because we cannot run the app safely without it. You remain free to delete your account.
Withdraw consent. Where we rely on consent, you can withdraw it at any time. That does not affect anything done before you withdrew it.
How to exercise any of these: use the Help page in the app, or write to hello@scrandella.com. We may ask you to confirm who you are before we act, to avoid handing your information to somebody else.
If you are unhappy with how we handled it, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.
Children
You must be at least 13 to use Scrandella. We do not knowingly collect information from anyone under 13, and we remove accounts we believe belong to a child under 13 along with their content.
If you believe a child under 13 has an account, report it from their profile and choose "They may be under 13", or contact us. These reports are dealt with before other reports.
If you are a parent and believe your child has given us information, contact us and we will delete it.
Because people under 18 can use Scrandella, the Information Commissioner's Office expects us to design it in their interests. In practice that means we do not profile users, we do not serve behavioural advertising, we do not use engagement-maximising techniques such as streaks or autoplaying content, we collect the minimum we need to run the app, and the automated content filter applies to every post with no way to opt out.
Security, and what is kept on your device
Security
Your password is stored as a hash, so nobody including us can read it. Connections between the app and our servers are encrypted. Access to the database is restricted by row-level security rules, so one user cannot read another user's private information even if they bypass the app.
Administrator access is limited to accounts we have deliberately marked as administrators.
No service is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office within the time the law requires.
What is stored on your device
Scrandella stores your sign-in token on your own device so that you stay signed in, along with small settings such as whether you turned calorie display off. On the web this uses your browser's local storage.
These are necessary for the app to work. We do not use cookies or similar technology for advertising, analytics or tracking, which is why Scrandella does not show you a cookie banner.
Signing out, or clearing your browser data, removes them.
Changes to this policy
We will update this policy as Scrandella changes. The date at the top is when it was last changed.
If we make a change that materially affects you, for example collecting something new or using your information for a new purpose, we will tell you in the app before it takes effect.
Older versions are available on request.