Privacy policy

Weeknight Feast is a recipe website operated by [YOUR NAME OR COMPANY], based in [CITY, COUNTRY]. For data protection purposes we are the “data controller” (GDPR) and “business” (CCPA) responsible for information collected through this site.

You can reach us about anything in this policy at [YOUR CONTACT EMAIL].

Comments and ratings. If you leave a comment, we store the name you type, the text of your comment, your star rating if you give one, which recipe it belongs to, and the date and time. We do not store your IP address or email address alongside comments, and we do not require an account.

The name you enter is published publicly next to your comment, so please use whatever name you are comfortable having visible. You do not have to use your real name.

Contact form. The contact form on this site is currently a demonstration and does not send or store anything. Nothing you type into it leaves your browser. If that changes, this policy will be updated first.

Server logs. Like almost all websites, our hosting provider automatically records technical information about requests — typically IP address, browser type, the page requested and a timestamp. These logs are generated and retained by [YOUR HOSTING PROVIDER, e.g. Vercel] for security and reliability purposes, not by us for tracking, and we do not link them to comments or build profiles from them.

Administrator sign-in. The site has a private admin area used only by us to publish recipes. Signing in sets a session cookie. This applies to the site operator only and never to ordinary visitors.

Browsing this site as a visitor currently sets no cookies at all. We do not use tracking cookies, advertising cookies or analytics cookies.

We do store two small things in your browser’s local storage, which is different from a cookie: it stays on your device and is never transmitted to us or to anyone else.

• Recipe progress. When you tap a step to cross it off, we remember which steps you have completed for that recipe, so your place survives a page refresh mid-cook.
• Theme preference. Whether you chose light or dark mode.

You can clear both at any time through your browser’s “clear site data” settings. Doing so only loses your crossed-off steps and theme choice.

The only cookie this site sets is the administrator session cookie described above, which is strictly necessary for the operator to log in and is never set for ordinary visitors.

The typefaces used on this site are served from our own domain, not from Google’s servers. Although they originate from Google Fonts, they are downloaded and bundled when the site is built, so your browser never makes a request to Google to load them and no data about your visit is shared with Google as a result.

Photographs are likewise hosted on our own domain rather than loaded from a third-party image service.

We do not currently show any advertising, and no advertising or ad-measurement cookies are set. If we introduce advertising, this policy will be updated and — for visitors in the European Economic Area and the UK — consent will be requested before any advertising cookies are placed.

We do not currently run any analytics or visitor-tracking software on this site. There is no Google Analytics, no tag manager and no third-party measurement script. If we add analytics, this policy will be updated before it goes live.

If you are in the UK or the European Economic Area, the UK GDPR and EU GDPR require us to have a lawful basis for handling your data. Ours are:

• Consent (Article 6(1)(a)) — for publishing a comment or rating. You choose to submit it, and you can withdraw consent by asking us to remove it.
• Legitimate interests (Article 6(1)(f)) — for keeping the site secure and available, which is why our host keeps server logs. We have considered your rights and consider this proportionate, because the logs are short-lived and not used to identify or profile you.

We do not process any special category data, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

Comments and ratings are kept indefinitely so they remain useful to other readers, unless you ask us to delete them or we remove them for breaching our terms of service.

Server logs are retained by our hosting provider according to their own retention schedule, typically a short period measured in days or weeks.

We do not sell your data, and we do not share it for marketing purposes.

The only third party involved in running the site is our hosting provider, [YOUR HOSTING PROVIDER, e.g. Vercel], which acts as a processor on our behalf in order to serve the site to you. We may also disclose information where we are legally required to do so.

Comments you post are, by their nature, published publicly and can be read, copied and indexed by anyone, including search engines.

Our hosting provider may store or process data on servers outside your country, including outside the UK and European Economic Area. Where that happens, appropriate safeguards such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses are relied upon to protect it.

If you are in the United Kingdom or the European Economic Area, the UK GDPR and EU GDPR give you the following rights over your personal data:

• Right of access — to be told whether we hold personal data about you and to receive a copy of it.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to have your data deleted — in practice, usually a comment you left.
• Right to restrict processing — to have us pause use of your data while a dispute is resolved.
• Right to object — to object to processing carried out under legitimate interests.
• Right to data portability — to receive data you gave us in a structured, machine-readable format.
• Right to withdraw consent — at any time, without affecting anything done before you withdrew it.
• Right not to be subject to automated decision-making — — we do not carry out any, so this does not arise here.

How to exercise them. Email [YOUR CONTACT EMAIL] telling us what you want and, if it concerns a comment, which recipe it is on and the name you used. We will respond within one month, as the GDPR requires, and will not charge you for a reasonable request.

Because comments are anonymous, we generally cannot verify that a comment is yours. Rather than refuse on that basis, we will remove a comment on request — but that also means we cannot disclose data about a comment to someone claiming to have written it, since we have no way to confirm it.

Complaints. You can complain to your national supervisory authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the data protection authority for your country. We would appreciate the chance to resolve things directly first.

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you specific rights. This section sets out the disclosures California law requires.

Categories of personal information we collect. Over the past twelve months we have collected the following statutory categories:

Where it comes from. Directly from you when you submit a comment, and automatically from your device and browser when you request a page.

Why we collect it. To publish comments you choose to post, and to operate, secure and troubleshoot the site. These are business purposes under the CCPA.

Who we disclose it to. Only our hosting provider, as a service provider under a contract restricting its use of the data.

We do not sell or share your personal information, and we never have. “Sell” and “share” have specific meanings under the CCPA — share covers disclosure for cross-context behavioural advertising. We do neither. We also do not serve advertising, so no “Do Not Sell or Share My Personal Information” link is required. We also do not knowingly sell or share the personal information of anyone under 16.

Your California rights.

• Right to know — what personal information we collect, use and disclose, including the specific pieces we hold.
• Right to delete — personal information we have collected from you.
• Right to correct — inaccurate personal information.
• Right to opt out — of the sale or sharing of personal information — not applicable, since we do neither.
• Right to limit use of sensitive personal information — — not applicable, since we collect none.
• Right to non-discrimination — for exercising any of these rights. We will never degrade the site or charge you differently for doing so.

How to exercise them. Email [YOUR CONTACT EMAIL]. We will acknowledge within 10 business days and respond within 45 days, extendable by a further 45 where necessary. An authorised agent may submit a request on your behalf with written permission.

Global Privacy Control. Because we do not sell or share personal information, there is nothing for an opt-out preference signal such as GPC to act upon. If we ever introduce advertising that qualifies as sharing, we will honour GPC signals as a valid opt-out request.

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — have broadly similar rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and profiling. We do not carry out targeted advertising, sale or profiling. To exercise any right, email [YOUR CONTACT EMAIL] and we will apply the protections your state provides, including any right to appeal a refused request.

This site is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children, as defined by COPPA. If you believe a child has posted a comment containing personal information, contact us at [YOUR CONTACT EMAIL] and we will remove it promptly.

The site is served over HTTPS and the admin area is password protected. No website can promise perfect security, but we keep the amount of personal data we collect deliberately small — which is the most effective protection available.

We may update this policy as the site changes. The version on this page is the one that applies, and the “last updated” date at the top shows when it last changed. If we begin collecting materially more data — for example by enabling advertising or analytics — we will update this policy before doing so.

Questions, or a request about your data, can be sent to [YOUR CONTACT EMAIL] or through our contact page.