PRIVACY POLICY
Last updated: October 3, 2026
This policy explains what this research version of cookly.recipes collects about you, what it never collects, and what you can do about it. The short version: we keep your email if you give it to us, we never see your card details, and advertising tools may set cookies.
1. Who We Are and What This Covers
This website (the "Site") is operated by cookly.recipes and its operators ("we", "us", "our"), acting from Canada. This policy covers the Site only. It does not cover the future cookly.recipes product, which will have its own policy.
The Site is intended for people aged 18 and over. We do not knowingly collect data from children.
The Site is a test. Its checkout is a simulation, as explained in our Terms of Service. That shapes what we collect, below.
2. What We Collect
Information you type in:
- At the checkout: your email address and the country you select, together with the recipes in your cart and the total shown at that moment.
- In the early-access form: your name, email address and country; for chefs, also your years of commercial experience and your cuisine specialties.
- In the sign-in box: your email address. Sign-in is not active on this version, so nothing further happens with it.
Information we never collect: the card number, expiry date, security code, name on card and billing address typed at checkout. These are checked for format inside your browser and discarded. They are not sent to us, not stored anywhere, and not visible to us or to anyone else.
Information collected automatically: when you submit a form, our server receives your IP address, browser user-agent and the page you came from, and reads the Meta cookies described in section 4 if they are present. Our hosting provider keeps standard server logs. Advertising and analytics tools, described in section 4, collect page views and the actions listed there.
3. Why We Use It
We use your information to:
- send the confirmation email and the receipt that states nothing was charged, and deliver the promo code;
- tell you when the real product launches;
- understand how many people are interested in the product and which recipes they chose, which is the purpose of this Site;
- measure our advertising and tell the advertising platform which visits led to a signup, so that we can show the Site to people who are likely to be interested;
- keep the Site secure and working.
Where the GDPR or the UK GDPR applies to you, our legal bases are: your consent (advertising cookies and marketing emails), performance of what you asked for (sending you the confirmation and the promo code), and our legitimate interest in running and measuring this research Site in a way that does not override your rights.
We do not sell your personal information and we do not share it with third parties for their own marketing.
4. Analytics and Advertising
Meta Pixel and Conversions API. We advertise the Site on Meta platforms (Facebook, Instagram). The Meta Pixel may set the `_fbp` and `_fbc` cookies and send Meta a record of your page views and of events such as adding to cart, starting checkout and submitting a form. When you leave your email, our server also sends Meta a "Lead" event through the Conversions API. In that event your email, name and country are hashed (SHA-256) before they leave our server; your IP address and user-agent are sent as-is, as Meta requires. Meta uses this to match the event to its users and to measure and optimise our ads. You can limit this through your Meta ad settings and by blocking the cookies named in section 8. Meta's own policy is at facebook.com/privacy/policy.
Web analytics. We use a web analytics service to count visits and see which pages, filters and recipes people use, and whether they reach the checkout. It records page views and the events named above, together with a rough location derived from your IP address, your browser and device type. We configure it not to record what you type into forms.
On the Site itself, these events are also kept in a browser data layer so that the tools above can read them. That data layer is not sent anywhere by us.
5. Who Processes Your Data for Us
We use these providers strictly to operate the Site. Each processes data only as needed for its service and under its own privacy terms:
- Resend — delivers our emails to you and the notification to us (resend.com/legal/privacy-policy).
- Meta Platforms — advertising measurement, as described in section 4.
- Vercel — hosts the Site and keeps its server logs (vercel.com/legal/privacy-policy).
- A web analytics provider — page and event statistics, as described in section 4.
Some of these providers are outside Canada, the EU and the UK, notably in the United States. Where European or UK law applies, transfers rely on the provider's standard contractual clauses or an equivalent safeguard.
6. How Long We Keep It
- Your email and the details you gave with it: until the product launches and you have been told, or until you ask us to delete it, whichever comes first.
- The notification emails we receive about signups and simulated purchases: in our mailbox for the same period.
- Advertising and analytics data: for the periods set by those providers, typically up to 180 days for Meta events and up to two years for aggregated analytics.
- Server logs: a short rolling period set by the hosting provider.
7. Your Rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it, including removing you from the waitlist;
- stop sending you emails, which you can also do with the link in any email we send;
- stop processing based on consent, such as advertising cookies.
Write to the address in section 11. We reply within 30 days and may ask you to confirm the email address the request concerns.
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and you may complain to the Office of the Privacy Commissioner of Canada. If you are in the EU or the UK, the GDPR or UK GDPR applies, and you may complain to your local supervisory authority. If you are a California resident, we do not sell or share your personal information as those terms are defined in the CCPA.
9. Children
The Site is not directed at anyone under 18, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Security
The Site is served over HTTPS. Form submissions go to our server over an encrypted connection, and the card and address fields are never submitted at all. We take reasonable steps to protect the little we keep, but no transmission or storage method is completely secure, and we cannot guarantee absolute security.
11. Changes to This Policy
We may update this policy. Changes are posted on this page with a new date at the top. If a change materially affects how we use data you have already given us, we will email you.
12. Contact
For any question or request about your data, write to cookly.recipes@proton.me.