Version 6, 23 October 2026
Who we are
PrepNow is run by Sean Lawson, an individual in the UK, who is the data controller for your information. Contact: privacy@prepnow.co.uk.
What we hold
- Your name, email address and password. The password is stored scrambled so we can't read it.
- Your household's stockpile: products, dates, places, the shopping list, your prep box plan, and a history of who changed what.
- Invites you send: the invitee's email address, until the invite is used or expires (7 days), then for up to 30 days.
- Sign-in records for each phone or browser: a session, and a "keep me signed in" token if you chose it. They're stored scrambled or as random IDs, and you can end them from Household with "Sign out other phones".
- Your alert settings and, for each phone with alerts on, the address its browser gave us for sending alerts.
- Short-lived security records, such as a count of failed sign-ins from an address. These are kept for 24 hours.
- Server logs kept by our host, which include IP addresses, for security and fixing faults.
The scanner uses your camera on your phone only. Pictures never leave your device; only the barcode number is sent.
Why, and our lawful basis
- To provide PrepNow to you (contract): your account, sharing one stockpile with your household, alerts and the shopping-list connections you turn on.
- To keep it safe and working (legitimate interests): sign-in limits, security records, server logs, barcode lookups and the practice household.
- Phone alerts (consent): your browser asks first, and you can turn them off at any time.
We don't use analytics, advertising or tracking, and we never sell your data.
Cookies and storage
We use three cookies, all needed for PrepNow to work: one keeps you signed in for this visit, one remembers your phone if you choose "keep me signed in", and one identifies your phone for alerts if you turn them on. If you add PrepNow to your Home Screen, it also keeps a copy of its own screens, fonts and icons on your phone so it opens quickly. There's no cookie banner because nothing optional is stored.
Who else is involved
- IONOS hosts PrepNow and sends its emails, under a contract that only lets it use the data to provide that service.
- Open Food Facts. When you scan or type a barcode, our server sends only the barcode, never your name, email or household. Product photos load straight from Open Food Facts in your browser, so it can see your device's IP address.
- Push services (Google, Apple or Mozilla, depending on your browser) deliver phone alerts. Alerts are locked so the service can't read them; it only sees that a message was sent to your device.
- Your own services. If you connect Home Assistant, Google Tasks or Apple Reminders, shopping list item names go to your own account there, and ticks come back. Access details are stored encrypted, and Disconnect removes them.
Where it's stored
PrepNow's data is stored by IONOS in the UK. Push services may be based in the US. Those transfers rely on the UK–US data bridge or standard contract clauses.
How long we keep it
- Your account and household data: until you delete them.
- Change history: 12 months.
- Sessions: 8 hours without use. Remembered phones: 60 days.
- Alert addresses: until you turn alerts off, sign out, or the push service stops them.
- The phone's alerts cookie: 1 year, or until you turn alerts off.
- Invite links: 7 days. Password reset links: 1 hour.
- Practice households: deleted within a day, or straight away when you choose "Leave the practice household".
- Security records: 24 hours. Server logs: as long as IONOS keeps them, usually a few weeks.
Age
Accounts are for people aged 18 and over. We don't knowingly hold data about children, other than the number of children by age band in a prep box plan.
Deleting your data
In Household, choose "Delete my account". That removes your login and ends all your sign-ins straight away. If you're the only admin and others are still in the household, first make one of them an admin. If you're the last member, it also deletes the household and everything in it. Your entries in the change history then show as "Former member". An admin can also remove a member, which deletes that member's login.
Your rights
You can ask to see, correct, delete or get a copy of your data, to limit how we use it, or to object to uses based on legitimate interests. You can also withdraw consent for phone alerts at any time. Email privacy@prepnow.co.uk. We'll reply within one month. For a copy of your data, we'll send your household's data as a file.
Complaints
If you're unhappy with how we've handled your data, email privacy@prepnow.co.uk. We'll acknowledge it within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
If we change this note in a way that matters, we'll tell you in PrepNow. The version date is at the top.