Privacy Policy
How we collect, use, and protect your data when you use Biltong Buddy.
Introduction
Biltong Buddy (“we”, “us”, or “our”) operates the Biltong Buddy progressive web application and associated services, available at biltongbuddy.app. Biltong Buddy is a food tracking app for hobbyist and small-scale biltong makers to log drying progress, monitor weight loss, and record recipes.
This Privacy Policy explains what personal data we collect, why we collect it, how it is stored and protected, and what rights you have over it. We are committed to being transparent and straightforward — no legal jargon where plain English will do.
For the purposes of UK GDPR, we are the data controller. Our designated contact for privacy matters is reachable at [email protected].
By creating an account or using Biltong Buddy, you agree to the collection and use of data as described in this policy. If you do not agree, please do not use the app.
We do not sell your personal data to third parties. We collect only what we need to run the service, and we give you tools to access, export, and delete everything we hold.
Information We Collect
We collect information in three ways: directly from you when you use the app, automatically as you use the service, and from third-party authentication providers if you choose to sign in with Google.
Account Data
- Email address — required to create and manage your account, and to contact you about important service updates.
- Display name — optional, used to personalise your experience within the app.
- Password — if you register with email and password. We never store passwords in plain text. All passwords are hashed using bcrypt via Supabase Auth.
- Google OAuth profile — if you sign in with Google, we receive your Google account email address and display name. We do not receive your Google password or payment information.
App Usage Data
This is the core content you create inside Biltong Buddy:
- Batches — name, start date, end date, status, notes, and drying environment details (temperature, humidity if recorded).
- Pieces — cut names, initial weight, current weight, weight-loss percentage, target weights, photos (if uploaded).
- Recipes — ingredient lists, curing parameters, prep notes, and usage history.
This data is essential to the service. Without it, Biltong Buddy cannot function.
Device and Technical Data
- Browser type and version — collected automatically to help us identify compatibility issues.
- Operating system — used to understand what platforms our users are on.
- IP address — collected by our hosting infrastructure (Cloudflare). Used for security, abuse prevention, and approximate geolocation (country-level only).
- Session identifiers — a unique identifier per browser session, used to group activity for debugging and performance monitoring. This is not tied to your identity beyond a single session.
- PWA install events — whether and when you installed Biltong Buddy as a progressive web app on your device.
Analytics and Error Data
- Error reports — collected via Sentry (hosted in the European Union) when the app crashes or encounters an unexpected error. These reports may include the page you were on, the action you were taking, a stack trace, and a pseudonymous internal user identifier so we can correlate a support enquiry to your specific errors. Reports do not include your name, email address, password, payment details, or the content you have entered into the app. Session replay is disabled.
- Usage patterns — aggregate, anonymous statistics about how features are used (e.g. how many batches the average user tracks). Individual users are not identified in these aggregates.
- Heartbeat signals — periodic pings sent while you are using the app to help us understand active usage. These contain no personal content, only a session identifier and timestamp.
How We Use Your Information
We use the data we collect for the following purposes:
- Providing the core service — storing and displaying your batches, pieces, and recipes so you can track your biltong drying progress.
- Account management — authenticating your identity and communicating essential account information (e.g. password resets, security alerts).
- Improving the app — using aggregate usage data and error reports to identify and fix bugs, prioritise features, and improve performance.
- Notifications — if you opt in, sending push notifications or emails about your active batches (e.g. drying milestones). You can withdraw this consent at any time from your account settings.
- Security and fraud prevention — monitoring for unusual access patterns or abuse of our systems.
- Legal compliance — retaining records as required by applicable law, and responding to lawful requests from authorities.
We do not use your data for advertising, and we do not sell it to third parties for any purpose.
For users in the UK and EU, our legal bases are: contract performance (providing the service you signed up for), legitimate interests (security, debugging, aggregate analytics), and consent (notifications, optional features). Where we rely on consent, you may withdraw it at any time.
Data Storage & Security
All Biltong Buddy data is stored in Supabase, a managed PostgreSQL database platform. Supabase stores your data on managed cloud infrastructure. Your data is encrypted in transit using HTTPS (TLS 1.2+) and encrypted at rest using AES-256.
Access to your data within the database is controlled by Row-Level Security (RLS) policies enforced at the database layer. This means even our own application code cannot read another user’s data — the database itself enforces that each user can only access their own records.
Our backend API runs on Railway infrastructure. API endpoints require valid authentication tokens for all user-specific operations. Tokens are short-lived and refreshed automatically by Supabase Auth.
While we take security seriously and implement industry-standard controls, no method of transmission over the internet or electronic storage is completely secure. If you discover a security issue, please report it to [email protected] and we will address it promptly.
Third-Party Services
Biltong Buddy uses a small number of third-party services to operate. Each of these services has its own privacy policy and data handling practices. We have selected providers that meet our security and privacy standards.
Because Apple only returns your name on the very first sign-in, the app stores a small copy of the data Apple returned (your email, given name, and family name) in your device's local storage, keyed by the Apple user identifier. This lets us greet you correctly on subsequent sign-ins without asking Apple to re-share the data. The cache is automatically cleared when you sign out and is never transmitted off your device. apple.com/legal/privacy/data/sign-in-with-apple
International Data Transfers
Nerdbase is based in the United Kingdom and your data is processed under UK GDPR and the Data Protection Act 2018. Some of the third-party providers we rely on (listed in Section 5) are based outside the UK and the European Economic Area (“EEA”) — primarily in the United States. This means that some of your personal data may be transferred to, stored in, or accessed from countries that the UK government has not formally found to provide an “adequate” level of data protection.
Where we transfer personal data outside the UK or the EEA, we rely on one of the following lawful transfer mechanisms recognised under UK GDPR:
- UK adequacy regulations — for transfers to countries the UK government has formally recognised as providing equivalent protection (for example, the EEA member states). Transfers to the United States can also rely on the UK Extension to the EU–US Data Privacy Framework, but only where the receiving organisation is self-certified under that framework. Where it is not, we rely on the contractual safeguards described below.
- The UK International Data Transfer Agreement (IDTA), or the European Commission’s Standard Contractual Clauses with the UK Addendum, signed with the relevant processor as part of their data-processing agreement.
- Other lawful safeguards permitted by UK GDPR Articles 46–49 in the limited cases where neither of the above is available.
Where Each Processor Sits
- Supabase — the hosting region for our database is selected when the project is created. Where Supabase processes data outside the UK or EEA, transfers are covered by Supabase’s data-processing addendum, which incorporates the UK IDTA and the EU Standard Contractual Clauses.
- Sentry — processes error data on Sentry’s European Union infrastructure (operated by Functional Software, Inc.). Where any incidental processing occurs in the United States, transfers are covered by Sentry’s data-processing agreement, which incorporates the EU Standard Contractual Clauses with the UK Addendum.
- Cloudflare — serves the frontend and API edge from a global network. Cloudflare may process metadata at the edge node closest to you, which can be inside or outside the UK. Transfers are covered by Cloudflare’s data-processing addendum, which incorporates the UK IDTA and EU Standard Contractual Clauses.
- Railway — backend deployments run on US-based cloud infrastructure operated by Railway Corp. Transfers are covered by Railway’s data-processing addendum, which incorporates the EU Standard Contractual Clauses with the UK Addendum.
- Google (OAuth) — if you sign in with Google, authentication is handled by Google LLC (United States). Transfers are covered by Google’s data-processing terms, which incorporate the EU Standard Contractual Clauses with the UK Addendum and (where applicable) the EU–US Data Privacy Framework with its UK Extension.
- Apple (Sign in with Apple, APNs) — on iOS, authentication and push delivery are handled by Apple Inc. (United States). Transfers are covered by Apple’s data-processing terms, which include the EU Standard Contractual Clauses with the UK Addendum.
- HetrixTools — uptime monitoring is operated from the European Union, so no transfer outside the EEA is required for that service.
We review these arrangements periodically and will update this Policy if any of our processors materially change where they store or process your data. If you would like a copy of the safeguards in place for any specific transfer, please email [email protected] and we will share what we hold.
Your Rights
Under UK GDPR, EU GDPR, POPIA (South Africa), and similar applicable privacy laws, you have rights over your personal data. We honour these rights regardless of your jurisdiction.
To exercise any of these rights, email us at [email protected]. We will respond within one calendar month (or sooner where possible), as required under UK GDPR. For account deletion, you may also delete your account directly from within the app under Settings › Account › Delete Account.
If you believe we have not handled your data appropriately, you have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO). In South Africa, this is the Information Regulator.
Data Retention
We retain your personal data and app content for as long as your account is active. If you choose to delete your account, we will permanently delete all associated personal data — including your batches, pieces, recipes, and account information — within one calendar month (or sooner where possible) of receiving the deletion request.
Certain anonymised, aggregate data (e.g. app usage counts, feature adoption metrics) may be retained indefinitely as it cannot be used to identify you individually.
Error logs held in Sentry are automatically purged after 30 days under our current plan. Diagnostic logs we hold in our own database (used to investigate user-reported issues) are automatically purged after 30 days. Infrastructure access logs held by Cloudflare and Railway are retained per those platforms’ standard policies.
If your account has been inactive for 24 months, we may send a notice email before deleting it. We will always give you an opportunity to reactivate before any deletion occurs.
Children’s Privacy
Biltong Buddy is not intended for use by children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has created an account, please contact us at [email protected] and we will delete the account and all associated data promptly.
Users in certain jurisdictions may be subject to higher age thresholds (e.g. 16 in some EU member states for consent-based data processing). If you are below the applicable age threshold in your jurisdiction, you must have parental or guardian consent to use Biltong Buddy.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in the app, our data practices, or applicable law. When we make material changes, we will:
- Update the “Last updated” date at the top of this page.
- Send an email notification to all registered users.
- Display an in-app notice the next time you open Biltong Buddy.
Your continued use of Biltong Buddy after we publish an updated policy constitutes your acceptance of those changes. If you do not agree with the updated policy, please stop using the app and delete your account.
Previous versions of this policy are available on request by emailing [email protected].
Contact Us
If you have any questions about this Privacy Policy, want to exercise your data rights, or have a concern about how we handle your data, please get in touch. We aim to respond to all privacy-related enquiries within 30 days.