Cookies and browser storage
This policy lists the cookies and browser storage Recipy actually uses. Essential technology keeps the service and your choices working. Mixpanel and configured Google Analytics browser measurement stay off unless you select Accept cookies. Vercel Web Analytics measures aggregate page visits only after analytics consent. Private route identifiers, query strings and fragments are removed. Do Not Track and marked internal or test traffic are excluded. Speed Insights measures aggregate page performance with the same consent and URL protection. Session replay remains disabled, including after acceptance.
The controller is AB & GL Nexus Global Partners Limited, Irish company 764964. Questions may be sent to support@recipy.to.
1. Your choice
On the first visit, Recipy offers equally clear Reject and Accept cookies choices. Rejecting does not block account, Recipy, book, purchase, or support features.
You can reopen the choice at any time with the Cookie settings control. If you withdraw consent, Recipy removes accessible Google Analytics cookies and Mixpanel local-storage entries and reloads the page to stop already-loaded analytics code. Provider-side information collected before withdrawal is handled under the Privacy Notice and the provider retention setting.
Browser or device controls can also block cookies or storage, but blocking essential authentication technology can prevent Recipy from working.
2. Essential and functional technology
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Recipy authentication cookies | First-party cookies with the recipy prefix |
Maintain anonymous or signed-in authentication, refresh the session, and protect account routes | For the session and refresh period needed to keep you signed in, then expired or replaced |
recipy_analytics_consent |
First-party local storage and SameSite cookie | Remember your analytics choice; the cookie passes it to the authentication receipt check | Local storage until changed or cleared; cookie up to 400 days |
recipy_lang |
First-party local storage | Remember the interface language you selected or that the app detected | Until you clear site storage or choose another language |
recipy_theme |
First-party local storage | Remember your Light, Dark, or System appearance choice on this browser | Until you clear site storage or change the setting |
recipy-recording-recovery |
First-party IndexedDB database | Keep essential browser audio recovery copies keyed by owner and Recipy | Expires seven days after the last checkpoint; expired entries are removed on the next database use. Copies are cleared after server upload confirmation or when you clear site data. |
recipy_pending_migration |
First-party session storage, with tab memory and history state for recovery | Carry a signed anonymous-account proof through requested sign-in so the right Recipys can be claimed | Kept for retryable interruptions; active copies cleared after success or a confirmed invalid or expired proof. The proof is valid for up to 24 hours. Older history entries follow browser retention. |
These items are not used for advertising. Recipy does not store audio drafts, Recipy text, or photos in localStorage. Essential audio recovery copies are stored separately in the browser's IndexedDB database recipy-recording-recovery, keyed by owner and Recipy. Each copy expires seven days after its last checkpoint; expired entries are removed the next time Recipy uses this database, not automatically while the site is closed. Recipy clears the recovery copy after the server confirms upload. Clearing site data also removes these copies. Recovery requires the same owner account or anonymous session and a server check confirming ownership of the Recipy. Uploaded drafts and content records remain in Recipy's authenticated database and private object storage.
3. Consented analytics and historical browser storage
| Name or provider | Type | Purpose | Retention |
|---|---|---|---|
recipy_returning |
Historical first-party local storage; no longer written | Previously marked returning analytics sessions | Until site storage is cleared |
recipy_analytics_v2_* |
Consented first-party local storage | Session, first observed channel and bounded delivery receipts to reduce duplicate milestones | Session rotates after 30 minutes without observed activity; other entries until withdrawal or site storage is cleared |
recipy_analytics_receipt |
Consented signed HttpOnly, Secure, SameSite cookie | Distinguish genuine new accounts from returning sign-ins; contains opaque account/session IDs, method and time, never authentication credentials | Up to 7 days; expires on withdrawal when the deletion request succeeds |
mp_* |
Mixpanel local storage | Pseudonymous identity; historical entries may include earlier analytics profile state | Browser entry persists until consent is withdrawn or site storage is cleared; provider-side data follows the configured project retention |
_ga and _ga_<measurement-id> |
Consented Google Analytics first-party cookies, including historical entries | Distinguish browsers and sessions for consented website measurement | New cookies up to 400 days; removed when consent is withdrawn or site storage is cleared |
| Mixpanel | Consent-gated script and network requests to the EU ingestion host | Sanitised feature events, safe screen/route views, approximate country code, visitor-local hour/day, visible recently active page time, named clicks, device category, locale, classified acquisition, campaign attribution and pseudonymous identity | For the configured project retention or until earlier deletion is appropriate |
| Google Analytics | Consent-gated Google tag when configured for production | Sanitised page views, engagement, device, approximate geography, known referrer domains and allowlisted campaign values; no account ID | New property event/user data retention is 2 months; standard aggregated reports may persist longer; earlier deletion when appropriate |
| Vercel Web Analytics | Consent-gated, cookie-free script and network requests | Aggregate page traffic and visitor measurement with sanitised route templates; no private link parameters or Recipy content | Vercel Web Analytics is cookie-free by default; provider retention applies |
| Vercel Speed Insights | Consent-gated, cookie-free script and network requests | Aggregate web-performance measurements with sanitised route templates | Provider retention applies |
Mixpanel uses its core-only browser SDK without session replay, automatic click capture or profile updates. Events use a strict allowlist: URLs become route templates and referrers become channel categories. Page titles, search fields, emails, family content, audio, transcripts and access tokens are excluded. IP-based analytics enrichment is disabled; only an approximate two-letter country code provided by the host is used when available. Active page time stops after 60 seconds idle or while hidden. No events are backfilled from before consent. Sends are not batched; old persisted batches are discarded before initialisation.
Google Analytics loads only after consent, only on the configured production host, and respects Do Not Track. Development, preview and marked internal/test traffic do not load the tag. Page paths become route templates; page titles are fixed labels; query strings, fragments and private links are omitted. Only known public referrer domains and allowlisted campaign values are used. No account IDs, emails, family content, audio, transcripts or form values are sent. Enhanced measurement, advertising storage, ad personalization and Google Signals are disabled. Google may derive approximate geography from the connection; we do not promise EU-only processing. No pre-consent events are backfilled. Withdrawal immediately disables delivery and reloads the page to stop the loaded tag.
Disabling collectors does not erase historical browser storage or data already received by providers. The withdrawal controls and provider retention handling above still apply.
Recipy does not use advertising cookies or provide family content to advertising networks.
4. Session replay
Session replay is currently disabled, even after analytics consent. The browser SDK excludes replay, replay sampling is zero, and remote replay configuration and recording triggers are disabled. Network recording and heatmap collection remain disabled. Consented Mixpanel browser analytics continues to use the EU ingestion endpoint. Recipy reviews these controls after material UI or analytics changes.
These controls do not delete replay data previously received by the provider; that data remains subject to the provider retention setting and the Privacy Notice.
5. Server-side reliability events
Recipy no longer sends processing reliability events directly from its server to Mixpanel. Server logs needed to operate and secure the service remain separate from consented browser product analytics. Historical provider events remain subject to the provider retention setting.
6. Email technology
Transactional emails for sign-in, account security, orders, delivery, cancellation, refunds, and support are part of the requested service and do not depend on analytics consent.
The optional Recipy newsletter uses separate consent: deliberately submit the dedicated email form, then confirm your address using the emailed link. This choice is independent of account registration, terms and browser analytics. The newsletter confirmation, welcome and updates include an unsubscribe method. Newsletter open and click tracking remain disabled.
7. Keeping this list accurate
Recipy will update this policy before adding a new non-essential browser technology. Material analytics changes require a new consent where the existing choice no longer covers them.
The exact authentication cookie name can vary by live session. Recipy keeps this policy focused on purpose and duration and updates it when a new category or provider is introduced.
8. Contact and related documents
AB & GL Nexus Global Partners Limited
Company number: 764964
Registered office: Valclusa, Church Avenue, Killiney, Ireland, A96 Y072
Email: support@recipy.to
Related documents: Privacy Notice, Terms of Use and Sale, and Accessibility Statement.