Privacy Policy

Crust (“we”, “us”) is the data controller for personal data processed through this website. For anything privacy-related, email hello@crustclub.co.uk.

When you create an account:

• Your email address and a securely hashed password, if you sign up with email.
• If you choose “Sign in with Google”: your name, email address and profile picture, as shared by Google. We do not get access to your Google password, contacts, Gmail, Drive or any other Google data.
• The username you pick, which is shown publicly next to your ratings.

When you use Crust:

• Sandwiches and sandwich places you add, including the place's name, address and map location.
• Your ratings and any notes you write. These are public.
• Reports you send us about other people's content.
• Basic technical data such as sign-in times, plus security logs kept by our hosting providers (IP address, browser type).

We do not track your own location. When you search for a place, we only send the text you type to our map search provider.

• To provide the service: running your account, showing your ratings and keeping you signed in. Basis: performing our contract with you (our Terms).
• To keep Crust safe and fair: moderating ratings, handling reports, preventing abuse and fake reviews. Basis: our legitimate interests.
• To understand how the site is used: aggregate, privacy-friendly page analytics. Basis: our legitimate interests.
• To meet legal obligations where they apply.

Your username, ratings, notes, and the sandwiches and places you add can be seen by anyone, including people without an account. Your email address is never shown publicly. Only Crust administrators can see it, and they use it only to run and moderate the service.

We do not sell or rent personal data. We only use trusted providers who help run the site:

• Supabase: database, authentication and account storage.
• Vercel: website hosting and cookie-free, aggregate analytics.
• Google: only if you choose to sign in with Google.
• OpenStreetMap / Nominatim: receives the place search text you type, and serves the map tiles your browser loads.

Some of these providers may process data outside the UK or EEA. Where that happens, they use recognised safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. We may also disclose data if the law requires it.

We only use essential cookies, which keep you signed in and keep your session secure. We do not use advertising or cross-site tracking cookies, so there is no cookie banner to dismiss.

We keep your account data until you delete your account or ask us to. When an account is deleted, its ratings and notes are deleted with it. Sandwiches and places you added may stay on the site without being linked to you, so other people's ratings still make sense. Hosting providers' security logs are kept only for a short time.

Under UK and EU data protection law, you have the right to:

• access a copy of your data;
• correct inaccurate data;
• have your data deleted;
• object to, or restrict, how we use it;
• receive your data in a portable format.

Email hello@crustclub.co.uk and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Crust's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We only request your basic profile and email address. We use them only to create and sign in to your Crust account, and we never transfer them for advertising.

Crust is not intended for anyone under 13, and we do not knowingly collect data from children.

If we change this policy, we will update the date at the top. If the change is significant, we will let account holders know.