Word of Mouth
Privacy policy
Draft for review by a qualified lawyer before launch. Last updated 12 October 2026.
We collect as little personal data as we can to run a recipe discovery platform safely. This policy explains what we hold and why.
What we collect
Your email address and the display name you choose. What you taste, save, rate and pass on. Reviews and photos you post. For protected recipe views, the time of each view and a scrambled, one way code made from your connection and device, used only to spot account sharing and fraud.
When you buy a paid recipe on a cook's Gumroad through Word of Mouth, Gumroad tells us the sale, the product, the price, your email, our commission and any refund or dispute, so we can unlock the recipe in your library. Cooks who connect their Gumroad give us read only access to their profile and sales, kept encrypted. Chefs applying for a verified badge give their restaurant details, which are shown publicly if approved.
What we never collect
Card numbers, bank credentials or government ID.
Your password and sign in
Your password is stored only as a one way hash by Supabase, our sign in provider. We never see it. When you choose a password, we check it against known data breaches using the Have I Been Pwned service: only the first 5 characters of a scrambled code of the password leave our server, never the password itself.
If you turn on two-step verification, the secret for your authenticator app is kept by Supabase. We keep a record of sign in related events, such as password changes, to protect your account.
Why we use it
To run your account and give you the recipes you have access to (contract). To keep the platform safe, prevent fraud and trace leaked recipes (legitimate interest). To count anonymous page views and clicks to creators' shops so creators can see how their listings perform; these counts carry no personal data (legitimate interest). If you accept analytics cookies, to measure visits with Google Analytics (consent, which you can withdraw at any time). To meet tax, accounting and legal duties (legal obligation).
Photos
Photos you upload are re-encoded before they are stored, which removes hidden details such as location data.
To keep the site safe, each photo is checked once by an automated moderation service (OpenAI's moderation model) for sexual content, violence and self-harm. Only the photo is sent, without your name or email. A flagged photo is looked at by our team before it can be shown.
How long we keep it
Account data for as long as your account is open. Order records, consent records and access logs linked to a purchase for as long as tax law and dispute handling require. Other access logs for 12 months.
Your rights
You can ask for a copy of your data, correct it, delete your account or object to processing by writing to hello@wordofmouth.recipes. You can also complain to the Data Protection Commission in Ireland.