Privacy Policy

Who we are

Thyme en Place (thyme-en-place.com) is a private recipe book run by StillHumanDesign. In this policy, "we", "us" and "our" mean StillHumanDesign. We are the controller of the personal information described here, which means we decide how and why it is used.

You can contact us at thyme.en.place@gmail.com.

What information we collect

Information you give us

• Your account: your email address, a display name and a username (made for you when you sign up, and editable later), and a password. Passwords are stored only as a one-way scrambled "hash", so nobody, including us, can read them. You may also upload a profile picture, and we remember which shop you prefer for price estimates.
• If you sign in with Google: Google tells us your name, email address, profile picture and a Google account identifier. We never see your Google password.
• Your content: the recipes you save or import (titles, ingredients, methods, notes, ratings, photos and source links), your weekly menus, and the items you tick off on shopping lists.
• Your cooking log: if you use it, the dates you cooked something, the notes you write and the photos you upload. Only you can see your cooking log, including when a recipe has been shared with someone.
• The newsletter: only if you choose to receive it (a box you tick at sign-up, or a switch in Settings), we keep that choice and the date you made it, and email you news and updates at your account address. Every newsletter has an unsubscribe link, and you can also turn it off in Settings. Emails about your account, like a password reset, are separate.
• Friends and sharing: friend requests, your list of friends, people you have blocked, and what you have shared and with whom. If you type an email address to add a friend or share something, we keep that address so you can see what you shared. It may belong to someone who is not a member.
• Notifications and settings: the notifications we send you inside the site and your choice of which ones also arrive by email.
• Asking for an invite: if you ask for an invite from our home page we keep your email address, your name (if you give one) and your IP address, so we can reply and to stop the form being abused.

Information created when you use the site

• Technical data: like any website, our server receives your IP address and details about your browser and the pages you request. It is used to deliver the site and keep it secure.
• Security records: we count failed sign-in attempts (against a scrambled version of the email address, together with the IP address), and how many imports an account makes, to slow down abuse. These are kept for a few days at most.
• Email records: a log of emails the site sends (who to, the subject line, and whether it was delivered) so we can fix delivery problems. The log does not hold the message text.

How we use your information

We use your information to:

• create and run your account, and store and show you your recipes, menus and shopping lists (to perform our agreement with you);
• let you connect with friends and share things, and tell you when someone shares with you or sends a friend request (to perform our agreement with you);
• send emails you would expect: invites, friend invites, links to confirm your email address, notifications you have chosen to receive, and private links when someone shares with your email address (to perform our agreement with you, or our legitimate interest in the site working as described);
• keep the site secure, limit abuse, and find and fix faults (our legitimate interests); and
• meet legal obligations, or deal with legal claims where necessary.

We do not use your information for advertising or profiling, we do not make automated decisions about you, and we do not sell or rent your information to anyone.

Who can see your content

Everything you save is private to your account by default. It becomes visible to someone else only when you share it:

• Sharing with a friend or member. They can see the current version of what you shared, marked as shared by your display name. Your private notes and personal ratings on a recipe are never shown to them. They can save their own copy, and that copy belongs to them.
• Sharing with an email address that is not a member. We email them a private link. Anyone who has the link can view what you shared, without an account, until you stop sharing.
• Friends. People you are friends with can see your display name, username and profile picture. Being friends does not share any recipes by itself.

You can stop sharing at any time from the Sharing page and the person loses access immediately. Copies they already saved stay theirs.

Because we run the site, we can technically reach the database it is stored in. We only look at your content to run, secure and repair the service, when you ask us to, or where the law requires.

Who we share information with

We use a small number of other companies to run the site. They only get what they need to do their job.

• Hosting. The site runs on a virtual server rented from Hostinger. Your account and content are stored there.
• Email. Emails are sent through Google's Gmail service. Google sees the recipient address and message.
• Google Sign-In. If you choose "Sign in with Google", Google handles the sign-in and tells us the details listed above.
• Google Fonts. Our pages load their typefaces from Google. Your browser therefore sends Google your IP address and browser details when a page loads.
• Importing recipes. When you paste a link, our server fetches that public page on your behalf. The website sees a request from our server's address, not yours. For Instagram and TikTok links we read the public caption, and for TikTok its automatic captions, and may save the post's thumbnail picture.
• Anthropic (Claude). When you import from Instagram or TikTok and this option is switched on, the public caption text is sent to Anthropic's Claude service to be turned into a tidy recipe. We do not send your name, email or any account details, and results are shown to you before anything is saved.
• Pexels. When a recipe needs a photo we may send a search phrase based on its title (for example "chicken curry food dish") to Pexels. No personal information is included.

Some recipe pictures are loaded directly from the website they came from. When your browser loads such a picture, that website can see your IP address and browser details, just as if you had visited it.

We may also disclose information if the law requires it, or to protect the rights, safety or property of our users or ourselves.

Sending information outside the UK

Some of the companies above, such as Google, Anthropic and Pexels, may process information in countries outside the UK, including the United States. Where they do, they rely on legal safeguards approved for UK data protection law, such as the UK's data bridge arrangements or standard contractual clauses.

How long we keep it

• Your account and content are kept for as long as you have an account. If you ask us to delete your account, we remove your account, recipes, menus, shares, friends and notifications from the live site promptly, and within one month at the latest.
• Backups. We keep copies of the site and its database so it can be restored after a fault. Deleted information can remain in those backups until they are replaced by newer ones.
• Invite requests (email, name, IP address) are kept while we deal with the request and are deleted when we clear them out or when you ask.
• Security records (failed sign-ins and import counts) are kept for a few days.
• Email records are kept for as long as they are useful for fixing delivery problems.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it, or object to us using it;
• ask for your information in a portable form; and
• withdraw your consent, where we rely on it (we do not currently rely on consent for anything).

You can already change most of your information yourself: edit or delete recipes and menus, change your name and picture in Settings, remove friends and stop sharing. For anything else, or to have your account deleted, email thyme.en.place@gmail.com. We will reply within one month and may need to check it is really you first.

If you are unhappy with how we handle your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

How we keep it safe

The site is served over HTTPS. Passwords are stored as one-way hashes. Sign-in attempts are limited to slow down password guessing. Every page that shows a recipe, menu or shopping list first checks that you own it or that it has been shared with you. No online service can promise perfect security, but if a breach ever puts your information at risk we will tell you and, where required, the ICO.

Children

Thyme en Place is not meant for anyone under 13, and we do not knowingly collect information from children under 13. If you think a child has an account, please email us and we will delete it.

Cookies

We use only a small number of cookies that the site needs to work. There are no advertising or tracking cookies. The details are in our Cookie Policy.

Changes to this policy

We may update this policy as the site changes. The date at the top shows when it was last updated. If we make an important change we will tell members by email or a notice on the site.

Contact us

Questions about this policy or your information: thyme.en.place@gmail.com.