Privacy Policy
Last updated: 15 May 2026
Who We Are
Breaking of Bread is operated by Francesco Galassi, based in Leeds, United Kingdom. Francesco Galassi is the data controller for the personal data described in this policy. You can contact him at [email protected].
What Data We Collect and Why
Account data (email address, display name)
Collected when you register. Used to provide the service and identify your account. Legal basis: performance of a contract.
Testimony content
Text and other content you submit as a testimony. Retained in anonymised form if you delete your account. Legal basis: performance of a contract; legitimate interest (preserving the archive).
Location data (city, country, coordinates)
Optional. Provided by you when submitting a testimony. Used to display testimonies on the public map feature. Legal basis: legitimate interest.
Comments, votes, and favourites
Activity you perform on the platform. Used to power interactive features. Legal basis: performance of a contract.
App feedback
Feedback you submit through the platform. Used to improve the service. Legal basis: legitimate interest.
Semantic embeddings and keywords
Derived automatically from submitted testimony content to power search and discovery features. These are not directly personal data but are generated from content you provide. Legal basis: legitimate interest.
Admin logs
Records of moderation actions taken on the platform. Used to maintain platform integrity and accountability. Legal basis: legal obligation; legitimate interest.
Retention
- Account data: retained for the lifetime of your account. Email addresses are hashed upon account deletion.
- Testimony content: retained in anonymised form after account deletion and not removed from the archive.
- App feedback: retained for up to 2 years.
- IP addresses: retained for 30 days and then automatically purged by hosting infrastructure.
Third-Party Data Processors
We use the following third-party services to operate the platform. Each acts as a data processor on our behalf.
- Supabase (Supabase Inc., USA): authentication and database hosting.
- Ionos(1&1 IONOS SE, Germany): primary server hosting, United Kingdom data centre.
- OpenAI (OpenAI LLC, USA): semantic embeddings and keyword extraction.
- Anthropic (Anthropic PBC, USA): keyword extraction.
- Resend (Resend Inc., USA): transactional email.
- Cloudflare (Cloudflare Inc., USA): media storage (R2).
International Transfers
Supabase, OpenAI, Anthropic, Resend, and Cloudflare are based in the United States. Transfers to these providers are made under the UK Extension to the EU-US Data Privacy Framework. The primary database is hosted in the United Kingdom via the Ionos VPS UK data centre, so testimony content and account data at rest remain in the UK.
Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to data portability
- Right to object
To exercise any of these rights, email [email protected] or use the account settings page.
How to Complain
If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.