Privacy notice

Who is responsible for your data

The controller is Michael Gabriel Papanikolaou, trading as Made By Michael, Sydney NSW, Australia.

• For anything about your personal data: hello@onlygravy.com
• Our other contact points are on Legal notice and contacts.

We haven't appointed a data protection officer, as we don't believe the law requires one for a site like ours. Draft: our lawyer is to confirm this.

The short version

• We collect what's needed to run your account and your tables' recipes, and nothing for advertising. We never sell data, and we use no tracking cookies.
• Your data is stored in the European Union. Two things leave it: AI reading and translation (Anthropic, in the United States), and the copies of pages shared with everyone that our network keeps near visitors.
• What you share is seen only by the audience you choose: you, your table, anyone with the link, or everyone.
• You can download everything about you at /me/export/, and delete your account at /me/delete/, whenever you like.

What we collect, and why

Your account

Your name, email address, handle, date of birth, country and language; your profile photo and bio if you add them; your settings (language, units, which emails you get); the version of the terms you accepted and when; your passkeys' public keys; and, if you sign in with Google or Apple, your account id there (we keep none of their tokens). For each signed-in device we keep a session with its IP address and browser details. We ask your date of birth to make sure you're 16 or older.

What you eat

If you tell us what you eat — a way of eating (vegetarian, vegan, nistisimo) and what you leave out (nuts, gluten, dairy) — we keep it on your account to say whether a recipe fits it. It can say something about your health or your religion, so we only keep it because you chose to enter it, and only you see it unless you switch on a table, whose people (never a guest link, never everyone) then see it "to cook for you". We never infer it or use it for anything else, and no one who works for us sees it: Cloudflare only stores it, as it stores the rest of your account. You can clear it at any time, and it goes with your account. Whether a recipe fits is read from the recipe's own tags and ingredients: it is never a promise, so check labels if you have an allergy.

Tables, invitations and guest links

Your tables, your role at each, the invitations you make (with the email address of the person you invite), and the guest links you make. Cooks — the people recipes come from — are usually relatives, sometimes no longer living: a table keeps their name, relation, place, story and portrait.

What you add

Recipes, stories, photos, books, "I cooked this" posts, tips, love and "helpful" marks, versions, and who added each. What you write may say things about your relatives — and sometimes, through a fasting recipe or a diet, about health or religion. Share only what you're comfortable with, at the level you choose.

Following and love

Whom you follow and who follows you (and requests to, and the date one was declined, kept 30 days), the recipes and posts you love, and the filter you chose on your Following page. Following never shows anyone more of yours. Whoever you follow, or ask to, sees your name; how many follow you is shown to you alone. People who know you — who follow each other with you, or share a table with you — may see that you follow someone they look at. Whoever wrote a recipe sees who loves it, and how many; nobody else sees a number. If you choose to show your Saved recipes on your profile, people who see your profile also see the recipes you saved — each only if they may open it — and your books, never one at Only me.

Purchases and thank-yous

When kitchens are open: what you buy and the thank-yous you send — the order, its price and the tax as Stripe charged it, your country, the moment you asked for immediate access (giving up the 14-day right of withdrawal), what you own through it, your note and the kitchen's reply — and, to answer a card dispute, the IP address and browser you bought from, your account's age and when you first opened what you bought. If you ask for your name to be shown on a thank-you, it appears on that recipe or post among those who thanked ("Thanked by …") to anyone signed in, until you delete your account. Stripe takes the payment on its own page: we never see your card.

Selling, and gifts

When account holders' kitchens are open: if you open a kitchen, its country and currency, the state Stripe reports of your account (never your identity documents or bank details: you give those to Stripe on its own pages), your prices, each transfer, refund and payout of your share, and a statement each month. As a seller you read your sales' receipts — what was bought, when, the buyer's country and the currency they saw — never a buyer's name or email. If you wrap a recipe for someone: their @handle or email address and your note; the recipient sees your name and the note. An email address is used to send the gift (once, and once more if you ask) and is forgotten when the gift is claimed, or a year after it was sent.

When memberships are open (draft): if you join a cook's kitchen, the membership — its kitchen, price and interval, how it stands as Stripe reports it, the period paid for, when a payment failed, when and why it ended, the moment you asked for immediate access — and each payment as an order, with its receipt. The kitchen sees you as a member by your @handle (or "someone", if you hide your Saved recipes), since when and when you renew, never your email or card. Stripe keeps your card and renews the membership; you update your card on Stripe's own page.

When messages are open (draft): your conversations — each message, who sent it and when, and when each of you read or deleted it — and a kitchen's offers to you and its messages to everyone. Only the two of you read a conversation. A moderator reads one only after its recipient reports a message in it, and then only that conversation up to the report; if you send the same words into many conversations in a day, a moderator reviews them, and whatever you send meanwhile waits for the moderator before it's delivered. Nobody else reads them, no AI reads them, and they're never used for anything else. A message's email notification names who wrote, never what they wrote.

Photos, and keeping them safe

Every photo has its location and camera details removed — first on your device, then again on our side. Every photo is checked by a moderation classifier (Amazon Rekognition) and against a list of known child sexual abuse images before anyone sees it.

AI reading, suggestions and translation

Photos of recipe cards and cookbook pages, and dish photos you ask suggestions for, are read by Anthropic's AI; shared recipes are translated by it between Greek and English. It sees the photo and the words, never your email address, a post's photo or a Cook's portrait. We record the cost of each AI call, with the table and account holder it was for.

Notifications and emails

What happened around your recipes and tables, so we can tell you in the site and by email; your email choices; and which day's email we last sent you.

Reports and moderation

If you report something: the reason, what you wrote, the item, and your name and email (taken from your account if you're signed in). If something of yours is reported or decided on: the report, the decision, the statement of reasons we sent, your appeal, any strike or suspension. Your blocks and mutes.

Security

IP addresses, browser details and the addresses requested, in Cloudflare's request logs; rate-limit counters; and the signals Cloudflare Turnstile reads to tell people from robots.

Our lawful bases

Purpose	Lawful basis
Your account, tables, recipes, books, posts, tips, photos, exports	Contract (Art. 6(1)(b)): it's the service you joined for
Invitees' email addresses, Cooks and relatives named in recipes	Legitimate interests (Art. 6(1)(f)): a table keeping and sharing its own recipes
What you eat, and the tables you show it to	Explicit consent (Art. 9(2)(a)): you enter it and choose each table, and can clear it at any time
AI reading, suggestions and translation	Contract, when you ask for it; legitimate interests for translating recipes into the site's other language
Security, rate limits, robot checks, request logs	Legitimate interests: keeping the site and its account holders safe
Screening photos, moderation, blocks, mutes, trust levels	Legitimate interests: keeping the community safe
Receipts, statements of reasons, reporters' outcomes, keeping moderation records, answering authorities	Legal obligation (Art. 6(1)(c)), under the Digital Services Act
Selling to you, your receipt, refunds and thank-yous	Contract
Keeping sales records	Legal obligation, under tax law
A purchase's evidence for a card dispute	Legitimate interests: defending a payment against a dispute (a legal claim)
Evidence after a known-image match	Legal obligation, and the law that lets us report crime (Art. 10)
Cookies	None needed: we only use cookies that are strictly necessary for the site to work (see Cookies)

Where we rely on legitimate interests, you can object (see Your rights). Draft: each basis is for our lawyer to confirm.

Who else handles your data

• Cloudflare — hosts the site: its code, database, photos, background jobs, emails, robot check and request logs. The database (D1) and the photos (R2) are kept in the EU. Requests pass through Cloudflare's data centre nearest the visitor, which may be outside the EU.
• Email — sent by Cloudflare Email Service; if it fails, by Resend as a fallback. They see the address and the email's contents.
• Amazon Web Services (Rekognition) — checks every photo for nudity, violence and similar, in an EU region (Frankfurt). It sees only the cleaned photo, nothing about you. We opt out of AWS using it to improve its AI services (draft: confirmed at launch).
• Anthropic — reads card and page photos, makes suggestions from dish photos, and translates recipes, in the United States (see Transfers).
• A known-image matching service — compares each photo, or a fingerprint of it, with known child sexual abuse images. Which service: to be confirmed before launch.
• Stripe — takes payments for the kitchens on its own page, works out the tax, and handles refunds and disputes. It sees your card and country there; from us, your email, what you bought and, in a dispute, the evidence above. It is partly our processor and partly a controller of its own (payments, fraud, its legal duties).
• Google or Apple — only if you choose to sign in with them. They act as controllers of their own sign-in.
• The people you share with — your table, anyone with the link, or everyone, as you choose; and moderators, for what's reported or held.
• Authorities — only when the law requires it, for example after a known-image match or a threat to someone's life.

We don't sell personal data, and no advertiser receives any.

Transfers outside the EU

• Anthropic (United States): under the Standard Contractual Clauses in Anthropic's data processing terms. Whether Anthropic is also certified under the EU–US Data Privacy Framework, and how long it keeps what we send, are to be confirmed before launch; by default it doesn't train its models on it.
• Cloudflare's network handles requests worldwide, under Cloudflare's data processing terms (the EU–US Data Privacy Framework and the Standard Contractual Clauses).
• Resend, if used: its transfer basis is to be confirmed.
• Stripe (Stripe Payments Europe, with Stripe, Inc. in the United States), when kitchens are open: under the Standard Contractual Clauses or the EU–US Data Privacy Framework, as Stripe's data processing terms say (to be confirmed before kitchens open).

You can ask us for a copy of the safeguards at hello@onlygravy.com.

How long we keep things

Accounts

• Your account and profile: while the account exists.
• A sign-in session: 30 days from its last use.
• A handle you change or give up: held for 90 days, so nobody else takes it at once, then released.

Tables, invitations and links

• An email invitation keeps the invitee's address until 30 days after it expires or is revoked, used or not. If the invitee deletes their own account, it goes at once.
• Guest links: until 30 days after they expire or are revoked.
• A starter invite (a moderator's invitation to start a new table) keeps its address, if it was sent by email, until 30 days after it's used, revoked or expires; then it's deleted. If its invitee deletes their own account, the address goes at once.
• A table being deleted is kept 30 days, so any owner can download it or change their mind; then it's deleted.

Recipes and photos

• Recipes, books, posts and tips: until they're deleted.
• A draft never shared: 90 days after its last save. We remind you at 30.
• Original photos, as you uploaded them: 30 days. The cleaned copies stay with their recipe, post or Cook.
• A photo held for a moderator: until a moderator decides.
• Evidence after a known-image match: until the authorities say it may go. It's never deleted automatically.

Purchases and thank-yous

• Orders, their tax and your thank-yous are sales records: kept for the period tax law sets (to be confirmed: up to 10 years), even after you delete your account — then without your name or email.
• What you own through them, and your copy of each recipe as you bought it: while your account exists.
• A purchase's evidence for a card dispute (IP address, browser, account age, first opening): 180 days, or 180 days after a dispute opened or closed — never deleted while one is open, and kept that long even if you delete your account.

Selling, and gifts

• A kitchen, its prices, its ledger, payouts and monthly statements, and the gifts given: sales records, kept as orders are, even after you delete your account (your kitchen is then closed and kept without you: "a cook who left").
• A membership and its payments: sales records, kept as orders are, even after you delete your account (then without you).
• A message: until both of you have deleted it ("Delete it for me"), or the sender deletes their account — except while a report of it is open; a message a moderator removed keeps its words with the decision for 180 days. An offer: as a sales record.
• A gift's recipient's email address: until the gift is claimed, or a year after it was sent.

Exports

• Your export, and a table's export: 7 days.

Notifications and emails

• Notifications: 90 days.
• Which day's email we sent you: 14 days.
• An unsubscribe link in an email never expires — it can only turn emails off.

Reports and moderation

• A report from a visitor without an account: their name and email are deleted 6 months after the report is closed. An account holder's report keeps their id while their account exists.
• Moderation decisions (what was decided, on what, why) are kept as the site's record, with your name removed if you delete your account. Draft: how long is for our lawyer to set.
• Blocks and mutes: until you undo them, or either account is deleted.

Pages shared with everyone, and logs

• Copies of pages shared with everyone and their photos in our network's cache, made only for visitors who aren't signed in (never for account holders, and setting no cookie): at most one day, and never served again once the item changes.
• Request logs at Cloudflare: kept only briefly (a few days; the exact period is to be confirmed).
• Backups: the database can be restored to any moment in the last 30 days, so something deleted can linger in backups for up to 30 days.

Share links, guest links and invitations

• A share link opens only its own recipe or book. A book's link shows only the recipes in it that its holder could see anyway.
• A share link works until it's made anew, it runs out (after 7 or 30 days, if you chose that), or its item stops being at Anyone with the link.
• Share links, guest links and invitation links carry a secret in their address. Like any address, they appear in request logs, which is why those are kept briefly. Anyone you give a link to can pass it on: send it only to people you'd show the recipe to.

Leaving a table, and deleting your account

If you leave a table, its shared recipes, posts, tips and books stay with the table. Your recipes and books at Only me go with you as your own. Your posts and tips at Only me on its recipes are deleted.

If you delete your account, we delete your profile, your own recipes and books, your posts, tips and love, whom you follow and who follows you, and your photos. Table recipes you uploaded stay with the table, credited to their Cooks and shown as uploaded by "someone who has left". Your recipes at Only me in a table, and drafts you never shared, are deleted with your account. Reports and decisions stay as the site's record, pointing at nobody. What you bought stays as a sales record without your name or email; what you owned goes with your account.

Draft: what stays with a table is for our lawyer to confirm.

Your export, and a table's

• Your export (at /me/export/) holds everything about you: your profile, recipes, books, posts, tips, photos, blocks, mutes, reports, the decisions about you with their statements of reasons, your appeals, strikes and any suspension, your purchases (with their dispute evidence while it's kept) and thank-yous, your kitchens (their settings, prices, ledgers, payouts and monthly statements) and the gifts you gave and received — except a decision the law asks us not to tell you of yet, and a moderator's reason for refunding a purchase of yours, which we keep back where it concerns fraud.
• A table's export, which its owners can make, is its requester's own: it's built as that owner sees the table, so someone else's recipes at Only me are never in it.
• An export names a recipe only while its exporter may see it: a book in your export lists only the recipes in it you can see.

Automated decisions

Some decisions are made by software first, and always looked at by a person afterwards:

• The moderation classifier refuses a photo that very clearly shows sexual, graphically violent or hateful content (you're told it can't be used, and can upload another), and holds others it isn't sure about until a person looks.
• A known-image match stops the upload and suspends its uploader at once; a person then handles it with the authorities.
• When three Trusted account holders report the same item, it's hidden until a moderator looks.

The statement we send says when automation was involved, and you can appeal. No decision with legal or similarly significant effect on you is made by software alone: a person reviews each. Draft: our lawyer is to confirm how GDPR Article 22 applies.

Children

You must be 16 or older to have an account. Family photos may show children: whenever a recipe is shared with everyone, we ask whether there are children in its photos, and if so they stay with the table unless whoever shared it with everyone confirms again. A parent can report a photo of their child under "This is me or my child".

Your rights

You have the right to:

• access your data — the fastest way is your export;
• correct it — most of it you can change yourself in your account;
• erase it — delete your account, or ask us;
• restrict what we do with it while a question is settled;
• take it with you (portability) — your export is in a standard format (JSON, with your photos);
• object to what we do on the basis of legitimate interests.

Write to hello@onlygravy.com. We answer within a month. If we need to confirm it's you, we'll ask. If your account is suspended, you can't sign in to export or delete it yourself: write to the same address, and we'll do it for you — unless the law requires us to keep it (for example, the evidence after a known-image match).

You can also complain to the Hellenic Data Protection Authority (HDPA, www.dpa.gr), or to the authority of the EU country where you live or work.

Cookies

We use only cookies that are strictly necessary: to keep you signed in, and to remember guest and share links you opened. No tracking, no advertising. Cookies lists each one.

Security

There are no passwords to steal: you sign in with an emailed code, a passkey, or Google or Apple. Sign-in codes are encrypted; invitation, guest and share links are stored only as fingerprints. Every page and photo is checked against who may see it, and nothing that isn't shared with everyone is cached or offered to search engines. If something goes wrong with your data, we'll tell the authority within 72 hours and you without delay when the law requires it.

Changes to this notice

When we change this notice, we'll publish the new version here and tell account holders of any change that matters. Last updated: 19 October 2026.