Privacy Policy

Recapp is a private recipe collection at recapp.site, run by one person as a personal, non-commercial project. This page says what Recapp stores about you, why, and who handles it.

What Recapp stores

• Your account: email address, display name, and whether the address is verified. While an email change waits for confirmation, the new address too.
• Your password, as a one-way hash only. The password itself is never stored.
• If you use Continue with Google: your Google account ID and the email address Google reports for it. When you sign up with Google, your Google name sets your first display name, which you can change. Google's access tokens are discarded after sign-in, and your Google profile photo is not stored.
• Your recipes, categories and favorites, including ingredients, steps, notes and video links.
• Photos you upload. Recapp keeps a resized, re-encoded copy; the original file and its metadata, such as camera location, are not kept.
• For each sign-in: a session record with its expiry, your IP address and your browser's user agent. A session ends after seven days or when you log out.
• Email links for verification, password reset and email change, stored only as a hash and valid for a limited time.
• Short-lived attempt counters for rate limiting, keyed by your client IP address or email address, in most cases hashed. Expired counters are removed as new attempts arrive.

Recapp's own logs record error types, codes and at most an internal account ID, never your email address, password or recipe content. The hosting providers below keep their own request logs, which include IP addresses.

Why

• To run your account and keep your recipes.
• To sign you in, with a password or with Google.
• To send account emails: address verification, password reset, email change, and notices about your account.
• To protect the service from abuse, such as repeated sign-in attempts.

Recapp shows no ads, sells no data and shares nothing between accounts.

Who handles your data

• Vercel hosts the web app.
• Render hosts the API.
• Neon hosts the database and the photo storage.
• Google provides Sign in with Google and Google Analytics.
• Resend delivers account emails.

Google user data

Continue with Google asks only for your basic profile: your Google account ID, email address and name. Recapp uses it only to sign you in or to link Google to your account. It does not ask for access to Gmail, Drive or any other Google data. No Google user data is sold, shared or used for advertising.

Recapp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Recapp uses the cookies it needs to sign you in, and Google Analytics cookies to measure how the site is used. There are no advertising cookies.

• A session cookie that keeps you signed in, for up to seven days.
• A sign-in state cookie while Continue with Google runs, for up to five minutes.
• A cookie holding the address you signed up with, so the check-your-email page can show it, for up to one hour.

On the live site, Google Analytics sets cookies that tell one browser from another and keep the state of a visit, so Recapp can see which pages are used and how often. They do not hold your name, email address or recipes.

• _ga, which gives your browser a random ID, for up to two years.
• _ga_ followed by the site's measurement ID, which keeps the state of your visit, for up to two years.

Google processes this usage data in line with its privacy policy. You can block these cookies in your browser or with Google's opt-out add-on; Recapp works the same without them.

Keeping and deleting your data

Your data is kept while your account exists. To delete your account and everything in it, or to ask what Recapp holds about you, email hello@recapp.site from your account's address.

Changes and contact

If this policy changes, the date at the top changes with it. Questions go to hello@recapp.site.