Privacy Notice
Phill early-access trial · last updated 23 October 2026
Phill is a pre-launch app being trialled with a small group. This note explains, in plain English, what we collect and how we handle it during the trial. Questions, or a request to see or delete your data: support@phillmybasket.com.
Who we are
The data controller is PHILL LTD, registered in England & Wales, company number 17365809, registered office 6 Westbourne Drive, Wilmslow, SK9 2GY. We're registered with the Information Commissioner's Office, reference ZC237807.
If you join the waitlist
If you give us your email on our home page, we store only that email address and use it solely to let you know when Phill opens up. We don't profile you, share it, or send marketing about anything else. Ask us any time and we'll remove you.
What we collect
- Your account, the email and password you sign up with.
- Your preferences & plan: diet, budget, household, kitchen items, meal plan, recipe ratings and any feedback you send.
- What you tell Phill about yourself: short notes like "doesn't like mushrooms" or "partner is vegetarian on Mondays", saved when you say them in chat or type them in Account. You can see every one in Account → What Phill knows about you and delete any of them. We never keep anything about your health or allergies: if you mention one, Phill says so and saves nothing. We don't keep your chat conversations.
- Calendar events, only if you connect a calendar link. Read-only; we never write to your calendar.
- Fridge/pantry photos, only when you scan. Sent to AI for analysis, then discarded, we do not store your photos.
- Scan corrections: when you fix something a scan misread ("that's Sriracha, not hot sauce"), Phill keeps the two ingredient names in your account and uses them on your future scans. Names only, never a photo, and they go when you delete your account.
- Recipe links you import: Phill fetches the public page, extracts its recipe and discards the webpage. The extracted recipe text may be sent to Amazon Bedrock to turn it into a recipe card. We save the recipe and a clean source link only after you review it and tap Save; tracking parameters, fragments and access tokens are removed from the saved link.
- A notification address for your device, only if you turn reminders on. See below.
- Your first name, if you give it. Just so Phill can say hello properly. It goes with your chat messages so Phill knows what to call you. Change or clear it in Account.
- Your household. How many you're feeding, your diet plan, budget, cost preference and kitchen kit.
- What you actually cook. Which planned meals you cooked, skipped or swapped for a takeaway, so next week fits how you really live.
- Your shops. Baskets and lists you've sent to a shop: what was in them, our estimated total and anything the shop couldn't match. Plus the product you picked for an ingredient, so Phill picks it again.
- Feedback and thumbs. Feedback you send is kept with your email so we can reply. Thumbs on chat replies are counted without your message, the reply or who you are.
- Housekeeping records. Which version of this notice you've seen and when, and short error reports from the app: the error, the page and your browser type, never what you typed.
If you turn on reminders
Turning reminders on stores a push subscription for that device: a web address your browser gives us, plus two keys used to encrypt the message so only your device can read it. It contains no name, email or location, but it does identify a device, so we treat it as your personal data.
- It's stored against your account only, and is never shared or sold.
- We use it for one thing: sending you the reminders described in the app.
- Reminders are sent on a schedule: one in the late afternoon about that day, and one on a Sunday evening about the week ahead. At most one notification per run, and none at all when there's nothing worth telling you.
- Turning reminders off in the app deletes it straight away. Uninstalling the app or clearing your browser data also ends it, and we delete the record the next time a send fails.
How we use it
- To plan your meals and run the app's features for you.
- Some features (chat, photo scan and recipe import) send your text, image or extracted recipe content to Amazon Bedrock (Claude) to generate a response.
- When you paste a recipe link, the website receives an ordinary request from Phill's server. We accept only public HTTPS webpages, follow at most three checked redirects and stop at a strict size and time limit. We don't sign in, bypass access controls or keep the raw page.
- When you connect a calendar, the titles of your entries are sent to Amazon Bedrock (Claude) once, so Phill can tell a meal out from a meeting and a bin-day reminder from a holiday. Only the titles go: never the dates, times, locations, attendees, notes or which calendar they came from. The answer is used to plan your week and then discarded, so we do not store it. If this is unavailable Phill falls back to using only the times, and your calendar still works.
- The notes you've asked Phill to remember are sent with your chat messages and used to plan, so a food you dislike is left out of your plans and suggestions.
- To keep AI costs in check, we count how often your account uses each AI feature (chat, scans, recipe imports and so on) and roughly what it cost us. It's numbers, never what you asked. The daily count goes after 3 days and the cost record after 35.
- If you rate a chat reply with a thumbs up or down, we count the rating against the version of Phill's instructions that wrote it. The rating is stored without your message, the reply, or who you are.
- Step-by-step cooking methods Phill writes for a recipe are kept for 30 days and reused for anyone cooking the same recipe for the same number of people. They contain the recipe, nothing about you.
- We keep an eye on how Phill's doing on a private owner page that only Phill's director can open: totals, ratings, and AI cost per household shown against a scrambled code rather than your name or email. Feedback you send shows there with your email, so we can reply.
- We do not sell your data or share it for advertising.
How Phill decides what to suggest
Phill's planner and chat pick meals using your diet plan, what you've told it you don't like, your budget, household, kitchen kit, what's already in your kitchen, your ratings and what you've actually cooked or skipped. It also leaves out recipes it can't get the ingredients for at the shops it's connected to, so you're not left with a half-filled basket.
These are suggestions. Nothing Phill decides has a legal effect on you or anything like it, and you can always swap a meal, change a setting or ignore the lot. If you'd like a person to look at how Phill treated you, email us.
If you choose to help Phill read fridges better
This is off unless you switch it on, and it isn't running yet: the switch appears in Account only once it is. Saying no, or never deciding, changes nothing about how Phill works for you.
- What we'd keep: the photos from your kitchen scans, and the list you confirmed after fixing anything Phill misread. Nothing else from your account goes with them, and they're filed under a random code rather than your name or email.
- What for: testing how well Phill reads fridges, and training the AI models behind the scan, including custom versions of models on Amazon Bedrock that only Phill uses. Never for advertising, and never sold.
- Why we ask first: a fridge photo can show medicine or other things about your health. The law treats that as special category data, so we only keep these photos with your explicit consent, given by the switch. We record which wording you agreed to and when.
- Where and how long: encrypted, in the UK (AWS London), for up to 24 months from each scan. Someone at Phill may look at a photo to check its labels. We remove any photo that shows people, post or anything else not about food.
- Changing your mind: switch it off in Account, or delete your account, and we delete the photos and lists we kept within 30 days. A model already trained can't forget one example, so your scans won't be used for any training after you switch off, and any model trained with them is retired within 24 months of training.
How we measure whether Phill works
We've built in PostHog, a tool that counts how an app is used, but it's switched off and nothing is sent to it. If we ever switch it on, we'll update this notice first and tell you in the app. It would only count named actions (like "planned a week"), never your recipes, kitchen, chat or photos, and you'd be able to turn it off in Account.
Cookies and your device
We use two cookies, both there to keep you signed in: one lasts an hour, the other 30 days. They're locked so web pages can't read them. If you use reminders, your browser also keeps a small helper (a service worker) so reminders can arrive. No advertising or tracking cookies, so there's no cookie banner.
Where it's stored
On Amazon Web Services in the UK (London / eu-west-2): accounts in Amazon Cognito, your data in Amazon DynamoDB. AWS acts as our processor.
When Phill uses AI (chat, a kitchen scan, a recipe import), the request is handled by Amazon Bedrock in AWS's UK or EU data centres, whichever has room at that moment. It is processed and answered there, not stored, and not used to train anyone's models. The UK recognises EU data protection as adequate, so the same protections apply.
If you turn reminders on, your browser's push service may be outside the UK. It only handles encrypted messages it can't read.
Who helps us run Phill
These companies work for us, under contract, and only do what we ask:
- Amazon Web Services, in London: your login (Cognito), your data (DynamoDB), the website itself (Amplify), emails like your sign-up code (SES), our server logs (CloudWatch), our firewall (WAF) and the AI behind chat, scans and recipe imports (Bedrock). The AI is Anthropic's Claude, running inside Bedrock. Anthropic doesn't receive your data.
- Cloudflare, which runs our domain name, so your browser can find phillmybasket.com.
- Your browser's push service, only if you turn reminders on. That's Google, Mozilla, Apple or Microsoft, depending on your browser. It passes on our reminders, which are encrypted so it can't read them.
These see something from Phill but make their own decisions about it:
- Amazon, when you open your basket there. See "When you shop".
- A recipe website, when you paste its link. It sees an ordinary request from our server, not from you.
We've also built in a measuring tool called PostHog, but it's switched off. See "How we measure whether Phill works".
We don't sell your data or share it for advertising.
Why we're allowed to use it, and for how long
| What | Why we can use it | How long we keep it |
|---|---|---|
| Your account, plan, kitchen, diet, household, recipes, baskets, what Phill remembers, scan corrections, product picks | To give you the service you signed up for (contract) | Until you delete it, or your account |
| Kitchen photos, chat messages, recipe pages | To give you the service (contract) | Not kept. Used for that one request, then gone |
| What you cooked or skipped, used to shape next week | Our legitimate interest in planning weeks that fit you | Until you delete your account |
| Reminders (your device's push address) | Your consent, given when you switch reminders on | Until you switch them off, or your device stops accepting them |
| Scan photos kept for training (not running yet) | Your explicit consent, given by its own switch | Up to 24 months, deleted within 30 days if you switch off |
| Feedback you send, with your email | Our legitimate interest in improving Phill and replying to you | Until you delete your account |
| AI use counters | Our legitimate interest in keeping costs and abuse in check | Daily count: 3 days. Cost by feature: 35 days |
| Records of which privacy notice you've seen | To show we've told you (legal obligation and accountability) | Until you delete your account |
| Waitlist email | Your consent, given when you joined | Until we invite you, or 12 months, whichever is sooner |
| Copies in our backups | Our legitimate interest in recovering from mistakes | Up to 35 days after deletion |
Where we rely on legitimate interests, you can object, and we'll stop unless we have a strong reason not to.
Your choices & rights
- You can disconnect a calendar, turn reminders off, forget anything Phill remembers, or delete items any time in the app.
- Deleting your account removes your login and everything linked to you straight away, including feedback you sent and any waitlist entry. Copies can stay in our encrypted backups for up to 35 days before they're gone for good. Anonymous tallies (like how many thumbs up a reply got) aren't linked to you, so they stay.
- If we ever close Phill, we'll tell you first and give you at least 30 days to ask for a copy of your data before we delete it.
Your rights
You can ask us to:
- send you a copy of your data, in a format you can take elsewhere if you like
- correct anything that's wrong
- delete it (or do it yourself in Account → Delete my account)
- limit how we use it, or stop using it where we rely on legitimate interests
- forget a consent you gave. Switching reminders or scan training off does that straight away
Email support@phillmybasket.com and we'll reply within a month.
Not happy? Tell us first at the same address. We'll confirm we've got your complaint within 30 days and tell you what we've done about it. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint (opens in a new tab) or on 0303 123 1113.
Phill is for grown-ups
You need to be 18 or over to have a Phill account. If you think someone younger has signed up, tell us and we'll delete it.
When you shop
Phill never takes a payment and never places an order for you. When you tap Available at Amazon, your browser goes to Amazon with the products and quantities on your list and Phill's Associates tag, so Amazon knows you came from us. We don't send Amazon your name, email or anything else about you. From there you're on Amazon's site, signed in to your own account, and Amazon's privacy notice (opens in a new tab) applies. Amazon decides what to do with what it sees, so it's a separate controller, not someone working for us.
If you buy, Amazon pays Phill a small commission. Amazon's reports show us which products were bought through our links, never who bought them. We keep a note in your account that a basket was sent (what was in it, our estimated total and anything the shop couldn't match) so your Orders screen and next week's plan make sense.
Prices in Phill are estimates. Amazon's basket shows the real price.
Not sure about something here? Ask us at support@phillmybasket.com and we'll explain.