Last updated: 19 September 2026.
This Privacy Policy explains what personal data the Smakota website (the “Site”) processes, for what purposes and on what legal bases, how long we keep it and what rights you have. It is written in line with the EU General Data Protection Regulation (GDPR) and the Law of Ukraine “On Personal Data Protection”. We collect only the minimum needed to run the Site.
1. Data controller
The controller of your personal data is the Smakota editorial team. For any privacy question, write to hello@smakota.kitchen or use the form on the Contact page (topic “Personal data request”).
2. What we process, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Server logs: IP address, date and time, requested page, browser and device type | Site security, protection against attacks and failures | Legitimate interest (Art. 6(1)(f) GDPR) | A limited period set by the hosting provider, usually no more than 30 days |
| Contact form: name, e-mail, topic, message text, date of consent | Replying to your message | Your consent (Art. 6(1)(a) GDPR); for data requests — a legal obligation | 12 months, then deleted automatically; e-mail correspondence likewise |
| Question under a recipe: the name you give (optional), the text of the question and a photo of the dish if you attach one | Answering it and publishing the question with the answer and your photo next to the recipe | Your consent — you send the question for publication yourself (Art. 6(1)(a) GDPR) | As long as the question and answer are useful to readers; you can ask us to delete them at any time. Photos are re-encoded on our server, so the camera and location data (EXIF) they carry never reaches the Site |
| Form spam protection: one-way hash of the IP address | Preventing mass submissions | Legitimate interest | Up to 1 hour |
| Recipe ratings: a rating from 1 to 5; one-way hash of the IP address | Calculating the recipe rating, preventing repeat votes | Legitimate interest | Rating — indefinitely, anonymised; hash — up to 7 days |
Browser storage: rated-recipe flags (smakota-rated-…), saved recipes (smakota-saved), viewing history (smakota-recent), your products and weekly menu (smakota-pantry, smakota-menu, smakota-menu-checked), your weaning schedule (smakota-weaning), your measuring units (smakota-units, when the seasonal decoration last ran (smakota-seasonal), pumpkins found in the Halloween hunt (smakota-pumpkins), the light-theme choice while the holiday look is on (smakota-theme), ticked recipe steps (smakota-steps-…)) — recipe numbers and product names only | Remembering your ratings, saved recipes, recently viewed dishes, products and menu | Strictly necessary for features you use | Until you clear the site’s data in your browser or press “Clear history”. Only recipe or product numbers are sent to the server to show cards and lists — not stored and never linked to you |
| Tab storage (sessionStorage): timers, cook mode | Keeping timers if the page reloads while you cook | Strictly necessary for features you use | Until the tab is closed; never sent to us |
| Offline cache (Cache Storage): copies of pages you opened or saved ♡ and their photos | So recipes open without internet | Strictly necessary for a feature you use | Up to the last 60 pages and 150 photos; saved ones until you remove them or clear the site’s data; never sent to us |
We never store the IP address itself for ratings or the form — only a one-way hash that cannot be turned back into the address. We make no decisions about you based solely on automated processing and do not build profiles.
3. Cookies
The Site uses cookies for analytics and advertising — and only where we have your consent or another lawful basis. The full list is in the Cookie Policy.
4. Who receives data
We do not sell personal data or share it with third parties for marketing. Access is limited to:
- the hosting provider whose servers run the Site;
- the e-mail service we use to receive and send mail;
- public authorities — only where and as required by law.
Providers process data only on our instructions and must keep it confidential. Where data is processed outside Ukraine or the European Economic Area, we choose providers that ensure an adequate level of protection (including the European Commission’s standard contractual clauses).
5. Advertising and analytics
We use Google Analytics 4 to see anonymous statistics: which pages people read, which countries and devices they come from. GA4 does not store your IP address and does not let us identify you; the data is kept for 14 months.
Ads are served by Google AdSense and Google’s partners. They may use cookies and advertising identifiers to choose more relevant ads, avoid repeating the same ad and count impressions.
Ads are also served by Ezoic Inc., a Google Certified Publishing Partner, together with its advertising partners. Where consent is required, it is collected by Ezoic’s certified consent message (IAB TCF 2.2); to change your choice, clear the site’s data in your browser and the message will appear again. The list of Ezoic’s partners and the cookies they use is below.
Visitors from the EU, the EEA, the UK and Switzerland see Google’s certified consent message (Consent Mode v2) before any such cookie is set. Until consent is given, analytics and ads run without cookies and without personalisation. You can change your choice at any time through “Privacy choices” at the bottom of the page.
Residents of US states, California included, can opt out of the sale or sharing of personal information through the same link at the bottom of the page.
How Google uses data from partner sites: policies.google.com/technologies/partner-sites. Ad settings: myadcenter.google.com. Turn Google Analytics off on every site: tools.google.com/dlpage/gaoptout.
6. How we protect data
The Site runs over a secure HTTPS connection, only authorised people can access its administration area, and IP addresses used against abuse are stored only as a one-way hash.
7. Your rights
Under Articles 15–22 GDPR and Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right to:
- know what data about you we process and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased;
- restrict or object to processing;
- receive your data in a structured, machine-readable format;
- withdraw consent at any time — this does not affect processing carried out before withdrawal;
- lodge a complaint with your local data protection authority in the EU/EEA or with the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).
To exercise your rights, write to hello@smakota.kitchen. We will respond within one month (30 days) and may ask you to confirm that the request comes from you.
8. Children
The Site is not designed to collect children’s data. If you are under 16, please use the contact form only with the consent of a parent or guardian. If you believe a child has sent us data without such consent, contact us and we will delete it.
9. Changes to this Policy
We update this Policy when the way we handle data changes. The date at the top shows the current version; we will announce significant changes on the Site.