Privacy
Not legal advice. This says what the site actually does, in plain words, and it has not been reviewed by a lawyer. If you need it to be more than an honest description, have somebody qualified read it first.
The short version: if you are reading, nothing is stored about you. If you have an account, what is stored is the handful of things an account needs to work. Nothing is sold, and nothing is shared with anybody who wants to build a profile of you.
Reading without an account
No account, no cookie, nothing kept against you. Page views are counted, but anonymously and in aggregate. See cookies and counting for exactly how.
If you make an account
Stored: your username, your email address, a display name, whether you prefer grams or ounces, and a hash of your password. A hash is not a password: it cannot be turned back into one, which is the point of storing it that way.
Also stored, because they are the things an account is for: the recipes you have rated, the ones you have marked as made, and the comments you have written. Comments are public under your display name. Ratings are not shown with your name on them; they become part of an average.
If you sign in with Google
Google tells us your Google account's identifier, your email address, whether Google has verified that address, and the name on the account. That is all that is asked for and all that arrives. Google is told that somebody signed in; it is not told what you read here.
If you join the email list
The list is not kept here. It is held by Buttondown (buttondown.com), which is the only record of who is on it: this site's database stores nothing about subscribers, not even the address.
What Buttondown holds is your email address and whether you have confirmed it. Joining is two steps on purpose: you give the address, Buttondown emails you to ask whether you meant it, and nothing is sent until you click the link in that email. An address that is never confirmed is never written to.
Buttondown sends the newsletter, and every message it sends carries a one-click unsubscribe that works. You do not need an account here to be on the list, and being on the list is not an account.
Opens and clicks are not recorded. Buttondown can do it: a tracking pixel in the message, and links rewritten to pass through its own address first, which also tells it your rough location and which mail program you use. It only does that when it is switched on, and it is not switched on here.
Buttondown's own statement of what it does with this is its privacy policy; it says it does not sell subscriber data, and it is a US company. Joining the list is the one thing on this site that hands your address to somebody else, which is why it has a section to itself.
Everything your browser loads from somebody else
Four, and each of them is here because a specific thing on the site needs it. Nothing is loaded "just in case". The typeface is served from this site rather than from anybody else's font service, so that reading a page does not tell a third party that you did.
challenges.cloudflare.com(Cloudflare Turnstile)- The anti-spam check. Loaded only on sign-up and the contact form.
static.cloudflareinsights.com(Cloudflare Web Analytics)- The page counter. Loaded on every page, and it sets no cookies and does not track you across other sites. What comes back is aggregate, anonymous page-view data: how many, roughly from where, on what kind of device. Never who.
www.youtube-nocookie.comandi.ytimg.com(YouTube)- The player and its thumbnail, on the handful of recipes that have a video. Loaded only on those pages. The no-cookie domain is the privacy-preserving one, but YouTube still sees the request when a video plays.
Three more services run on the server, where your browser never touches them: Resend (resend.com) sends the email about your account, Buttondown (buttondown.com) holds the email list and sends the newsletter, and Google sign-in is checked from the worker rather than from your browser. The signup form posts to this site, which passes the address on, so your browser never speaks to Buttondown either. Cloudflare hosts all of it, under their privacy policy.
What is never done
No advertising. No third-party analytics that follow you elsewhere. No selling, renting or trading your address. No profile built from what you read. The site has no commercial reason to do any of it and no intention of finding one.
Where it lives
On Cloudflare: the database, the images and the site itself. Cloudflare is the host, which means it can technically see what it stores; it is not given your data for any purpose of its own.
The one exception is the email list, which lives with Buttondown and not here. If you are on the list and have no account, this site holds nothing about you at all.
What you can ask for
Write to hello@kennardcooks.com and you can have everything held about your account, have it corrected, or have it deleted. Deleting an account removes the account; comments you have written can be removed with it or left in place with the name taken off, and you choose which.
How long things are kept
Account data for as long as the account exists. Sign-in sessions expire. Anonymous page counts are aggregate from the moment they are collected and are never tied to a person.
A subscription for as long as you stay subscribed. Unsubscribing is the link at the foot of any message, and it is Buttondown that acts on it, so it works whether or not you have an account here, and without asking us.
Age
You must be at least 13 to make an account. If we learn one belongs to somebody younger, it gets deleted.
Changes
If this changes in a way that matters, the change is announced on the site before it takes effect.