Privacy & Cookie Policy
Effective October 24, 2026
You can read every recipe without an account. We only collect what we need to run accounts, comments and memberships, and we never sell your data.
What we collect and why
- Account details — your name, email address and a securely hashed password (never the password itself). If you choose “Continue with Google”, we receive your name, email, profile picture and Google account ID from Google. Used to sign you in, show your name on comments and link your membership to you. Legal basis: performance of a contract.
- Comments — what you write and the name shown with it. Comments are public. You can delete your own comments at any time. Legal basis: performance of a contract.
- Membership purchases — payments are processed by Stripe. Stripe receives your card or wallet details, billing name, country and email and runs its own fraud checks; we receive only the checkout ID, amount, currency, payment status and the email you paid with, never your card number. Legal basis: performance of a contract and our legal accounting obligations.
- Correction and contact reports — the message you send, the page it concerns and, only if you give it, your email address. To limit abuse we store a one-way hash of your IP address, not the address itself. Legal basis: our legitimate interest in keeping our content accurate.
- Analytics (optional) — if you allow it, Google Analytics 4 records anonymised page views (IP addresses truncated, Google signals and advertising features switched off). Legal basis: your consent, where consent is required.
- Server and security logs — our host, Cloudflare, processes IP addresses and request data to deliver pages and block attacks. Legal basis: legitimate interest in security.
We do not sell or rent personal data, we do not use it for advertising, and we do not use your data to make automated decisions about you.
Cookies and local storage
| Name | Purpose | Type | Lasts |
|---|---|---|---|
nl_session | Keeps you signed in | Essential | 30 days |
g_state, g_from | Protect Google sign-in and return you to your page | Essential | 10 minutes |
__cf_bm, cf_clearance | Cloudflare bot and attack protection | Essential | Up to 30 minutes / 1 year |
| Stripe cookies (on checkout.stripe.com only) | Secure payment and fraud prevention when you check out | Essential | Set by Stripe |
nl_consent (local storage) | Remembers your cookie choice | Essential | Until you clear it |
_ga, _ga_* | Google Analytics page statistics | Optional — only with your permission | Up to 2 years |
Visitors in the EU, EEA, UK and Switzerland are asked first; no analytics cookies are set until you click “Accept analytics”. Elsewhere, analytics is on by default and you can switch it off. You can change your choice at any time with Cookie settings in the footer of every page, or block cookies in your browser — recipes stay fully readable either way. Our fonts are served from our own site, so no font requests go to third parties.
Who processes your data
- Cloudflare, Inc. — website hosting, database, security (USA, global network)
- Stripe — payment processing and fraud prevention; Stripe also acts as an independent controller for some payment data under its own privacy policy
- Google LLC — Google sign-in (if you use it) and Google Analytics (if you allow it)
- WhatsApp / Meta — only if you click the chat button, which opens WhatsApp under its own privacy policy
Some of these providers process data outside your country, including in the United States. Where the law requires it, transfers rely on adequacy decisions (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.
How long we keep it
- Account data: while your account exists. When you ask us to delete your account we remove it within 30 days.
- Comments: until you or we delete them, or your account is deleted.
- Purchase records: as long as tax and accounting law requires (normally up to 7 years), even after an account is closed.
- Correction reports: up to 2 years.
- Google Analytics data: 14 months.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or the California Consumer Privacy Act), you have the right to access, correct, download, or delete your personal data, to object to or restrict processing, and to withdraw consent at any time. We do not sell or “share” personal information for cross-context behavioural advertising, so there is nothing to opt out of in that sense. We will not treat you differently for exercising your rights.
To make a request, use the contact form, choose “Account, privacy or refund request” and include the email address on your account. We reply within 30 days. If you are in the EU, EEA or UK you can also complain to your local data protection authority.
Children
Nourilo is a general-audience recipe site. Accounts are for people aged 16 and over, and you must be an adult (or have a parent or guardian’s permission) to buy a membership. We do not knowingly collect personal data from children under 16; if you believe a child has created an account, contact us and we will delete it.
Security
All traffic is encrypted (HTTPS). Passwords are hashed with PBKDF2-SHA256, sign-in cookies are signed and HTTP-only, and access to our database is restricted. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
Changes
If we change this policy we will update the date above, and for significant changes we will tell signed-in members on the site.
Contact
Privacy questions and requests: use our contact form.