Privacy

Without an account

Browsing and saving recipes works signed out. What you do then (your preferences, your saved recipes, what you have in the cupboard) is stored in your own browser under a key called uks.kitchen.v1. It never leaves your device. We cannot see it, and clearing your browser data deletes it permanently, including from us, because we never had it.

With an account

An account stores the same things on a server so they follow you between devices, plus your email address, which is what you sign in with. No name, no address, no phone number. If you block somebody, the list of people you have blocked is stored too. Only you can see it, and they are not told.

If you subscribe, you pay on Stripe’s own checkout page. Stripe takes and holds your card details; we never see or store them. We keep only a Stripe customer reference, so we know which subscription is yours, and its status and renewal date.

Accounts and data are held by Supabase on servers in the UK (London region). Every table is protected so that your rows are readable only by you, not by other users, and not by the browser code we ship.

What a profile shows

A public profile is optional and separate from your account. If you set one up, five things on it are published: the name you chose to be seen as, your handle, your picture, your banner photograph and your description. Anybody who visits /people/your-handle can read all five without signing in, and search engines can index the page.

Your email address is not among them, and not by policy. The table that holds public profiles has no email column in it at all, so there is nothing there to leak even if a rule were written wrongly later.

This page has never mentioned any of that, and profile pictures have been public the whole time. We are saying so now because a banner photograph makes it a bigger thing to have left unsaid, not because anything changed about the pictures.

A picture or a banner you upload is re-saved by your own browser before it is sent, which drops everything the camera wrote into the file, including, on a phone, the place the photograph was taken. Only the visible image leaves your device. You can take a banner off again at any time from your profile settings, and deleting your account removes the lot.

Cookies

This page used to say we set no cookies at all, and that there was therefore no banner. That stopped being true when the free PDF shipped, and it took us too long to notice. The PDF has since been retired, so the cookie that remembered which one you took is not written any more, by anybody, whatever you choose.

Three things are stored no matter what, because the site does not work without them. If you sign in, your session is kept in your browser’s local storage, and it is deleted when you sign out. Your answer to the cookie question is kept in a cookie, because the only way to stop asking is to remember that we asked. And while you are part way through the free week, the answers you have given and the meals you have swapped are kept for that browser tab only, so that reloading the page does not throw away the week you were in the middle of building. That one is gone the moment you close the tab, and it is never kept between visits.

Nothing is stored under remembering things. There used to be one item, which free PDF you downloaded, and it went when the PDF did. The category is still in the banner so that the day anything is kept there, you are asked rather than told.

There is nothing under advertising. Measuring is Google Analytics, described under What we measure. Advertising is still in the banner so that the day it changes, you are asked rather than told.

Worth saying because it is widely got wrong: this is not really about cookies. The law covers anything stored on your device, so moving something into local storage would not make it exempt. Nothing here relies on that trick.

The Menuni Android app loads neither Google Analytics nor the Meta pixel and never asks the cookie question.

What we measure

We record when something breaks, and a small fixed list of events like “a plan was generated”. This is how a site run by one person finds out it is broken without waiting for somebody to complain.

These records hold the page path, the error message, your browser’s user-agent string, and counts such as how many people a plan was for. They do not hold your email, your dietary requirements, your dislikes, your shopping list, or anything you typed. Page paths are recorded without the query string, so a search term cannot end up in a log. This part runs on our own server whatever you chose in the banner, because it stores nothing on your device.

Separately, and only if you agreed to measuring, there is Google Analytics. It tells us which pages people actually use. Its cookies are _ga, _gid and one named after the property, and turning measuring off deletes all of them. Say no and Google’s script is never requested, so they are not told you were here at all. This page used to say there was no third-party analytics service, and there now is one.

Who else gets your data

We never sell it. These companies process it because they run the site: Supabase, which stores accounts and data; Vercel, which serves the pages; Stripe, which takes payments if you subscribe; our email delivery service (Resend, with Brevo as a backup), which sends the emails you signed up for; and Bunny, which hosts recipe videos and sees your IP address when you play one.

Google, but only if you agreed to measuring. They are sent which pages you looked at, never your email or anything you typed.

One third party sees your IP address without us choosing to send it: the page loads fonts from Google Fonts, and loading a font is a request to Google’s servers. We mention it because it is true, not because it is significant.

Getting rid of it

Signed out: clear your browser data for this site and it is gone.

With an account: you can delete it yourself, in the Menuni app or on this website. Sign in, open Your kitchen, choose Delete account and confirm. How to delete your account also covers what to do if you cannot sign in. Deleting cancels any Premium subscription straight away, with no refund of unused time, and then removes the account, your profile, photos, recipes, ratings and notes, saved recipes, lists, books, weeks, follows, blocks and streak.

Under UK GDPR you also have the right to a copy of what we hold, to have it corrected, and to object to us holding it. Given the list above, that is a short conversation.

What we keep after deletion

Stripe keeps its own customer and invoice records for any subscription you paid for, because tax rules require them, and we do not delete them. Error reports and usage counts your account made stay, with your account number removed. Supabase, which runs our accounts, keeps its own security logs for a limited time.