Draft for review: highlighted parts still need filling in, and the whole text needs checking before launch.
Privacy policy
Last updated: 1 November 2026
Now We Cookin’ is a recipe site. We keep what we store about you to the minimum the site needs to work: no ads, no analytics, no tracking, and we never sell your data. This page says what we store, why, who helps us run the site, and how you can download or delete everything.
Who is responsible
The controller of your personal data is [name of the person or company], [address], [country]. Questions or requests about your data: [contact email address].
What we store, and why
- Your account. When you sign in (with Google or email and password, through Firebase Authentication) we store your email address, a technical account id, and the username you pick. Other cooks only ever see your username; we don’t store or show your real name. Why: to give you an account (performance of a contract, GDPR art. 6(1)(b)).
- What you do on the site. Your pantry, your shopping list, the recipes you save, your votes and your unit preference (metric or imperial). Why: these are the features you use (art. 6(1)(b)).
- Recipe requests in the Lab. The text you type, the chips you pick, a snapshot of your pantry when you ask to cook from it, the recipe drafts we generate and the tweaks you ask for. Why: to make the recipe you asked for (art. 6(1)(b)), and to keep the Lab fair with a daily limit per account (legitimate interest, art. 6(1)(f)).
- Technical logs. Our hosting provider keeps short-lived server logs (such as IP address and the page requested) to run the site and keep it secure. Why: security and keeping the site working (art. 6(1)(f)).
Recipes that are published on the site are public. If you delete your account, recipes you asked for stay on the site without your name.
Cookies
We only use cookies the site needs to work, so we don’t ask for consent:
nwc_session: keeps you signed in (14 days).nwc-units: remembers metric or imperial (1 year).
When you sign in with Google, Google sets its own cookies on its own sign-in page; see Google’s privacy policy. We use no analytics, advertising or tracking cookies.
Who helps us run the site
These providers process data for us, only to provide their service, under a data processing agreement:
- Vercel (hosting; our servers run in Frankfurt, Germany).
- Neon (database; region [Neon project region, e.g. Frankfurt]).
- Google Firebase Authentication (sign-in).
- OpenRouter and the AI model providers it routes to, such as DeepSeek (writing recipes in the Lab). They receive the text of your request, the chips you picked and, if you asked to cook from it, your pantry list. They don’t receive your email address or username. [check the data retention and training terms of OpenRouter and the model providers you use, and state them here]
Some of these companies are based in the United States. Where data leaves the European Economic Area, the transfer is covered by [the EU-US Data Privacy Framework and/or the European Commission’s standard contractual clauses: check each provider].
How long we keep it
As long as you have an account. When you delete your account, your data is deleted straight away; database backups that may still contain it are overwritten within [backup retention period, e.g. 7 days].
Your rights
You can, at any time:
- see and download everything we store about you (right of access and portability): on your account page, as a file;
- delete your account and data (right to erasure): on your account page;
- correct your data, object to processing, or ask us to restrict it: email [contact email address].
If you think we handle your data wrongly, you can complain to your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Children
The site isn’t meant for children under [age, e.g. 16]; they shouldn’t create an account.
Changes
If we change this policy we update it here and change the date at the top. Important changes we also announce on the site.