← cd ~

Privacy Policy

Last updated: 26 October 2026

touchgrass.sh is run by an individual sole trader based in the United Kingdom, who is the data controller for the data described here. Contact: hello@touchgrass.sh.

The short version

  • Your bot runs on your own Cloudflare account. Your meals, photos, weight and messages never reach us.
  • We collect the minimum: your email if you join the waitlist or email us, and order details if you buy.
  • No ads, no cookies, no selling data. We count visits with our own self-hosted, cookieless analytics.

Your touchgrass bot

The bot and its database live in your Cloudflare account and talk to your Telegram bot. We have no access to them. Telegram and Cloudflare (including Workers AI, used for food photo analysis) process that data under their own privacy policies, as services you signed up to.

What we collect

  • Waitlist: your email address, the time you signed up and which page you signed up from. Used only to tell you about launch and major updates. Basis: your consent.
  • Talk to a human (Ask Moss): the Telegram username, email or phone number you type, your message, the page you sent it from and your country (from your IP, the IP itself is not stored). Kept for 180 days and sent to us on Telegram so we can reply. Basis: your consent.
  • Visit counts: self-hosted Umami analytics records pages viewed, clicks on Ask Moss and buttons, referrer, browser, device type and country. No cookies, no cross-site tracking, no IP addresses stored. Basis: legitimate interest.
  • Abuse protection: your IP address, kept for 10 minutes to stop repeated waitlist signups. Basis: legitimate interest.
  • Emails: messages you send to us, and our replies. Our outgoing emails contain a small image that tells us whether the email was opened. Basis: legitimate interest.
  • Purchases: your name, email, country, what you bought, and the GitHub username you give us to grant repository access. Card details go to Dodo Payments and never reach us. Basis: contract, and legal obligations for tax records.

Who processes it

  • Cloudflare: hosts this site, the waitlist and our email.
  • Resend: sends our outgoing email.
  • RackNerd: hosts the server our Umami analytics runs on.
  • Telegram: delivers Ask Moss messages to us.
  • Dodo Payments: Merchant of Record for purchases (payment, invoices, tax).
  • GitHub: hosts the private add-on repositories you are invited to.

Some of these providers are based outside the UK. They protect transfers with standard safeguards such as international data transfer agreements.

Cookies and storage

This site sets no tracking cookies. It stores your light/dark theme choice in your browser's local storage, which never leaves your device.

How long we keep it

  • Waitlist emails: until you ask us to remove you, or we stop sending updates.
  • Emails: up to 2 years.
  • Purchase records: 6 years, as UK tax law requires.

Your rights

Under UK GDPR you can ask to see, correct, delete or export your data, or object to how we use it. Email hello@touchgrass.sh and we will reply within one month. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes, we will update the date at the top.