Privacy
We wrote this ourselves; no lawyer has reviewed it yet.
What this site collects, where it is stored, why we need it, and how to delete it. We only list what we have checked; if anything changes we will update this page and the date above.
What we collect
- Your account: the email and password you sign up with (kept by Supabase Auth; only a hash of the password is stored); the name and bio you enter; a profile address taken from the first part of your email (you can change it); when you ticked “I am 16 or older”; your site language. Your name, profile address and bio, and the recipes and comments you make public, are visible to others; your email is not.
- What you leave on the site: favorites, comments, reports; recipes and photos you upload (uploads are not open yet); notifications sent to you.
- Sign-in cookies: just two (dt_at, dt_rt). They hold your sign-in, page scripts cannot read them, and they expire after 30 days without a visit.
- Abuse counters: sign-up, sign-in and password-reset requests are counted per IP address and per email so bursts can be slowed down. The database stores hashes of the IP and email, not the originals, and each count is deleted a day after its window ends.
- Anonymous statistics: a summary at the end of cooking along (which dish, how far you got, how many timers, your “Did it work?” answer and so on) and page performance (load speed, screen size and so on). No account, no cookies, no IP address; stored in Cloudflare Analytics Engine and kept for three months.
- Kept only in your browser: kitchen preferences (units, servings, stove), where you are in cook-along (expires after 24 hours), and the share-image ratio you picked. None of this is sent to us.
- Server logs: the site runs on Cloudflare Workers; the address and result of each request go into its logs, kept for 7 days for troubleshooting.
Where it is stored, and who handles it
- Accounts and database: Supabase, hosted in the eastern US (Northern Virginia, us-east-1).
- The site, photos, anonymous statistics, server logs: Cloudflare. Photos are stored in Cloudflare R2 (Eastern North America).
- Email: sign-up confirmation and password-reset emails are handed by Supabase to Resend, which sees your email address and the message.
Why we need it
- to sign you in and keep you signed in;
- to show your name on your comments and profile, and remember your favorites;
- to send sign-up confirmation and password-reset emails;
- to stop password guessing, mass sign-ups and spam (rate limits and handling reports);
- to improve cook-along steps and page speed (using only the two anonymous kinds).
What we don’t do
- The only cookies are the two for signing in. They are not used for ads or cross-site tracking; the site has no ads and loads no third-party analytics scripts.
- We don’t sell your data or give it to anyone for advertising.
Deleting your data, and contacting us
- When signed in, you can delete your account at the bottom of Account settings. Your account, name, favorites, comments, reports, uploaded recipes and photos, and notifications are deleted together, and this cannot be undone. Deleted photos can no longer be opened by anyone; the stored files themselves are removed by a cleanup job that is not built yet (it will be before uploads open). Audit records left when editors handle reports or take content down (who, when, why) are kept.
- Supabase Auth keeps its own sign-up and sign-in records, which include your email; they are not deleted with your account. Email us if you want them removed.
- Questions, or want us to handle something for you? Write to privacy@duckitup.com.
- You must be 16 or older to sign up.