Privacy policy

1. Who is responsible

forever.recipes, by Drafted By is the independent digital service responsible for the personal data processed here. It is operated within the European Union and is reachable at [email protected].

2. What we store

• Your email address, used only to sign you in.
• The books, recipes, notes, and photos you create.
• Your Stripe customer reference if you subscribe (we never see card numbers).

3. What we never do

• We never sell or rent your data to anyone.
• We never show advertising and never run ad trackers.
• We never use your content to train machine learning models.
• We never set marketing cookies.

4. Limited public measurement

On eligible public pages, we set one 30-day first-touch cookie. It contains only a public landing-page group and a broad source category, such as direct, search, newsletter, or referral.

Umami records a stable category for eligible public pages, without raw private paths or recipe content. PostHog receives limited public-site analytics events and sampled public performance data. These services receive limited route, source, and metric fields. This measurement excludes recipes and private books and does not include the content of your recipes, notes, books, or photos.

5. Processors

Your data passes through these processors, strictly for the purpose listed:

• Stripe processes payments and subscriptions and may retain billing or subscription records under its own legal obligations and policies.
• Cloudflare: hosting, object storage (photos), and email delivery.
• OpenRouter: optional AI drafting. Only the text or photo you explicitly submit for drafting is processed, under OpenRouter's no-training policy.
• MXRoute: transactional email delivery.

6. Retention and deletion

We keep your data while your account exists. You can delete books, recipes, and photos yourself at any time. Account deletion removes the product data held by forever.recipes after required external cleanup succeeds. Stripe may separately retain billing records as described above.

7. Your rights

You have the right to access, rectify, export, and erase your personal data, and to object to or restrict processing. Write to [email protected] to make a request. You may also have the right to lodge a complaint with the data protection authority that applies to you.

8. Security

Access is by magic link (no passwords to leak), sessions are hashed at rest, and connections are encrypted in transit. Recovery backups are encrypted and isolated from ordinary product access. Photo and object-storage snapshots currently use 7 daily, 4 weekly, and 13 rotating 28-day recovery slots; off-site transfer copies expire after 9 days. A deleted photo can therefore remain in an isolated recovery snapshot until its slot expires. If a backup is restored, recorded deletions must be reapplied before the restored service becomes available to users.