Privacy Policy

1. Information We Collect

We collect information needed to run accounts, recipes, calculators, and product analytics.

• Account data: When you create an account with email and password, we collect your email address and authentication credentials (passwords are handled by our auth provider and are not stored by us in plain text). When you sign in with Google, we receive your email address and basic profile information from Google to create and maintain your account. You may also set a username, display name, and profile preferences.
• Baking & content data: Recipes, ingredients, instructions, baker's percentages, bake logs and journal entries, cook-mode progress, ratings, favorites, want-to-bake lists, and any notes you save. If you make a recipe public or create a share link, that content (and related metadata) may be visible to others as you configure.
• Images & uploads: Recipe photos and images you upload for display or for AI-assisted import. Uploaded import images may be stored so we can process your request.
• Import inputs: URLs, pasted text, social links, and other content you submit for recipe import (including Beta AI import features).
• Usage & calculator data: How you use calculators and product features (including inputs you enter while signed in) so we can provide results and improve the Service. Interactive calculators require an account.
• Analytics data: Pages viewed, session activity, feature usage, and marketing/conversion events (for example signup funnel steps and calculator gate views). Analytics use a distinct ID and, when you are signed in, may be linked to your account ID. This is pseudonymous product analytics, not fully anonymous when you have an account.
• Technical data: IP address, browser type, device information, approximate location derived from IP, and cookies or similar technologies as described below.
• Billing data (when paid plans are enabled): Plan tier and subscription status. Payment card details are processed by our payment processor (for example Stripe) and are not stored on our servers in full.

2. How We Use Your Information

We use information to:

• Provide, operate, secure, and maintain the Service
• Create and manage accounts, sessions, and authentication
• Store and display your recipes, logs, images, and preferences
• Power calculators, import tools, cook mode, and related features
• Process AI-assisted imports by sending necessary content to our AI providers
• Publish content you choose to make public or share via links
• Enforce plan limits and, when enabled, process subscriptions and billing
• Understand product usage, fix bugs, and improve features and marketing
• Communicate essential service messages (security, account, or material changes)
• Detect abuse, enforce our Terms, and comply with law

3. AI Processing

Certain Beta features (such as AI import from social content, photos, or assisted text extraction) send the content you submit—and related metadata needed to fulfill the request—to third-party AI providers (currently Google Gemini) for processing. Do not submit sensitive personal information you do not want processed by those providers. AI output may be incomplete or inaccurate; you are responsible for reviewing imported recipes before baking.

Submitted content is used only to fulfill your import request. We do not use your content to train our own AI models. Our AI providers process it under their API terms (see Google's Gemini API terms). We retain import inputs (such as submitted URLs and uploaded import images) and processing logs for a limited period for abuse prevention, rate limiting, and debugging, then delete or de-identify them.

4. Cookies & Similar Technologies

We use cookies, local storage, and similar technologies for:

• Essential: sign-in sessions and security (for example Supabase authentication cookies)
• Analytics: PostHog may set cookies and/or use local storage to measure page views, sessions, and funnel events — only after you allow analytics in our consent banner

Analytics is off by default. The first time you visit we show a consent banner; PostHog only initializes if you choose "Allow analytics." You can change your choice at any time via the "Cookies" link in the footer. If your browser sends a Global Privacy Control signal and you have not made an explicit choice, we treat it as a decline and do not enable analytics.

You can also control cookies through your browser settings. Blocking essential cookies may prevent sign-in or core features from working.

5. How We Share Information

We do not sell your personal information. We share information with:

• Service providers / subprocessors that help us run the Service, including:
  • Supabase — authentication, database, storage, and related backend services
  • PostHog — product and marketing analytics (privacy policy)
  • Google — OAuth sign-in (when you choose Google) and Gemini for AI import features
  • Hosting providers (for example Vercel) that serve the website and application
  • Payment processors (for example Stripe), when paid subscriptions are enabled
• Other users when you publish a public recipe, share a link, or otherwise make content visible
• Legal & safety when required by law, to protect rights and security, or in connection with a merger, acquisition, or asset transfer (with notice where required)

6. Public Content & Sharing

Content you mark public or share via link may be viewable by others, indexed by search engines where applicable, and saved or copied by other users as allowed by the product. Think carefully before publishing personal details in recipes, notes, or photos. You can usually unpublish or remove share access in the product; remnants may remain in backups or caches for a limited time.

7. Data Retention & Security

We retain account and content data for as long as your account remains active and as needed to provide the Service, resolve disputes, enforce agreements, and meet legal obligations. After account deletion, we delete or de-identify personal data within a commercially reasonable period, except where retention is required by law or for legitimate security/audit purposes. Backups may persist for a limited time before rotating out.

We use commercially reasonable safeguards to protect data, including encryption in transit, row-level access controls on our database, and least-privilege access to production systems. No method of transmission or storage is 100% secure.

If we become aware of a security breach that affects your personal data, we will notify affected users and applicable regulators without undue delay and within the timeframes required by applicable law (for example, GDPR's 72-hour supervisory notification requirement), including a description of what happened and steps you can take.

8. Your Rights & Choices

Depending on where you live, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated personal data
• Export or receive a copy of certain data you provided
• Object to or restrict certain processing, where applicable
• Withdraw consent where processing is consent-based

To exercise these rights, email support@baking-maths.com. We may need to verify your identity (for example by confirming control of your account email) before acting on a request, and we respond within 30 days or the shorter period applicable law requires. If we deny a request you may appeal by replying to our decision. We will not discriminate against you for exercising any of these rights. You can also update some profile information in the product, and sign out anytime from your profile.

If you are in the EEA, UK, or Switzerland, our legal bases include performance of a contract (providing the Service), legitimate interests (security, product improvement), and consent (non-essential analytics). You also have the right to lodge a complaint with your local supervisory authority. California residents may have additional rights under the CCPA/CPRA (including the right to know, delete, and correct). We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we honor Global Privacy Control signals as described in Section 4. If that ever changes, we will update this Policy and provide required opt-outs first.

9. Children

The Service is not directed to children under 13 (or under 16 where a higher age is required). We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

10. International Transfers

We and our providers may process data in the United States and other countries. Those countries may have different data-protection laws than your home country. Where required, we rely on appropriate transfer mechanisms used by our providers.

11. Changes to This Policy

We may update this Policy from time to time. We will post the revised version on this page and update the "Last updated" date. For material changes, we may also provide additional notice (for example by email or in-product notice). Continued use after the effective date means you accept the updated Policy.

12. Contact Us

Questions about privacy or data requests: support@baking-maths.com.