Legal
Cookies
Draft — needs a lawyer’s review These pages are a draft. A lawyer hasn’t reviewed them yet, and the facts marked “to fill” are still missing: both will be settled before the site opens to everyone. On 15 October 2026 the names of things changed — a table for a family, Cook for the role Member, account holder for member, Everyone for Public, guest link for viewer link, follow for subscribe, share for approve, thank-you for tip — without changing any rule; the changed clauses are listed for our lawyer’s review.
A cookie is a small piece of text a website asks your browser to keep and send back. OnlyGravy uses only essential cookies: the ones it needs to keep you signed in and to remember the guest and share links you opened. None is used for tracking, analytics or advertising, and none is shared with anyone else. Because every one is strictly necessary for something you asked for, the law doesn't require us to ask your consent first, so there's no cookie banner.
Draft: that each cookie below is strictly necessary is for our lawyer to confirm (ePrivacy Directive Art. 5(3); Greek Law 3471/2006 Art. 4(5)).
The cookies we set
| Name | What it's for | How long it lasts |
|---|---|---|
__Secure-ft.session_token (ft.session_token on a local test site) | Keeps you signed in. It holds a random token that matches your session in our database; scripts on the page can't read it. | 30 days, renewed while you use the site. Deleted when you sign out. |
ft_member | A hint that someone is signed in on this browser, so pages can show your own links (You, Table, notifications) instead of "Sign in". It holds only 1, nothing secret. | 30 days. Cleared when you sign out. |
ft_pending | The email address a sign-in code was just sent to, so the code page can show it. | 10 minutes. |
ft_view | The guest links you opened in this browser (up to eight), so you can keep seeing those tables' recipes. Scripts can't read it, and each link is checked again on every visit: a revoked link stops working at once. | 400 days. |
ft_guest | A hint that a guest link was opened here, so a recipe page knows to fetch the table's part of it. Nothing secret. | 400 days. Cleared once none of your guest links works any more. |
ft_share | The share links you opened in this browser (up to sixteen), so their recipes or books stay open to you. Scripts can't read it; each link is checked again on every visit. | 400 days. |
ft_decision | Set only when you open a moderation decision from the link in our email: it keeps that link's key for the decision's page alone, so the address you see no longer holds it. Scripts can't read it. | A day. |
ft_starter | Set only for a moderator, when they make a starter invite link: it carries the link to the starter invites page to be shown once, and is cleared as it's shown. Scripts can't read it. | Five minutes, or until the page shows the link. |
ft.state, ft.better-auth-passkey (with __Secure- in front on the real site) | Set by our sign-in system while you sign in with Google or Apple, or with a passkey, to tie the sign-in to your browser. | A few minutes, until the sign-in finishes. |
All of them are sent only to OnlyGravy, only over a secure connection, and never to other websites. Keeping copies of pages shared with everyone near visitors sets no cookie: those copies are made only for visitors who carry none of ours.
The robot check
On pages that send an email — joining, signing in, making an anonymous report, sending an invitation — we use Cloudflare Turnstile to tell people from robots, without a puzzle. It runs from Cloudflare's own address and may set or read what it needs for that check, only on the pages that show it. It isn't used to track you. Cloudflare's network may also set a security cookie of its own if its bot protection is turned on (to confirm before launch).
Signing in with Google or Apple
If you choose to sign in with Google or Apple, you do it on their own pages, which set their own cookies under their own rules. We receive only your name, email address and an account id, and keep none of their cookies or tokens.
Visitor statistics
If we turn on Cloudflare Web Analytics to count visits, it works without cookies and without following you from site to site. We won't add anything that sets non-essential cookies without asking you first.
On your device, not a cookie
The site remembers whether you prefer metric or US units in your browser's local storage, under the name units. It never leaves your device and isn't sent to us; it stays until you clear your browser's data.
Your choice
You can delete or block cookies in your browser's settings. If you block them, you won't be able to sign in or use guest and share links, but pages shared with everyone will still work. For anything else about your data, see the privacy notice.
Changes to this page
If we ever need a cookie that isn't on this list, we'll add it here before we use it — and if it isn't essential, we'll ask you first. Questions: hello@onlygravy.com.