Privacy Policy
pashutFree — 30 July 2026
1. Controller and contact
pashutFree operates the service and determines the purposes and means of processing the data described in this policy. Privacy requests of any kind may be sent only through the contact form available on the site; there is no separate dedicated privacy mailbox, and requests submitted through the form are handled directly by the site operator.
2. Information we receive
Account data can include email address, display name, locale, profile image, authentication provider and account timestamps. Community and preference data can include comments, ratings, uploaded review photos, favourites, collections, recently viewed recipes and reports. Contact messages include the name, email, message, source page and submission time.
3. Optional first-party analytics
Only after analytics consent, pashutFree records first-party events such as page path, locale, event type, coarse device category, referrer hostname and an anonymous browser identifier. Signed-in events may be linked to the account ID. The application does not store IP addresses in the analytics table, though infrastructure providers may process connection data in ordinary logs.
4. Why information is used
Information is used to create and secure accounts, provide favourites and personal history, display and moderate community contributions, answer contact requests, prevent abuse, operate and troubleshoot the service, understand consented product usage and meet applicable obligations. The application does not currently operate a newsletter list.
5. Providers and disclosures
Supabase processes database, authentication and some storage data; Cloudflare R2 stores image objects; and Resend processes contact email when configured. A future hosting or CDN provider will process normal request data. Data is shared only as needed to provide, secure, support or lawfully protect the service.
6. Retention
Account and account-linked product data are retained while the account remains active, and are deleted or de-identified within a reasonable period after an account-deletion request, subject to moderation, security and legal needs. Messages submitted through the contact form are retained for up to 24 months from when the request was handled, unless a longer period is required by law. Server-side analytics events are retained for up to 14 months from collection and are then deleted or de-identified.
7. Your rights
A signed-in user can download an account-data export and correct profile information. Deletion can be requested through the contact form using the account email. Depending on applicable UK GDPR, EU GDPR, Israeli law or other law, users may also have rights of access, correction, erasure, restriction, objection and portability, subject to lawful exceptions and identity verification.
8. International processing and security
Some of the providers listed above may process data on servers located outside Israel, subject to their applicable terms and the level of protection required by law. Access controls, row-level security policies, server-only credentials and limited data projections are used, but no online service can guarantee absolute security against every breach or failure.
9. Children and changes
The service is not intended for children under 13 acting independently. A parent or guardian should contact us if a child submitted personal data. Policy changes will be shown by updating this page and its date.