Privacy policy

Who operates Potful

Potful (potful.io) is operated by Matrix Automation Solutions, trading as "Potful", an Ontario-registered sole proprietorship. This policy explains what personal information we collect, why, and the rights you have over it under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, Law 25.

What we collect, and why

• Account information - your email address and a display name. When you sign up, your display name starts out as a name derived from your email address; you can change it anytime from account settings. We use your email to send one-time sign-in codes (including, for staff, codes to sign in to the admin review surface), an account-deletion confirmation code if you ask to delete your account, and moderation notices about your own recipes - a notice when one of them is hidden after a content report, and a forwarded copy of any copyright complaint made about one of them. For Potful Plus subscribers, we also use it for subscription emails: a purchase confirmation, cancellation and refund confirmations, renewal reminders, and advance notice of a price change. We never ask for or store a password.
• Recipes and related content - the recipes you write, their version history, forks, meal plans, grocery lists, pantry contents, stars, and "I made this" logs. This is the core content of the service - we collect it because the product can't function without it.
• Recipe photos - photos you upload to a recipe. We strip location and other EXIF metadata from every photo before storing it.
• Payment status - whether you have an active Potful Plus subscription, and billing identifiers from our payment processor (Stripe), which also receives your email address and your account ID to link a payment back to your account. We never see or store your card number.
• Session and rate-limiting data - a session cookie that keeps you signed in, and your IP address, held in memory (not in a database) to prevent abuse of the sign-in code system. IP-keyed entries are pruned on an hourly sweep once they age out of their own rate-limit window, and all of them are cleared on a server restart.
• Report form contact details - if you use the public "report a problem" form, the email address and (optional) name you enter, so our moderators can follow up with you about your report. We don't pass them on to the owner of the recipe you reported. They're kept with the report record for trust-and-safety purposes for as long as the reported recipe's record exists.
• Local preferences - your light/dark theme choice, stored only in your browser (localStorage), never sent to us.

Cookies

We only use cookies that are strictly necessary to run the service, and we don't use any tracking or advertising cookies:

• potful_session - keeps you signed in, for up to 30 days.
• potful_login_request - binds a sign-in code to your browser while you're signing in, for up to 15 minutes.
• potful_flash - carries a one-time confirmation message (like "Recipe saved") across a page redirect, for up to 15 seconds.

Signing in to the separate admin review surface sets its own equivalent, differently-named cookies, scoped to that surface only.

Who we share it with

We don't sell personal information. We share the minimum necessary with the processors who help us run the service:

• Stripe - processes Potful Plus subscription payments. Stripe may process your information outside Canada; see Stripe's privacy policy.
• Resend (our email delivery provider) - sends sign-in codes, deletion codes, moderation notices, and subscription emails on our behalf. Resend processes this data in the United States.
• Hostinger (our hosting provider) - stores the application database and serves the website. Hostinger hosts our server in Canada.
• Cloudflare (Turnstile, our bot-protection provider) - when bot protection is enabled, checks that the sign-in form is being used by a person rather than an automated script. To do that it receives your IP address and signals about your browser and device, which it uses solely for bot protection. Cloudflare may process this data in the United States and elsewhere outside Canada; see Cloudflare's privacy policy.

Any public recipe you publish is, by design, visible to anyone who visits Potful - that's the point of publishing it. A fork of your recipe credits your display name, which is likewise public.

How long we keep it

We keep your account information for as long as your account exists. Deleting a single recipe removes it from view immediately - nobody, including you, can open it again - and deletes its photos and your draft of it, but the recipe's record and version history are kept in our database rather than erased, so that copies other members already forked from it keep their credit to you. If you delete your account, we immediately delete your sessions, pending sign-in codes, drafts, private recipes, meal plans, grocery lists, pantry, stars, cook logs, and subscription record, and cancel any active subscription. Your account record itself is kept but anonymised rather than erased: your email address is replaced with a placeholder that can't receive mail (so the real address is free for a new sign-up), your display name becomes "a former member", and the record is marked with the time it was deleted. If you also choose to delete your public recipes, every recipe you own is erased, including any you had already deleted earlier. If you don't, your public recipes stay published, credited to "a former member", and a recipe you had already deleted keeps its retained record as described above - see account deletion for the full list of what's deleted and what's kept. If you've filed or been the subject of a content report, a record of it (including any notes) may be kept after account deletion for trust-and-safety and accounting purposes. Billing and payment records are retained by Stripe independently of your Potful account, for as long as required by tax law; we don't delete your Stripe customer record ourselves. Photo files belonging to a deleted recipe are removed from storage by an hourly cleanup, normally within about two hours of the deletion.

Your rights

Under PIPEDA and Law 25, you have the right to:

• Access the personal information we hold about you - download it anytime from your account settings.
• Correct inaccurate information - edit your display name or recipes directly, anytime. Note that a fork someone else already made of your recipe keeps the credit name you had at the time they forked it, so a later name change doesn't rewrite credit lines that already exist.
• Withdraw consent and request deletion of your account - see delete your account.
• Request a copy of your data in a portable format (data portability) - the export in account settings covers this.
• File a complaint with us directly, or with the Office of the Privacy Commissioner of Canada, or (for Quebec residents) the Commission d'accès à l'information.

Children

Free accounts are intended for users aged 13 and older. Buying Potful Plus requires the age of majority where you live. If we learn that an account belongs to someone under 13, we'll delete that account and the personal information associated with it.

If something goes wrong: data breaches

If we discover a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we'll notify the Office of the Privacy Commissioner of Canada and you, as soon as feasible, as PIPEDA requires. We keep a record of every breach of security safeguards we become aware of - whether or not it meets that notification threshold - for at least 24 months.

Security

Sign-in codes and session tokens are never stored in plain text: a sign-in code is hashed with a deliberately slow algorithm built for secrets with limited entropy, and a session token is hashed before storage. The production service is served over HTTPS. We keep standard operational server logs for troubleshooting and abuse prevention; we don't intentionally log the content of your sign-in code, but a log entry can occasionally include technical error detail, such as a delivery failure message from our email provider.

Changes to this policy

We'll update the version number at the top of this page when this policy changes, and post meaningful changes prominently on the site.

Contact us

Questions, access requests, or complaints about this policy can be sent to info@matrixautomate.co. Our privacy officer is Tyler Friesen.