What this site records

Opening a page records the time, your IP address, the approximate location that address resolves to, the page, your browser and where you came from. It is kept for 90 days and then deleted. Only the author ever sees it. It exists to answer one question — who finds this site and from where.

An IP address counts as personal data. The lawful basis is legitimate interest in knowing the audience of one’s own site, and the 90-day limit is what keeps that proportionate.

Behind a sign-in at /food, and only for the person signed in. An account is a name and a password — no address is asked for, so none is held. The password is stored only as a PBKDF2 hash, which cannot be turned back into the password. What is kept is what that person writes down: meals, weights and body measurements, each readable only by the account that entered it.

What someone eats and what they weigh are health data, so the basis is their own consent: they chose to create the account and can empty it. Food products added along the way are shared between accounts, because a catalogue of yoghurts belongs to nobody — the diary entries that use them are not.

Deleting an account deletes its entries, its weights and its measurements with it. Nothing is kept afterwards and nothing is sent anywhere else.

Vercel Web Analytics counts page views without cookies and without identifiers. It cannot single you out, which is why this site asks for no cookie consent.

Vercel serves the site and processes every request. Upstash stores the visit log, on servers in Frankfurt. Neon stores the food diary. Searching for a food sends the search term — and nothing else — to Open Food Facts and to USDA FoodData Central; describing a meal in words sends that sentence to Google’s Gemini API. None of the three is told who asked. Activity pages for publicly shared rides embed Strava’s own widget, which loads Strava’s script and its cookies — that part is governed by Strava’s privacy policy, not this one.

You can ask what is held about you, and ask for it to be deleted. Waiting 90 days does the same thing on its own.