Privacy policy

This policy is a work in progress. We are a small team still shaping Forktales, and this page will change as the product does. When it does, we update the date above and, for changes that matter, let you know.

The short version

• What you post is visible to you and your current friends. Nobody else, and nobody who is signed out.
• There are no ads and no ad networks. We do not sell your data.
• We collect what we need to run the service, plus product analytics to understand how it is used.
• You can delete your account yourself, at any time, from inside the app.

Who is responsible

Forktales is made and run by a small team based in British Columbia, Canada. That team is responsible for your data: we are the data controller for the personal data described here. You can reach us at hello@forktales.app.

What we collect

Your account

Your email address, display name, unique handle and an optional avatar. If you sign in with Google, we receive the basic profile details Google shares for sign-in. There are no passwords: you sign in with an email link or with Google.

Hearing when sign-up opens

While Forktales was invite-only, our website let you leave an email address to hear when sign-up opened. That address is kept in Forktales's own database with the page you left it on. We sent one note straight away to confirm it, with a link that removes the address if you did not mean to leave it. We send one more email to say sign-up is open, and nothing else. Our analytics tool records that the form was used, not the address.

What you make

Photos of plates and their captions, recipes, the cooks you log against a recipe, star ratings, favourites, comments, likes, mentions and the recipe asks you send and receive. If you choose to scan a recipe card, have a link read by AI or work out nutrition, the photo, text or recipe is sent to an AI provider and is not kept as part of the recipe unless you save it.

Your friends

Who your friends are, the invites you send and redeem, who invited you, the friend suggestions you hide and your discoverability setting. When someone opens your invite or friend link, we record that it was opened and whether they already had an account.

Credits and purchases

A record of your credits: each one granted, spent, bought or refunded, with what it was for and when. If you earn credits through an invite, the record names the friend who joined. If you buy a credit pack or Plus, we keep what you bought, when, the amount and the customer and payment references our payment processor gives us. We do not receive or store your full card details.

Technical data

Device and browser information, your IP address in server logs and product analytics events (for example, which screens are used and which actions are taken).

The kitchen game

The kitchen game on this site keeps your progress, your recipe book, your ranked scores, a random player id and a generated name in your browser’s local storage. When you first finish a day on today’s island, the game sends the day, your moves, the generated name and the random id, and we store them with the score to run the leaderboard. Practice islands and replays of today’s island are not posted. The leaderboard shows the name and the score, never the id. The name comes from a word list, so it says nothing about you.

The daily quiz

The daily quiz keeps a random player id, a generated name, your finished rounds, the last challenge link you opened and your sound setting in your browser’s local storage. Each question and answer sends the day, the answer, the time you took, the generated name and the random id, and we store them to score the round and rank it. When you finish a round signed in to Forktales, or sign in afterwards to save it or collect its credits, we link the round to your account and record any credits it pays. A challenge link holds a code for one finished round, not your id. When someone opens your link, we store a link between your random id and theirs, so each of you sees the other’s rounds on your friends board. The leaderboards show the name, the number of right answers, the time and the score, never the id or your account.

Signing in on this site

This site has no sign-in of its own. You sign in to the app at eat.forktales.app. When a page here loads, your browser asks the app whether you are signed in and sends the app’s session cookie with the request. The site never reads the cookie. If you are signed in, the app answers with your account id, your display name and your handle. The site uses them to show that you are signed in and to link to your recipe box, and it links this site’s analytics to your account id. The daily quiz sends the same cookie with each answer, so the app can save your rounds to your account.

How we use it

• To run the service and keep your account working.
• To show your plates and recipes to the friends you choose, and theirs to you.
• To send you sign-in links, and to send the invite emails you ask us to send.
• To tell you when sign-up opens, if you asked us to on the website.
• To send optional mail: quiz streak reminders, a digest of what your friends have posted while you have been away (at most once a week) and one note at least two days after you join, if you have not yet posted a plate or saved a recipe. You can switch optional mail off in the app or from any of these emails.
• To send quiz streak reminders, only after you ask for them on the daily quiz or in the app. A reminder comes on a day your streak on the quiz would end and you have not played yet. You can switch reminders off from any reminder or in the app.
• To understand how Forktales is used, so we can improve it.
• To keep your credit balance and to process what you buy.
• To keep the service secure and prevent abuse, including checking that a sign-in request comes from a person.

Legal bases

Under the GDPR and UK GDPR we need a legal basis for each use. We rely on contract to provide the service you signed up for, legitimate interests to keep it secure and to understand usage, and consent where the law requires it, for example for analytics storage. This policy is a work in progress, and we may refine how we describe these bases as Forktales matures.

Who sees your content

Your posts are visible to exactly two groups: you, and the people who are currently your friends. Nothing is visible to signed-out visitors. If you unfriend someone, or they unfriend you, access is removed immediately in both directions.

A new recipe is shared with your friends unless you choose Just me when you save it. Just me means only you can see it. You can change who sees a recipe at any time. When a friend saves (forks) a recipe you shared, they keep their own copy.

Friend suggestions and discoverability

Forktales can suggest friends-of-friends to you, and you to them. This uses your existing friendships and nothing else. You can turn discoverability off on your profile page, and you can hide individual suggestions. Turning it off means you are not suggested to others.

Services we rely on

A small number of service providers process data on our behalf so Forktales can work:

• Hosting for the app and this website.
• A database and file storage where your photos live.
• A sign-in provider, if you choose to sign in with Google.
• Email delivery for sign-in links and invites, sent from hello@forktales.app.
• Product analytics, so we can understand how Forktales is used.
• An AI model provider that reads a recipe photo, text or web page, or works out nutrition, to fill in the recipe for you. It is used only when you choose to, and not to train models.
• A bot check on the form where you sign up or sign in by email (Cloudflare Turnstile), which looks at signals from your browser to tell a person from a script.
• Stripe, which processes payments if you buy a credit pack or Plus.

Some of these providers run outside Canada and may process data outside the UK and the European Economic Area. Where that happens, we rely on our providers' standard contractual protections for international transfers, and we will describe them in more detail here as this policy matures.

Cookies and similar technologies

• A session cookie that keeps you signed in.
• A short-lived join cookie that carries your invite token while you sign up from an invite link.
• Analytics cookies and local storage, used to understand how the app is used.

There are no advertising cookies and no ad networks. This brochure site, www.forktales.app, also runs analytics. It sets no sign-in cookie of its own.

How long we keep it

We keep your data for as long as your account exists.

When you delete your account, we remove your profile, recipes, ratings, favourites, friendships and credits straight away, sign you out and free your handle. Copies of your recipes that friends had already saved stay with them, attributed to “a deleted user”. Stripe keeps its own records of payments you made.

Backups and server logs are kept for a short period before they are removed or overwritten. We will state the exact period here once it is settled.

Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct it if it is wrong. You can edit your profile in the app.
• Delete it. Account deletion is self-serve in the app. It takes effect immediately.
• Receive a copy of your data in a portable format.
• Object to processing based on our legitimate interests.
• Complain to the privacy regulator where you live, for example the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia, if you think we have got something wrong.

For anything you cannot do in the app, email hello@forktales.app and we will help.

Children

Forktales is not meant for children. You must be old enough to agree to our terms where you live, and if you are a minor, a parent or guardian must agree for you. If you believe a child has an account, please tell us and we will remove it.

Security

We use established providers, keep access to your data limited to what the service needs and require sign-in for everything you post. No system is perfectly secure. If we learn of a breach that affects you, we will tell you as the law requires.

Changes to this policy

We may update this policy as Forktales changes. When we do, we will change the date at the top of this page and, for significant changes, let you know in the app or by email.

Contact

Questions about privacy? Email hello@forktales.app or use the contact page.