Privacy policy

1.Who we are

Sprig is operated by William Diggs, a sole proprietor doing business as Sprig Vegan Cookbook.

Day to day it is run by two people: William and his wife Tiffany. There is no team behind us and no third party handling your data on our behalf beyond the service providers described below.

If you have any question about your data, email sprig.vegancookbook@gmail.com and it will reach a person.

2.What we collect

We collect as little as we can get away with. In full, that is:

• Your email address and password, when you create an account. Passwords are stored hashed by our authentication provider: we never see them and cannot recover them, which is why a reset link is the only way back in.
• Your subscription status, the customer reference our payment processor gives us, and when your current period ends. This is what unlocks paid content.
• The recipes you save as favorites.
• Whether you have told us to stop sending you email about new features, the date you told us, and a random code that lets you tell us that from a link in an email without having to log in. The code identifies your account and nothing else. It cannot be used to read anything about you, only to switch those emails off. We also keep a note of which of those emails we have already sent you, so we do not send one twice.
• The fire rating you give a recipe, if you give one. Ratings are averaged into a public score on the recipe page, but only the average is ever shown: which recipes you rated, and what you gave them, are visible to nobody but you. You can change or remove your rating at any time by tapping the flames again.
• A display name, if you choose one. The signup form offers an optional box for it and we ask again if you set up friends; either way it is yours to skip, and an account works completely without one. Nobody can see it until you and another person are friends. There is still no way to search for a person on Sprig (not by address, not by name), and nobody outside the circle described here can reach you. Once two people are friends, each can see the recipes the other has rated, the recipes they have hearted, their weekly plan and grocery list, and whether the other is on the site right now. We keep one timestamp for that last part (when you were last active), and it is stamped only while you actually have a friend to show it to. Either of you can remove the other at any time, which cuts off access in both directions immediately. The free text you type onto your own shopping list is never shared, and neither is your email address: a friend sees the name you chose, never the address you signed up with.
• If you add a friend, your name and your profile picture also become visible to that friend's other friends, so that people who already have a friend in common can find each other. Any of them can send you a friend request, which names the friend you have in common. Requests from anyone else are not possible. You can accept it or ignore it. If you ignore it we do not tell them, and they cannot ask you again.
• A profile picture, if you add one. It is resized in your own browser before it is sent, which also removes the hidden information photos carry, including the location where the photo was taken. It is stored privately and can only be fetched by you and by your friends, never by the open web. Removing it deletes the file itself, not just the link to it.
• A background picture for your profile card, if you add one. It is handled exactly like a profile picture: resized in your browser, which removes the location the photo was taken, stored privately, and fetched only by you and by your friends, never by the open web. Until 11 September 2026 nobody but you could see it; we changed that so friends can see each other's cards. Removing it deletes the file itself.
• A photo of a recipe you cooked, if you add one, along with any note you write on it. It is resized in your own browser before it is sent, which removes the hidden information photos carry (including the location where the photo was taken), and we strip that again on our own server. Your friends can see it on your page, and by default nobody else can.
• There is a separate tick, off unless you turn it on, that shows one of your kitchen photos on the recipe page itself. That makes three things readable by anybody on the internet: the photograph, the note you wrote with it, and your display name. Search engines are included, and they may keep a copy of the page for a while after you change your mind. Your email address is never shown. Untick it at any time and the photo comes off the recipe page straight away; we can also take a photo off a recipe page ourselves, which hides it from the public page and leaves it where you put it. Removing the photo altogether deletes the file itself. Until 12 September 2026 a kitchen photo could not be shown publicly at all, and none was.
• Comments you leave on a friend’s kitchen photo, and which photos you have sprigged. A comment is stored with the display name you had when you wrote it, so changing your name later does not change what you already said. Comments are visible to the photo’s owner and to their friends, and either the author or the photo’s owner can delete one.
• Messages you send to a friend, and the ones they send you. Only the two of you can read a conversation, and only while you are friends: if either of you removes the other, the messages are deleted for both of you and cannot be recovered. You can unsend a message you wrote, which removes it from their screen as well as yours; you cannot delete something they wrote, and neither of you can edit a message after sending it. We keep one date per conversation so we can show you how many messages are waiting. It is stored on your own side of the friendship, the other person cannot see it, and they are never told that you read a message. Everything is deleted if either of you deletes their account. These messages are not end-to-end encrypted: they are stored in our database like everything else described here, so we could in principle read them, and we do not.
• Which of your friends’ kitchen photos you have opened. We keep one record per photograph rather than a history of visits, so opening the same picture again changes nothing. It is there so we can mark the photos you have not looked at yet. It is a record of which pictures you open, so it is worth being clear that nobody else can see it: not the friend whose photo it is, and not anyone else. It is deleted with your account, and also if the photo itself is deleted. Until 11 September 2026 we kept one date and time per friend instead, recording when you last opened their page; we changed it so that looking at one photo no longer clears the marks on all the others.
• If you are signed in: the recipes on your list and the servings you chose, which day and meal you assigned each one to, and any items you typed onto your grocery list yourself. This is what lets a week you planned on a laptop appear on your phone.
• Ordinary server logs, which include IP addresses, as a side effect of running a website.

3.Your list, your plan, and your devices

If you are not signed in, all of it stays in your browser: the recipes on your list, the servings, the day and meal you give each one, and anything you type onto the list yourself. None of it reaches us, none of it is linked to anything, and clearing your browser data clears it.

If you are signed in, those things are saved against your account so that a week you planned on a laptop is waiting on your phone. That includes any grocery items you typed in yourself. They are readable only by you, and they are deleted with your account. On the Pantry page, a label line you typed for a jar and the month you last filled a jar are stored with your pantry levels in the same way, visible to nobody but you.

On the Pantry page there is a switch called “Tilt to pour”. If you press it, your phone or tablet may ask you to allow access to motion and orientation. It is used for one thing: tilting your handset then moves what is drawn inside the jar you are looking at. It is entirely optional, we never ask for it anywhere else and never without you pressing that switch, and if you say no the contents simply sway on their own instead. Nothing from the sensor is stored, sent to us, or recorded anywhere: the reading is turned into an angle, the picture rotates, and that is the end of it. We do remember your answer, including a refusal, so that you are not asked again.

A few small things stay in your browser either way and are never sent to us: whether you prefer US or metric units, which items you have ticked off while shopping, your choice about whether the scrolling ticker at the foot of the page is shown, whether you have asked for the dark or the light theme, whether you have turned on the interface sounds, whether we have already shown you the tip about holding a jar on the Pantry page, your answer about tilting your phone to move what is inside a jar, and whether we have already shown you our invitation to create a free account. The sound setting is stored only on the device where you switched it on, the same as the theme and the ticker: nothing about it is ever sent to us, and it starts off on every new device until you say otherwise. A tick is about where you are standing in a shop, not about who you are.

If you use the share button on a grocery list, a copy of that list, including anything you typed onto it, is saved on our server so that the person you send the link to can open it. Anyone who has the link can read that list, tick items on it, move items from the cupboard check onto it, and add items of their own: the link is the only key, so treat forwarding it as handing over the list. Anything they type is saved with the shared copy and shows on your list while it is shared. You can press Stop sharing at any time, which cuts off access immediately, and a link stops working on its own within a day. The saved copy, including what anyone else added to it, is replaced the next time you share a list, and is deleted with your account.

Separately, when your browser asks our server for the ingredients of the recipes on your list, we receive those recipe names in order to answer. We do not store that request.

4.Payments

Payments are handled entirely by a third-party payment processor. Card numbers are entered on that processor's own checkout page and never pass through our code. We could not store your card details if we wanted to.

We receive from it only what we need to know that you are subscribed: a customer reference, your status, and your period end date. It processes your payment information under its own privacy policy.

5.Cookies

We use cookies only to keep you signed in. There are no advertising cookies, no tracking pixels, and no third-party marketing scripts on this site.

6.Analytics

We use a cookieless analytics service, provided by the company that hosts this site, to count how many people visit each page. It does not use cookies and does not follow you to other websites. To count a visitor only once a day it derives a temporary anonymous identifier from your request, which is discarded within twenty-four hours and is never linked to your account.

We also record a small number of events about what happens on the site: when someone starts a cook-along and which recipe it was, when someone starts sharing a grocery list, and which parts of the free demo people try. These tell us whether the things we built are actually used, which is the main thing we want to learn.

Each of those records an action and, at most, a recipe name. None of them records anything about you, and the link that shares a grocery list is deliberately never included, because anyone holding it could read that list.

Through the same hosting company, and on the same terms, we also measure how quickly pages actually load for real visitors. It records the timing, which page it was, and general details such as browser and country. It sets no cookies and records nothing that identifies you.

We do not use analytics to build a profile of you, and we do not share this data with anyone for advertising.

7.Who we share data with

We do not sell your data, and we do not share it for advertising. We rely on a small number of third-party providers to run the service:

• A managed database, authentication and file-storage provider: your account, everything listed above, and your pictures.
• A payment processor: payments and subscription billing. Your card details go to it and never to us.
• A hosting provider: running the website, plus the cookieless page counts and load timings described above.
• An email provider: sending account emails such as confirmation and password resets, and the occasional message about what has changed on the site.
• An image-recognition provider: reading the labels in a photo of your spice shelf, if you use that feature. The picture comes from your phone's own camera app, or from photos you already have, and this site does not ask for access to your camera. It did ask, until September 2026, and no longer does. The photo is sent to be read and is not stored: not by us, and not kept for us at the other end. What we keep is what you then confirm: the spices, how full each one is, which of five jar shapes yours looks most like, and the month, when you confirm a jar as full, so your cabinet is drawn the way your shelf actually looks.

We have named these by what they do rather than who they are. If you would like to know which companies they are, email us and we will tell you.

8.Email we send you

We send account emails: confirming your address, resetting your password, and messages about your subscription. These are part of the service and you cannot unsubscribe from them while you have an account.

Separately, we occasionally email the people who have an account here about what has changed on the site: a new feature, or something worth knowing about. You did not ask for these, and we should be straight about that: having an account puts you on that list. Every one of them carries a link that takes you off it in a single click, with no need to log in and no questions asked, and we have to include our postal address in them, which we do.

We keep one setting on your account recording whether you have told us to stop, and the date you told us. Once you have, the only emails you will get are the account ones above. We also keep a note of which of these messages we have already sent you, so that you do not get the same one twice.

If you change your mind and want them back on, email sprig.vegancookbook@gmail.com and a person will switch them on again. There is deliberately no link that does that: a link would make an old message a way for somebody else to undo your decision.

We do not sell or rent your address to anybody, and nobody else sends email to you on our behalf.

9.Where data is held, and for how long

Our providers store data on servers in the United States.

We keep your account data while your account exists. If you ask us to delete your account we will delete it, your favorites, your ratings, your friends, any friend requests you sent or received, your profile picture, your card background, your kitchen photos, your comments and sprigs, the record of when you last opened each friend’s page, your email preference and the note of which update emails we sent you, and your saved list and plan. We keep records of payments for as long as tax and accounting rules require, which is a legal obligation rather than a choice.

10.Your choices

You can cancel your subscription at any time from your account page.

You can stop the emails about new features in one click, from the link at the foot of any of them. You do not need to be logged in and we do not ask you why.

You can ask us to correct your email address, tell you what we hold about you, or delete your account entirely by emailing sprig.vegancookbook@gmail.com. There is no self-service delete button yet, so a person will do it and confirm when it is done.

Depending on where you live you may have additional rights over your data. Ask and we will honor them.

11.Children

Sprig is not directed at children under 13 and we do not knowingly collect their information. If you believe a child has created an account, email us and we will remove it.

12.Changes to this policy

If we change what we collect or who we share it with, we will update this page and change the date at the top. Material changes will be announced by email or in the app.