Freecost Privacy Policy
Last Updated: June 18, 2026
Freecost (“Freecost,” “we,” “us”) is a recipe-costing app operated by Brobata, LLC. This policy explains what we collect, how we use it, and the choices you have.
Information we collect
You give us: your email address, a display name, and the data you create in the app — ingredients and their prices, recipes, menu items, vendors, and the cost data derived from them. If you scan or upload an invoice, we store the invoice image and the line items extracted from it.
Automatic: device type and OS version (so the app renders correctly), authentication tokens (so you stay signed in), and crash reports via Sentry (stack traces and device model). We do not currently run ad networks or third-party behavioral analytics inside the app. See Future changesbelow for how we'll handle changes to our data practices.
How we use your data
To run the service: keep you signed in, sync your catalog across your devices and to other members of your kitchen, calculate recipe and menu-item costs, parse the invoices you submit, and surface food-cost and margin information.
To keep the app working: aggregate, anonymized error reports help us fix crashes. These never include the contents of your recipes or invoices.
Improvement data: to make Freecost better, we may use your data in fully anonymous, aggregated form — nothing that could identify you or your business is included. Before we use it, we remove your name, email, business name, and account ID. What remains is patterns (counts and averages across many kitchens), not people. We never share or sell the prices, recipes, or invoices you enter.
Who can see your data
Only members of your kitchen (location), plus anyone you explicitly grant access. We use Postgres row-level security (RLS) to enforce this at the database layer — not just in app code.
We do not currently engage in the “sale” or “sharing” of personal information as those terms are defined under California (CCPA/CPRA) or other US state privacy laws. We currently share personal information only with the operational subprocessors listed below as needed to run the service. If our practices change — for example, if we introduce sponsored partner content, advertising, or analytics that meet a statutory definition of “sale” or “sharing” — we will update this Privacy Policy in advance and provide the disclosures and opt-out mechanisms required by applicable law (including a “Do Not Sell or Share My Personal Information” control for California residents). See Future changes below.
Subprocessors
Supabase (database, authentication, storage) — US data centers. Hosts your account, your catalog, and your invoice images. DPA: supabase.com/legal/dpa.
Vercel (web hosting, edge runtime) — runs freefoodcost.com. DPA: vercel.com/legal/dpa.
Sentry (crash reporting) — receives stack traces, device model, and OS version. No recipe or invoice content. DPA: sentry.io/legal/dpa.
Resend (transactional email) — delivers sign-in and account emails. DPA: resend.com/legal/dpa.
Invoice parsing runs on Brobata's own infrastructure — your invoice images are not sent to a third-party AI service.
Your rights
Export: you can request a copy of the data you've entered.
Delete: delete your account from Settings → Account → Delete account (web or mobile). This disables your sign-in and removes your access immediately; associated personal information is anonymized.
Correct: edit any ingredient, recipe, or menu item you've created at any time.
California residents (CCPA/CPRA) and EEA/UK residents (GDPR): contact us at [email protected] for a copy of, correction of, or deletion of your data.
Children
Freecost is a business tool for restaurant operators and staff (adults). We do not direct the Service to, or knowingly collect data from, children under 13.
Security
Data is encrypted in transit (TLS 1.2+) and at rest (Supabase AES-256 disk encryption). We enforce row-level security at the database layer so even our backend can only return rows the requesting user is authorized to read. Passwords are stored hashed by Supabase Auth; our app never sees the plaintext.
Breach notification
If we ever discover a security breach affecting your data, we'll notify you by email within 72 hours of confirmation, in line with GDPR Article 33 and applicable US state breach-notification laws. The notice will describe what was accessed, what we've done in response, and the steps you can take.
Future changes and your consent
The product, the data we collect, the partners and subprocessors we work with, the way we monetize the service, and the advertising or sponsored content (if any) we show may evolve over time. Freecost is free today; we expect changes.
You can grant or withdraw permission for the following categories of data processing, which together describe Freecost's current and contemplated future monetization activities: (a) product improvement and analytics; (b) personalization and tailored recommendations within Freecost; (c) advertising and sponsored content (including any future in-app or website advertising, sponsored partner cards, and affiliate recommendations); (d) the sharing or sale of personal information for marketing, advertising, or analytics purposes (including disclosures that may meet a statutory definition of “sale” or “sharing” under CCPA/CPRA or comparable laws); (e) marketing communications by email or in-app message; and (f) any other monetization or partnership activities reasonably ancillary to the foregoing.
When our data practices change in a way that meaningfully affects you, we will:
- Update this Privacy Policy with the new practices clearly described, including any new categories of data collected, new purposes for use, new subprocessors, or new sharing arrangements.
- Give you advance notice by email at least 14 days before the change takes effect (30 days for changes that introduce advertising, sponsored content, or any new disclosure of personal information to a third party for their own use).
- Provide an opt-outat least as broad as applicable law requires (for example, a “Do Not Sell or Share My Personal Information” control for California residents, and the right to object to processing for EEA/UK residents).
- Maintain your existing data choices where reasonably possible — turning on a new feature for new users will not silently change settings you previously configured.
Where applicable law requires affirmative consent, a change takes effect for you only after you opt in.
Changes
We'll email you about meaningful changes to this policy at least 14 days before they take effect (30 days for changes that introduce advertising, sponsored content, or new third-party data disclosures).
Contact
Questions or privacy / data requests: [email protected]