COOKBOOK.STORE
Privacy policy
Last updated:
This policy explains how Cookbook.Store (“we,” “us,” or “our”) handles information when you browse our website, sign in, or contact us. It covers cookbook.store and dev.cookbook.store.
1. Information we handle
- Account information. When you request a sign-in link, Google Firebase Authentication processes your email address and creates or accesses an account with a unique user ID. Our server uses your verified email, user ID, and a four-hour session expiry to maintain your signed-in session and check access permissions. You can sign in using an email link or an email address and password. Password registration, verification, and resets are handled by Firebase; passwords are sent directly to Firebase and are not stored in our application database or PHP sessions. We store a user directory with sign-in email, verification and disabled status, linked to your Firebase user ID. Authorized administrators can correct site profile data and disable access to Cookbook.Store without changing your Firebase account. We store your author-tools preference, which you can change in Account settings. We require a public name during account setup, linked to your Firebase user ID. It appears on your profile, journal posts, and comments; a nickname or pen name is welcome. Cookbook author credits remain separate.
- Listing information. We store cookbook titles, author names, descriptions, cover images, purchase links, and promotion settings entered by authors and authorized administrators. We link author-managed listings to the author’s Firebase user ID and record confirmation that new author submissions are intended for all audiences. Author publications and changes to published books enter an internal admin review queue. Published listing information and its cover images are publicly accessible. Uploaded covers are resized to 200, 400, and 800-pixel widths without cropping and stored at public image URLs, including covers uploaded for drafts. Draft listing text is available only to its assigned author and authorized administrators. Do not submit private information in a public listing or cover image.
- Author profiles and journals. We store your chosen public profile URL, author name, biography, photo, social links, posts and image descriptions with your account ID. Saving a profile makes it public. Published posts are public; draft post text and saved previews are available only to their owner and authorized administrators. Profile and journal images use public S3 URLs, including images uploaded for drafts. Replacing an image or deleting a post does not remove stored image files. Contact support for image or profile removal.
- Catalog searches. Our server processes search text and category or sorting choices to find and rank published cookbooks. When you select Saved books, the browser sends the saved cookbook IDs needed to filter your results. Search text may appear in requested URLs and hosting logs. We do not attach searches to an account. Signed-in saved books are linked to your account.
- Community activity. We store saved-book connections and show related published journal entries in your updates feed. Comments and replies are public under your public name. Clicking a commenter’s name shows their public photo, About you text and social links, plus their author status and author-profile link when applicable. Anyone can report a comment; report reasons, timestamps, and a hashed account or random session identifier are stored privately for moderation and rate limiting. Administrators can view all comments, review reports and remove comment text. A removed-comment marker, account association, timestamps, and reports remain for moderation. Contact support for account or activity deletion requests. Saving a book creates account notifications about its journal entries and availability; email for these events is off unless you enable the corresponding category. Authors receive account notifications when their books are saved.
- Messages, notifications and blocking. We store text-only direct messages, conversation participants, timestamps and read status. Conversations are available to their participants through the site; messages are not end-to-end encrypted. Public names, profile images and author handles can be searched to choose a recipient. We also store notification events, unread status, category email preferences and delivery attempts. Email categories default off and can be changed in Account settings. Block lists are private: blocking stops direct messages in both directions and prevents the blocked member from adding comments to your journal. Existing messages and comments remain; blocking does not hide public content. Contact support for message or account deletion requests.
- Optional analytics. When enabled, Google Analytics measures visits to public catalog, cookbook, and legal pages after you allow analytics. Google may process a pseudonymous browser identifier, page-view information, referrer website, and browser, device, and network information. Our page measurements omit search text, URL fragments, and other query values except the public cookbook slug. We do not send account emails, Firebase IDs, sign-in links, saved-book selections, or author/admin form content to Analytics.
- Technical information. Our web host, image storage provider, and authentication provider may process IP addresses, browser or device information, requested URLs, timestamps, and error or security logs to deliver the site and protect it from abuse.
- Support messages. If you email us, we receive your email address and the information you choose to include in your message.
Published cookbook pages may include optional edition facts, author notes and preview links supplied by the listing manager. Public cookbooks, substantive author profiles, journals and discovery pages may be included in search-engine sitemaps and shared with page titles, descriptions and cover images. Draft text, saved-book lists and messages are not included in these sitemaps.
2. How information is used
We use this information to display cookbook listings, deliver sign-in links, verify accounts, enforce access permissions, respond to requests, troubleshoot problems, and protect the service. Requesting a sign-in link does not subscribe you to a marketing newsletter.
Optional Google Analytics helps us understand visits to public pages. It stays off until enabled for an approved HTTPS hostname and you allow it. Login, author, and admin screens are excluded. We disable advertising personalization and Google signals in the website integration. The current site does not accept payments. We will update this policy as data handling changes.
3. Cookies and browser storage
The site uses a session cookie for sign-in and form security. Signed-in access lasts a fixed four hours from sign-in, or ends when you sign out. Browsing does not extend this period. The sign-in cookie can persist across browser restarts during those four hours. Blocking cookies can prevent sign-in and administration from working.
When analytics is enabled, you can select Allow analytics or No thanks in the notice. Your choice is stored in this browser for up to 180 days. Google’s browser library is loaded only after permission; its first-party analytics cookies last no longer than the remaining permission period and are not extended by browsing. You can change your choice using Analytics preferences in the public-page footer. Withdrawing permission stops measurement, removes this integration’s analytics cookies, and refreshes the public page. We also keep measurement off when your browser sends Global Privacy Control or Do Not Track.
Saving books requires sign-in. Saved cookbook IDs are stored with your account ID for access across devices. Selecting Saved books may send these IDs to our server to retrieve matching published listings. If this browser contains saves from an earlier version of the site, you can explicitly import them into your account after signing in; new guest saves are no longer stored. For magic-link sign-in, your email may also be stored locally so a link opened on the same device can complete sign-in. The email is removed after successful completion.
You can remove account saves from Saved books. Clearing this site’s browser storage removes legacy browser saves and a locally stored email; it does not remove account saves. Local storage otherwise remains until it is cleared. Signing out ends account access but does not erase your saved books or delete your Firebase account.
4. Service providers and sharing
When configured, Mailgun delivers new-journal-post review notifications to designated site administrators. These messages contain the public author name, post title and links to the post and admin review queue. We record review and email delivery status. These administrative notices remain separate from member preferences. Mailgun also delivers account notifications for categories you enable, using your verified sign-in email. Member emails contain an event summary and a site link, without the body of a direct message or comment. We record delivery attempts and acceptance status; Mailgun processes recipient addresses and delivery metadata. Emails link to Account settings to change or turn off categories. Delivery is queued, and a message already being delivered may arrive after you change a preference or block a member.
Cloudflare Turnstile checks account forms for abuse. Your browser connects to Cloudflare, which processes network and browser signals; our server validates the challenge response and temporarily records successful verification in your session. See Cloudflare’s privacy policy.
Google Firebase provides authentication and sign-in email delivery. Google processes email addresses and technical information for authentication, account management, and abuse prevention. See Firebase’s privacy information and Google’s privacy policy.
When you allow enabled analytics, Google Analytics processes the measurement information described above. See how Google uses information from sites that use its services. Analytics retention follows the settings of our Google Analytics property.
Our hosting and S3-compatible image storage providers deliver the website and public cover images. Loading a cover image may send technical request information to the image provider. Providers process information as needed to deliver their services.
If you fetch book details from Open Library, our server sends the ISBN or Open Library record ID to that service. Requests identify our site using its public support contact. We do not send your account email, Firebase ID, or listing form content. Returned records may be cached in your private PHP session for up to one hour to reduce repeated lookups. Imported covers load directly from Open Library, which may receive your IP address, browser information, and requested image URL. Author-uploaded covers continue to be stored in S3. Amazon purchase links may include our affiliate tracking ID. Clicking them takes you to Amazon, which handles the purchase and may attribute a commission to us.
The current service does not sell personal information or share it for targeted advertising. We may disclose information where required by law or where reasonably necessary to investigate abuse and protect the service, users, or others.
5. Retention, location, and security
Firebase account records remain until the account is deleted. Provider logs and backups follow the relevant provider’s retention practices. We retain listing content while it is needed for the catalog; replacing a cover image does not immediately delete the previous stored image. Support correspondence may be retained to resolve requests and maintain relevant records.
Service providers may process information in the United States or other countries where they operate. We use access controls and verified authentication to protect administrative functions. No online service or transmission can be guaranteed completely secure.
6. Your choices and privacy requests
You can browse the catalog without an account, sign out, and clear browser storage. To request access to, correction of, or deletion of information associated with your account, email support@cookbook.store. We may need to verify your identity before acting on a request, and may retain information where required for legal or security purposes. Deleting account information may end your access to account features.
Depending on where you live, you may have additional privacy rights under applicable law, including rights to access, correct, delete, or restrict use of your information, and to contact a data protection authority. Send requests or questions to the same address.
7. External websites and ReciScan
Purchase links, author websites, and ReciScan lead to separate services with their own privacy practices. This policy does not cover those services. Our current site does not automatically transfer your account or saved cookbook list to ReciScan.
8. Children
The service is not directed to children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and arrange appropriate deletion.
9. Changes and contact
We will post updates on this page and revise the date above. Where required, we will provide additional notice of material changes. Contact support@cookbook.store with privacy questions. See also our terms of use.