Privacy Policy

Last updated: October 13, 2026

PlateMotive is a recipe platform where you can browse, save and share recipes, plan meals and join the community conversation. This policy explains what data we collect, why we collect it, and the choices you have. We keep it short because we collect little.

Who is responsible

The controller responsible for processing your data under the EU General Data Protection Regulation (GDPR) is the operator of PlateMotive named in our Impressum. For any privacy question or request, email [email protected].

What we collect

  • Account data — your email address, username and display name. Your password is stored only as a salted hash; we never see or store it in plain text.
  • Google sign-in — if you sign in with Google, we receive your email address, name and profile picture from your Google account, and store your Google account identifier so we can recognize you on future sign-ins.
  • Date of birth, checked but not stored — when you register, we ask for your date of birth only to check that you are at least 16, the minimum age to use PlateMotive. We do not store it; we keep only your confirmation, recorded with your Terms acceptance.
  • Terms acceptance — the Terms version you accepted, including your confirmation that you are at least 16, and the date and time of acceptance.
  • Optional profile details — bio, location, avatar and a website/social link, if you choose to add them in Account settings. They are visible on your public profile.
  • Content you create — recipes, comments, ratings, collections, saved recipes, your cooking log and personal recipe notes. Recipes you publish, and comments and ratings you post, are public. Saved recipes, personal notes and your cooking log are private; collections are private unless you choose to publish them.
  • Uploaded images — photos you upload are re-encoded on our server and we keep only resized copies, not your original file. Embedded metadata, such as EXIF data with GPS location, camera details and capture time, is removed during this step and is never stored or published.
  • Image rights confirmations — when you upload an image, the date and time you confirmed that you hold the rights to it, stored with that upload.
  • Technical and security data — your IP address and browser details (user agent) when you use the site. We store them with each signed-in session, use your IP address for rate limits, and our servers record them in technical logs.
  • Moderation records — when you submit a recipe for review or report content, we keep a record of the submission, the decision and any feedback, to run a fair moderation process.

Your email address, username and date of birth are required to create an account; without them we cannot register you. Everything else is optional.

We use your email address to send account-related transactional messages, such as email verification, password resets, email change confirmations and security notifications. These messages are delivered through Resend, our email service provider, which processes your email address as necessary to deliver them.

Cookies

We use essential cookies for authentication, session management and securely completing OAuth sign-in flows. These cookies are necessary for account functionality and security and cannot be switched off.

When you switch between metric and US units on a recipe or in your account, we set a mh_units preference cookie to remember your choice. It contains only metric or us and expires after 12 months. Until you choose, your browser picks the default from its time zone each time you open a recipe, and nothing is stored.

With your consent, we also use Google Analytics to understand how PlateMotive is used, so we can improve the site. These analytics cookies are only set after you accept them in the cookie banner or in Cookie preferences (in the site footer), and you can withdraw consent at any time from the same place.

We do not use advertising cookies, marketing trackers or social-media pixels.

Local storage

We use your browser's local storage for the following features. Unlike cookies, local-storage data stays in your browser and is not automatically sent to PlateMotive with web requests:

  • platemotive:cookie-consent — stores your cookie preference (whether you accepted analytics cookies) and the date you made that choice, so we do not show the banner on every visit. It expires after 12 months, or immediately if you change your choice in Cookie preferences.
  • platemotive:recipe-draft:<userId>:<recipeId> — stores the contents of a recipe form, together with save and expiry times, so you can recover an unfinished draft on the same browser and device. Each autosaved draft expires after seven days and is also removed when you delete it or successfully submit the recipe.
  • platemotive:article-draft:<userId>:<articleId> — stores an administrator's unfinished article edits as a recovery copy on the same browser and device. Each copy expires after seven days and is removed when it is deleted or the article is successfully saved.

You can remove these entries at any time by clearing PlateMotive's site data in your browser.

How we use your data and on what legal basis

  • Providing the service — your account, profile, recipes, comments, ratings, collections, cooking log and notes, Google sign-in and transactional emails. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
  • Signing you in and keeping your account secure — session cookies, email verification, password resets and security notifications. Legal basis: Art. 6(1)(b) GDPR; storing the cookies is strictly necessary (§ 25(2) no. 2 TDDDG).
  • Remembering your settings — the units cookie, your cookie choice and recipe drafts in local storage. Legal basis: our legitimate interest in a working, convenient site (Art. 6(1)(f) GDPR); storage is strictly necessary for features you use (§ 25(2) no. 2 TDDDG). We keep your cookie choice also to prove your consent (Art. 6(1)(c) and Art. 7(1) GDPR).
  • Recording Terms acceptance and image rights confirmations — so we can show what you agreed to and defend against claims about content you uploaded. Legal basis: our legitimate interest in establishing and defending legal claims (Art. 6(1)(f) GDPR).
  • Moderation, reports and copyright notices — reviewing submissions, handling reports and notices, and explaining our decisions. Legal basis: our legal obligations as a hosting service under the EU Digital Services Act and copyright law (Art. 6(1)(c) GDPR) and our legitimate interest in a lawful, trustworthy platform (Art. 6(1)(f) GDPR).
  • Preventing abuse — rate limits keyed on IP address across sign-in, comments, ratings, uploads and recipe submissions, technical logs and, where enabled, Cloudflare Turnstile. Legal basis: our legitimate interest in protecting the service and its users from attacks and spam (Art. 6(1)(f) GDPR); Turnstile's reading of browser signals is strictly necessary to protect the sign-in and report forms you use (§ 25(2) no. 2 TDDDG).
  • Error and performance monitoring with Sentry, and delivery through Cloudflare. Legal basis: our legitimate interest in a reliable, fast and secure site (Art. 6(1)(f) GDPR).
  • Analytics with Google Analytics, only if you accept analytics cookies. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), which you can withdraw at any time in Cookie preferences; withdrawal does not affect processing that happened before it.

We do not sell your data, and we do not send marketing email. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).

Error and performance monitoring

We use Sentry to monitor application errors, diagnose technical problems and measure the performance and reliability of PlateMotive.

When an error or monitored performance event occurs, Sentry may process limited technical information such as the page or API route involved, error details, browser or device information, timestamps, performance timings and related diagnostic data.

We use Sentry only for technical error and performance monitoring, not for advertising or behavioral profiling.

Analytics

When you consent to analytics cookies, we use Google Analytics to measure site usage, such as which pages are viewed and how visitors navigate the site. Google processes this data on our behalf as described in its privacy policy.

The Google Analytics tag is not loaded, and no analytics cookies are set, until you accept them. You can withdraw consent at any time from Cookie preferences in the site footer.

Hosting and infrastructure

PlateMotive is hosted by Hetzner Online GmbH on servers located in Germany (EU). We use Cloudflare as our content delivery network and reverse proxy for all site traffic and Cloudflare R2 to store uploaded images, so Cloudflare processes your IP address and uploaded images on our behalf as an infrastructure provider.

Where enabled, we also use Cloudflare Turnstile as a bot-prevention challenge on sign-in and the copyright report form. When active, Turnstile processes your IP address and browser signals to verify you are not a bot; it does not use tracking cookies.

Service providers and transfers outside the EU

Our hosting, email (Resend), error monitoring (Sentry), content delivery and image storage (Cloudflare) and, with your consent, analytics (Google) providers process data only on our behalf and on our instructions, under data processing agreements (Art. 28 GDPR).

Resend, Sentry, Cloudflare and Google are based in the United States or may process data there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision for it (Art. 45 GDPR); otherwise it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards that apply.

Deleting your account

You can delete your account at any time from Account settings. When you do, your profile is immediately and permanently anonymized: your email, username, name, bio, location, social links and avatar are removed, your Google account link (if any) is removed, your credentials are invalidated, and any pending password-reset tokens are deleted.

We also permanently delete your draft recipes and unpublished revisions, saved recipes, personal collections, personal recipe notes, cooking-log entries and their photos, and private uploaded images that are no longer used by retained public content.

Public contributions you made — published recipes, comments and ratings — remain on the site but are attributed to “Deleted user” and are no longer connected to your identifying profile information.

To request removal of specific retained public content, email [email protected] before or after deleting your account.

Copyright notices

When you submit a copyright notice through the report form, we store the name, email address, description and links you provide together with the IP address and browser details of the submission. We keep this record to process the claim and any counter-notice. We tell the person who posted the reported content what was reported and why we acted on it, but we share your name and contact details with them only if this is needed for a counter-notice or legal proceedings. If they send a counter-notice, we forward it to you, including the name they sign it with.

Retention

  • Account and content — for as long as your account exists, then deleted or anonymized as described in Deleting your account.
  • Signed-in sessions (including IP address and browser details) — until the session expires, at most 30 days after your last activity, and are then deleted automatically. Signing out or changing your password ends sessions earlier.
  • Rate-limit counters keyed on IP address — at most 24 hours.
  • Email verification, password reset and email change links — deleted once used or expired.
  • Technical server logs — up to 14 days, then deleted automatically.
  • Sentry error and performance data — deleted automatically after Sentry's retention period of at most 90 days.
  • Google Analytics data — deleted automatically after the retention period set in Google Analytics, at most 14 months.
  • Cookies and local storage — for the periods listed in the sections above.
  • Terms acceptance, image rights confirmations, moderation records and copyright notices — for as long as needed to handle the matter and to establish or defend legal claims, generally until the end of the three-year limitation period (§§ 195, 199 BGB) after the account or matter has ended.

We may retain public contributions and moderation or audit records needed to preserve the integrity and security of the service. Where a retained record refers to your deleted account, it refers to the anonymized “Deleted user” profile. Account deletion does not alter the identities of other people recorded in the same history, such as the moderator or administrator who took an action.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16) — you can edit your profile directly in Account settings;
  • have your data erased (Art. 17) — you can delete your account yourself, as described above;
  • restrict processing (Art. 18);
  • receive the data you provided in a portable format (Art. 20);
  • withdraw any consent you gave, at any time and with effect for the future (Art. 7(3)) — for analytics, in Cookie preferences.

We do not currently offer a self-service data export. To exercise any of these rights, request removal of specific retained content, or ask a privacy question, email [email protected].

Your right to object

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We will then stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. To object, email [email protected].

Right to lodge a complaint

You have the right to complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for PlateMotive is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg), baden-wuerttemberg.datenschutz.de.

Changes to this policy

If we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app.