Privacy Policy

Last updated: 13 August 2026

This privacy policy explains how I, Samuel Liedtke, process your personal data when you use FindThatRecipe.eu ("the site"). I run the site as a personal hobby project from Berlin, Germany. It is not a commercial offering.

1. Who is the controller?

I am the sole data controller. I am not obliged to appoint a Data Protection Officer (Art. 37 GDPR) and have not done so.

2. What data do I collect?

2.1 Data you give me (account holders only)

• Email address
• Username (chosen by you)
• Hashed password (I never see your plaintext password)
• Date joined, last login, email verification status
• Book selections on your personal bookshelf (private to you)

Creating an account requires an email address and a username; this is necessary to enter into the user agreement with you. Without an account, you can browse the site and use the recipe search without providing any further data.

2.2 Data collected automatically on every page view

When your browser loads a page, the following happens automatically:

• The site uses PostHog's cookieless Web Analytics SDK, which sends a small event payload to PostHog (see § 4.1). PostHog's servers briefly receive your IP address and user agent string to compute a daily-rotating salted hash, then strip both before storing the event.
• The application's HTTP server (Fly.io) processes the request and emits a server log containing your IP address, user agent, and the requested URL. Fly.io retains these logs for a limited operational period. I do not retain them separately, and do not control Fly.io's retention directly — both are governed by Fly.io's data processing agreement.

On the signup page only, the browser additionally loads a Cloudflare Turnstile bot challenge:

• The browser fetches a script from challenges.cloudflare.com. Cloudflare receives your IP address, user agent, and browser characteristics in order to decide whether to issue a single-use challenge token. Cloudflare does not set a cookie for this — see § 7. When you submit the form, the site sends the resulting token to Cloudflare's /siteverify endpoint to confirm that the challenge was solved; that call originates from the application server, not your browser.

The site does not set a session cookie on every page view. A session cookie is created only when the application's own functionality needs one — for example, when you log in, sign up, toggle a recipe filter, or trigger a flash message. See § 7.

3. Why do I process your data, and on what legal basis?

I do not perform any automated decision-making or profiling within the meaning of Art. 22 GDPR.

4. Who do I share your data with?

4.1 Sub-processors

I use the following service providers to operate the site. Each processes data only on my documented instructions and under a data processing agreement.

5. International data transfers

Most of your data stays within the EU. Where data is transferred to the United States (Sentry, Cloudflare), I rely on the EU-US Data Privacy Framework (DPF) as the transfer mechanism under Art. 46(2)(c) GDPR. Both providers are DPF-certified. Data hosted by Fly.io is in the United Kingdom, which is covered by the current EU adequacy decision.

Risk note (August 2026): the EU-US DPF is currently the operative Art. 45 GDPR adequacy mechanism, but its legal basis is under pressure. A June 2026 US Supreme Court decision raised questions about the independence of the FTC — one of the framework's oversight bodies — and a legal challenge to the DPF has been announced. If the DPF were invalidated, I would rely on Art. 46(2)(c) GDPR Standard Contractual Clauses (SCCs) as the fallback transfer mechanism. You can request a copy of the relevant DPF certifications and any SCCs I hold with these providers by emailing privacy@findthatrecipe.eu.

6. How long do I keep your data?

• Account data: until you delete your account. To delete, go to your profile → Account Settings → Delete my account. If that flow is unavailable, email privacy@findthatrecipe.eu and I will process the request manually within 30 days (Art. 12(3) GDPR).
• Account-deletion audit log: when you delete your account, I write one row to a deletion audit table in my primary database (timestamp, your user ID, username, email, and IP address). This is the audit trail proving I actioned your Art. 17 request and exists solely to demonstrate compliance. The row commits at the same instant as the deletion of your account, so either both happen or neither does. Rows older than 30 days are deleted automatically (Art. 5(1)(e) GDPR).
• Session data (Django sessions): up to 2 weeks after your last visit (Django default).
• Transactional email records (SES): per AWS default; governed by the AWS data processing agreement.
• PostHog analytics events: 90 days.
• Sentry error events: 90 days.
• Fly.io platform logs: per Fly.io default; governed by the Fly.io data processing agreement.
• Cloudflare Turnstile data: Turnstile tokens are single-use and short-lived. I do not store them; Cloudflare's own retention of the underlying signals (IP, user agent, browser characteristics) is governed by Cloudflare's Data Processing Addendum.

7. Cookies

The site sets only cookies that are strictly necessary for it to function, and only when the application's own functionality needs them. These do not require consent under § 25 TDDDG (the German implementation of the ePrivacy Directive). No analytics, marketing, or third-party cookies are used at any time.

Because the site uses no analytics, marketing, or third-party cookies (PostHog runs in cookieless mode, which uses no cookies, localStorage, or sessionStorage; Cloudflare Turnstile does not set a cookie by design), no cookie consent banner is shown.

8. Your rights under the GDPR

You have the right to:

• Access (Art. 15) — request a copy of the data I hold about you.
• Rectification (Art. 16) — ask me to correct inaccurate data.
• Erasure (Art. 17) — delete your data yourself via your profile, or ask me to do it ("right to be forgotten"). Self-service is the fastest path; manual requests are processed within 30 days.
• Restriction (Art. 18) — ask me to limit how I process your data.
• Data portability (Art. 20) — receive your data in a machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest.
• Withdraw consent (Art. 7(3)) — where processing is based on consent (currently none of mine is).

To exercise any of these rights, email privacy@findthatrecipe.eu. I respond within 30 days (Art. 12(3) GDPR). There is no fee.

9. Right to complain to a supervisory authority

If you believe I have not handled your data properly, you have the right to lodge a complaint with a data protection supervisory authority. As I am based in Berlin, the responsible authority is:

10. Changes to this policy

I may update this policy as the site evolves. The "last updated" date at the top will reflect the current version. Material changes that affect your rights will be communicated to logged-in users by email where appropriate.