Privacy policy

This policy explains what information Stapl collects, why, who it goes to, and the choices you have. It covers the Stapl app for iPhone and Android and the website staplapp.com.

Stapl is made by Hopscotcher Labs ("we", "us"), based in Dubai, United Arab Emirates. We decide how your information is used and are responsible for it.

1. What we collect

Your account

• Email sign-up: your name, email address and password. Our sign-in provider stores your password only in a scrambled (hashed) form that no one can read.
• Sign in with Apple or Google: your name and email address from Apple or Google. If you choose Apple's "Hide My Email", we get a private relay address instead of your real one.

Your profile

When you set up Stapl, we ask for:

• your nationality, marital status, household size and, if you have children, how many;
• your monthly household income, or "Prefer not to say";
• how confident you are cooking (optional), and what kitchen equipment you have;
• your diet preferences (for example halal, no pork, no beef, vegetarian, vegan or gluten-free), or "None".

Some answers are pre-filled at setup. You can change most of them at any time in the You tab. There you can also add your age group and any food allergies; both are optional and saved only if you add them.

We use these to suggest recipes and amounts that suit your household. See section 3 for diet and allergy details.

Your kitchen

• Items: what's in your kitchen, amounts and units, categories, when you bought them, when they need using, and your low-stock and restock settings.
• Grocery lists: the items on the list, amounts, and who in the kitchen added each one.
• Purchases: what you bought, the amount, price and currency, the store, brand, product name and pack size, and whether you added it by hand or by scanning.
• Cooking: which recipes you cooked and when, and the ratings you give recipes.

Photos and text you scan

When you use "Add what you bought", you choose up to five photos (such as receipts or screenshots of online orders) or paste the text of an order. Stapl asks for access to your photos only for this, and doesn't use your camera or microphone. See section 5 for what happens to them.

Notifications

If you allow notifications, we store a push token that lets us send them to your phone. We use it for reminders about items to use soon or running low, a weekly look back, recipe ideas, and activity in your shared kitchens.

How the app is used

• Product analytics: we record which features are used, for example that a kitchen was joined, a recipe was cooked or a receipt was scanned, with counts and the recipe involved. These records use a random ID for your device. They aren't linked to your name or email, and we've turned off location lookup.
• Crash reports: when the app breaks, we receive error details, the app version, and your device type and operating system. Before a report is sent, the app removes email addresses and your IP address from it.

When you contact us

If you email us, we keep your message, your email address and our reply, so we can help you.

Content from other services

Some recipes show videos and photos from other services. To show them, your phone connects to those services, which receive your IP address and device details under their own privacy policies. Videos play in the video service's own player.

What we don't collect

We don't collect your location, contacts, phone number or date of birth. We don't track you across other companies' apps or websites, and we don't use your phone's advertising identifier.

2. How we use it

We don't use your information for advertising, and we don't make decisions about you that have legal or similarly significant effects based only on automated processing.

3. Diet, allergies and other sensitive details

Diet preferences and allergies can reveal your health or your religious beliefs, and income and family details are personal. Giving them is your choice, and we only use them for you, with your consent:

• to filter and sort recipes by your diet preferences, and to warn you when a recipe doesn't fit them;
• to pick the recipe ideas we send you.

We keep any food allergies you add with your profile, but Stapl doesn't use them to filter recipes or warn you. Always check the ingredients yourself.

When Stapl warns you about a recipe, our product analytics record which of your diet preferences the recipe conflicts with, under the random device ID described above.

You can change or remove these details at any time in the You tab. Withdrawing consent doesn't affect what happened before.

4. Shared kitchens and invites

• What members see: everyone in a kitchen sees its items, grocery list, cooking history and purchases, including prices, stores and brands. They also see each member's name, role and when they joined. Members don't see each other's email addresses or profile details.
• Activity: members get updates in the app and as notifications, such as "name joined your kitchen", "name added to the grocery list" or "name cooked a meal".
• Invites by email: if you invite someone by email, we send them an email with your name, the kitchen's name and a link to join. We store their email address with the invite. Only invite people who'd expect to hear from you.
• Invite links and codes work once and expire after 7 days. Anyone who has the link or code can use it, including an email invite, so share them only with the person you mean.

5. AI features

Reading receipts and orders

• The photos or text you choose are sent to an AI service provider, which reads the items, amounts and prices. We don't send your name, email or account ID with them.
• We don't store the photos or the full text.
• We keep the items you confirm, as purchases in your kitchen.
• When you correct an item, or Stapl can't match one, we keep the line it read (up to 200 characters) so Stapl can match it next time. Lines Stapl couldn't match are also kept, without any link to you, to improve our list of ingredients.
• For each scan we log how many photos and items there were and which names weren't matched, to run the feature and control costs.

Comparing prices

• The names, amounts and units of the items you compare go to AI service providers, which estimate prices at partner stores. We don't send your name, email, account ID or location.
• The prices are AI estimates, not live store prices.

Our AI service providers don't use what we send them to train their AI models. They may keep it for a limited time to provide the service and check for misuse, then delete it.

6. Who we share it with

We don't sell your personal information. We share it only:

• with the people in your shared kitchens, as described in section 4;
• with the service providers below, who process it for us under contract and only on our instructions;
• if the law requires it, or to protect people's safety or our rights;
• with a buyer or successor if our business is sold or merged, in which case we'll tell you first.

A list of our service providers is available on request at support@staplapp.com.

7. Where your information is stored

We're based in the United Arab Emirates. Stapl's database is hosted in Japan (Tokyo). We plan to move it to India (Mumbai) before Stapl's public launch and will update this page then. Several of our providers, including our AI, analytics, push-notification, website and email providers, are in the United States and may process information there or elsewhere. Crash reports are kept in the European Union (Germany), and our emails are sent from Japan.

When information moves between countries, we rely on the safeguards the law requires, such as our providers' data processing terms and standard contractual clauses.

8. How long we keep it

• Your account, profile and kitchen: until you delete your account.
• Things you added to a kitchen shared with others: they stay for the other members after you leave or delete your account, no longer linked to you.
• Invites: kept, with the invitee's email address, until the kitchen or the account that sent them is deleted.
• Product analytics: 1 year.
• Crash reports: 30 days.
• Backups: deleted information can stay in database backups for up to 7 days before they're replaced.
• Emails with us: up to 2 years after our last message, then deleted.
• We may keep some records longer where the law requires it.

9. Deleting your account

In the app, go to the You tab, scroll down to Account and tap Delete account, then Delete Permanently. Your account is deleted straight away. If you can't open the app, email support@staplapp.com from the address on your account.

Delete your account explains step by step what is deleted and what is kept.

10. Your rights and choices

Depending on where you live, including under the UAE's Personal Data Protection Law and, if you're in the European Union or the UK, the GDPR, you can ask us to:

• give you a copy of your information, in a format you can take elsewhere;
• correct information that's wrong;
• delete your information;
• stop or limit some uses of it, or object to them;
• withdraw your consent, for example for diet and allergy details.

Email support@staplapp.com. We'll reply within 30 days, and we may ask you to confirm it's you. You can also complain to your local data protection authority.

Your choices in the app:

• edit your profile, diet and allergies in the You tab;
• turn notifications off in your phone's settings (the You tab links there);
• leave a shared kitchen at any time.

11. The website

staplapp.com sets no cookies and stores nothing on your device, so there's no cookie banner. It shows no ads.

To count visits and see which pages are read, the site uses the same analytics provider as the app. When you open a page, the provider receives the page address, the site that linked you here, your browser and device type, and your IP address. Before sending the address, the site removes everything after the "?" except campaign tags such as utm_source. The provider uses your IP address and browser details to count unique visitors each day, and may use them to tell roughly which country visits come from, without identifying you. It doesn't keep your IP address. The invite page and the "page not found" page don't use analytics.

Our website host keeps standard logs of requests to the site, such as IP address, the page address and browser type, to run and protect it.

Invite links (staplapp.com/join) contain a private code. The invite page passes it only to the Stapl app on your phone, or shows it as a QR code on a computer. It doesn't send the code to anyone else, and asks search engines not to index the page.

12. Children

Stapl isn't meant for children under 15, and we don't knowingly collect their information. If you think a child has given us information, email support@staplapp.com and we'll delete it.

13. Security

Information travels between your phone and our servers encrypted. Access to your kitchen is limited to its members, and access to our systems is limited to the people who need it. No system is perfectly secure, so please use a strong password that you don't use anywhere else.

14. Changes to this policy

We'll update this policy when Stapl or the law changes, and change the date at the top. If a change matters, we'll tell you in the app or by email before it takes effect.

15. Contact us