--- title: "Privacy policy for the recipe API — Tiny Plates" description: "How Tiny Plates handles account data, API usage, optional Google Analytics and Google Ads conversions, Roaarrr and performance monitoring, and how to change your cookie choices." url: "https://www.tinyplates.dev/privacy" --- Tiny Plates / The details # Privacy Short, because we collect very little. ## What we collect * **Your account.** Your name, your email address, and a hash of your password. We never store the password itself. * **Your session.** A cookie that keeps you signed in. * **Your API keys.** The name you gave each key, when it was created, and when it was last used. Keys themselves are stored only as hashes — we cannot read one back to you, which is why a new key is shown once and only once. * **How much you use the API.** For each key, a count of requests and errors per endpoint per day. Counts, not requests: we do not store the parameters you sent or the recipes you got back. Our servers keep short-lived request logs, as any web server does. ## Keeping the site up We use Guvnor, a monitoring service, to find out which requests are slow and which are failing. It receives the path of each request, how long it took, the status code, and the details of any error. On the website it also records which pages you moved between, and stores a random session id in your browser so the steps of one visit line up. If you are signed in, API requests are tied to your account and to the key you used. Query strings are stripped before any of this leaves our servers, so what you typed into a search is not part of it. Paths are not stripped: a request for a single recipe includes that recipe's id. On the website this is off until you agree to it. We ask the first time you visit, and you can change your mind whenever you like — see below. API requests are measured either way; there is no browser to ask, and we cannot run the service without knowing what it is doing. ## Understanding site usage With your permission, we use Google Analytics to understand which pages people visit and how they use the site. Google receives page URLs and titles, referring pages, browser and device information, and approximate location information. Analytics cookies identify visits and returning browsers. Google Analytics stays off until you accept analytics cookies. We disable advertising personalization and Google signals. You can withdraw consent through the cookie choices below; this stops collection and clears the Google Analytics cookies on this site. See [Google's privacy policy](https://policies.google.com/privacy) for how Google handles the information it receives. With the same permission, Google Analytics also tells Google Ads when you create an account, so we can see whether our ads lead to sign-ups. Google Ads receives that a sign-up happened, not your name or email address, and we do not use it to target ads at you. With the same permission, we use Roaarrr to see how the site grows. It receives the address of each page you view without its query string, the page you came from, your browser and its language, and when you create an account. If you are signed in, it also receives your account id, but not your name or email address. Roaarrr sets no cookies, and it stops as soon as you withdraw consent. One thing reaches Roaarrr either way: the first time your account makes a request to the API or through MCP, our servers tell Roaarrr that it happened, with your account id and whether it came through the API or MCP. That request does not come from a browser, so there is no cookie choice to ask, and it is sent once per account. It carries nothing about the request itself. ## What we do not collect * No ads on the site, no ads targeted at you, and no trackers that follow you to other sites. * No profile of the recipes you search for. Google Analytics and Roaarrr measure website activity, not the contents of requests made to our recipe API. Roaarrr learns only that your account made its first one. * No card details. Payments for paid plans go through Stripe, which holds your card. We keep your plan and the ids Stripe gives your customer record and subscription. ## Who else sees it Nobody buys it and nobody is sold it. Your data sits in our database and on the servers that run this site, both with infrastructure providers who process it on our behalf and under contract. The performance data described above goes to Guvnor on the same terms. If you accept analytics cookies, website usage data also goes to Google and Roaarrr. Roaarrr also learns when your account makes its first API request, as described above. We disclose data otherwise only where the law requires it. ## Cookies and browser storage One cookie keeps you signed in. A second is set when you press Run in the [documentation](https://www.tinyplates.dev/docs): it holds the API key that page created for you, so the request is made with your own key. Both are necessary for the site to work. A third remembers whether you agreed to the monitoring above, so we only ask again when our cookie choices change. If you accept analytics, Google Analytics also sets cookies with names beginning with `_ga`, and Google Ads sets cookies with names beginning with `_gcl_` when you arrive from one of our ads. If you did agree, that monitoring keeps a random session id in your browser's local storage. It identifies a visit, not you, and it is not used to target ads at you. . ## Keeping it or deleting it We keep your account for as long as you have one, and usage counts for 30 days. You can revoke any API key yourself from your [dashboard](https://www.tinyplates.dev/dashboard/keys), which takes effect immediately. To get a copy of your data, or to have your account and everything attached to it deleted, write to [chris@pullpanda.io](mailto:chris@pullpanda.io). ## Recipes The recipes the API serves are gathered from public recipe pages and are not personal data about you. Each one links back to the page it came from. If you publish recipes and want your site excluded, write to the same address — see [about](https://www.tinyplates.dev/about). ## Changes If this policy changes in a way that matters, we will say so here before it takes effect.