Privacy Policy

1. Introduction

Loafly Day is operated by Arne Tempelhof. This privacy policy explains what personal data we collect, how we use it, and your rights regarding your data. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR).

If you have any questions about this policy, you can contact us at info@loaflyday.com.

2. Data We Collect

We collect the following categories of personal data:

• Account data: email address, name, username, password (stored securely using bcrypt hashing), bio, and profile image.
• User content: recipes, bake logs and comments, ratings, bookmarks, and uploaded images (up to 3 per recipe or comment).
• Usage data: pages visited, interactions with the site, and device/browser information collected through Google Analytics.

3. How We Use Your Data

• Service operation: to create and manage your account, display your recipes and profile, and enable community features like comments and ratings.
• Analytics: to understand how visitors use the site and improve the user experience.

4. Third-Party Services

We use the following third-party services that may process your data:

• Google Analytics (GA4): collects anonymized usage data such as pages visited, session duration, and device information. Google may process this data on servers outside the EU. Google Privacy Policy.
• Cloudinary: hosts images you upload (profile pictures, recipe images, comment images). Uploaded images are stored on Cloudinary's servers. Cloudinary Privacy Policy.

5. Cookies & Local Storage

This site uses the following storage mechanisms:

• Google Analytics cookies: used to distinguish users and track sessions.
• Local storage (JWT tokens): your authentication tokens (access and refresh tokens) are stored in your browser's local storage to keep you signed in.

You can manage cookies through your browser settings. Disabling cookies may affect the functionality of the site.

6. Data Retention

We retain your personal data for as long as your account is active. If you delete your account or request data deletion, we will remove your personal data within 30 days, except where we are legally required to retain it. Uploaded images will be removed from Cloudinary upon account deletion.

7. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to the processing of your personal data for certain purposes, including direct marketing.
• Right to restrict processing: request that we limit how we use your data.

To exercise any of these rights, please contact us at info@loaflyday.com.