A kitchen built on trust
Privacy, plainly explained
Questions, suggestions and problem reports
The feedback and contact forms save your selected category and message in the private owner reports inbox and its backups. Recipe reports may include the recipe identifier and version. No reply address is collected and no email is sent by the form. Please leave out account details, names and sensitive information. The service uses request information for abuse limits. Contact justin@crossandcanopy.com if you need a reply or want a report removed; include its reference number.
Recipe feedback
Signed-in adults may give a recipe version one positive or negative vote, change it or remove it. We store the account identifier, recipe version, choice and update time. Other visitors see only totals, never voter names. Votes are saved immediately to your account, included in your account export and removed when you delete website account data. You can also remove all your votes from My account. Votes describe experience, not safety or professional approval.
Who operates this site
Bethany’s Kitchen is founded by Justin and Bethany. Contact justin@crossandcanopy.com about your information. This policy describes the current service, updated October 23, 2026.
Browser-local features
Saved recipes, private notes, shopping lists and their selected recipe versions, grocery checks, pantry exclusions, preferred stores, item-to-store assignments, user-entered package price notes, and meal plans are stored in your browser. Cooking progress is saved for the browser session. Full kitchen data is sent to your account only through explicit account saves, signed-in family edits, or automatic saving on a browser where you connected it (see Optional accounts). After a separate one-time browser opt-in, grocery descriptions can also be sent for automatic price research as explained below. Family edits in an account are saved directly to the database. Clearing browser storage deletes local copies, including changes that automatic saving had not yet confirmed to your account. Backup files are checked and restored within your browser, without uploading them. Restoring keeps a local recovery copy before replacing your saved data. After successful saves, up to two ordinary recovery copies are retained. Unreadable originals and copies protected during account replacement are kept until you remove them using the recovery tools or clear browser storage. Downloaded backups contain your private notes and preferences; keep them private.
Automatic ingredient research
Automatic research for shopping extras is off until you enable it on that browser. Once enabled and signed in, short grocery descriptions enter a shared source-research queue; recognized extras use their catalog food name. Turning it off stops new submissions but does not withdraw earlier research. Daily submission limits use keyed account hashes separately from research rows. Queue records do not contain account identifiers, list IDs, family fields or recipe notes. Keep descriptions to grocery products without names or personal information. Ingredient descriptions may be used in public retailer and search queries. Research records and factual price references are retained for shared catalog maintenance, separate from private account saves. Lookups run on a schedule and can be delayed or unable to find a suitable price.
Optional offline copies
In App setup, you can choose to prepare a take-along copy on a trusted device. It contains your shopping lists, the next seven days of planned meals, saved recipe instructions, and relevant ingredient warnings. Family profile names, private recipe notes and account details are left out. This copy is stored separately in this browser and can be read without signing in, including after sign-out or account deletion. Remove it in App setup or the offline viewer before sharing the device. Offline shopping checkmarks stay in that copy until you explicitly apply them to the matching browser list; saving them to your account is a separate action. We do not automatically sync the offline copy. Your browser may remove local storage when space is needed, so an offline copy is not a backup. The service worker caches only the small offline reader and its static files, not account or administrator pages.
Optional accounts
Website email/password sign-in uses Supabase Auth. Supabase processes your email address, password authentication, verification and recovery requests, and session security information. The website exchanges credentials with Supabase over HTTPS and uses an HttpOnly session cookie; passwords are not stored in the kitchen database. Existing ChatGPT sign-in remains available through the hosting platform, which supplies a site-specific identity and display information. Linking an existing kitchen requires control of both sign-ins and an explicit confirmation; matching email addresses alone never transfers saves. Account saves are private and stored in the website database. Automatic saving is off until you choose Turn on automatic saving on a browser in My account (a short review comes first when the account already holds different saves); a brand-new browser with nothing saved also receives your account copy when you sign in. After that, changes made in that browser are sent to your account while you are online. Until the account confirms them they exist only in that browser; if its storage is cleared before the upload completes, they are lost. The connection is a small record in that browser’s storage holding your account identifier, the last confirmed revision and a checksum of your saves, never your password. If another device saved to the account first, automatic saving pauses and My account asks you to review both copies; nothing is combined or replaced without your choice. Each confirmed account save keeps the previous copy on the server; the last 10 previous copies are retained, can be downloaded or loaded back from My account, and are included in your export. Use My account to create a kitchen profile, turn automatic saving on or off for a browser, merge account data, export both copies, or delete your website account data. A profile stores your chosen name, sign-in email and dated consent records. If you saved optional email choices in an earlier release, they remain in that record unchanged but are not used: there are no email preference controls, and we send no newsletters or reminder emails. Account confirmation and password recovery emails are sent through Resend. Email providers may delay or filter them. Sign-in lasts up to one hour by default. If you choose Remember me, a protected cookie keeps that device signed in for up to 30 days; its refresh credentials are encrypted on our server. Signing out or changing your password ends remembered sessions. Deletion removes your profile and consent records as well as account saves, their previous versions and unpublished submissions. The website-account deletion control also deletes its Supabase sign-in identity and revokes access. It requires your password; an interrupted deletion can be retried. Minimal random identity references and a deletion marker remain to prevent old saves from reappearing and support security auditing. Deleting website data does not delete your ChatGPT account. Browser copies, downloaded exports and provider backups are separate.
Cooking settings
Illustration, page-turn, site-motion and timer-sound preferences save directly to your signed-in account, separately from kitchen save/load. They are included in your account export and removed on account deletion. Reduced motion on your device takes precedence. A saved sound choice never activates audio on its own; only your Start timer or Sound tap can.
Submissions and reports
Signed-in adults can enter a structured recipe or import plain UTF-8 text up to 64 KiB on their device, inspect it, and then submit the recipe fields. Files themselves are not uploaded or retained. Image/PDF OCR is not supported. Permission, attribution and optional AI-review consent accompany each private revision. Withdrawal redacts unpublished recipe text and review findings and cancels pending jobs; hash-only audit records may remain. Local reviewer copies are removed at the next successful maintenance pass; an offline host must reconnect first. Reports are private to administrators; avoid sensitive personal information. No delivery email is sent automatically.
Account security checks
When enabled on an account form, Cloudflare Turnstile processes browser and network signals to distinguish people from automated requests. Supabase verifies the resulting security token for sign-in, signup, password recovery and account password checks. Kitchen saves and family preferences are not sent to Turnstile.
External processing
Browsing recipes makes no live AI calls. With the contributor’s consent, submitted recipe fields and necessary review context are processed by OpenAI Codex and Anthropic Claude through the authorized local maintenance workflow. Household data, credentials and unrelated account information are excluded. Rule-based checks run without AI consent; those submissions stay private and cannot be published under the current policy. Uncertain recipes are held; AI reviews cannot establish taste or kitchen testing. Review may wait when the maintenance computer or a required reviewer is unavailable. No OCR service is configured. Scripture and nutrient data are cached, so browsing does not contact those providers. Images are generated illustrations bundled with the site.
Store links and price notes
My stores and shopping estimates do not collect your location or store passwords. Store links open only when you choose them. A supported ingredient-search link sends that ingredient name to the retailer; it does not send your full list, notes or account identity. Price notes and store choices stay in browser storage until you save your kitchen data to your account, or until the next automatic save on a browser where you connected automatic saving. Shared estimate records are fetched without sending your shopping list or store selections. No live retailer feed is connected; product images are not used.
Giving
The Give page links to existing Cross & Canopy Stripe and PayPal payment pages. Payment information is entered on those providers’ websites, under their terms and privacy policies. Bethany’s Kitchen does not collect card details or receive payment status through an integration.
Retention and security
Account data is kept until you delete it. Previous account copies are limited to the last 10 and are removed with the current copy. Submitted text is kept while awaiting review unless withdrawn. There is currently no automated report-retention purge; request removal by email. Editorial review and publication records are retained to maintain recipe accountability. Backups may retain deleted data until they expire. Hosting infrastructure may retain operational security logs under its own terms. There is no third-party advertising or behavioral analytics in this release.
Home-screen app and offline copies
Installing the website does not create another account or automatically synchronize browser copies. The optional take-along copy stores rendered shopping items, planned meals and recipe instructions on the device, including preference warnings but not family names, private notes or account credentials. Anyone with access to that browser can read the copy after sign-out. Remove it in App & offline access or the offline viewer. Offline checkmarks are applied to the browser kitchen only after review and a matching-list check; account saving remains separate. The service worker caches only its fixed offline shell and icons, never account pages, API responses or authentication links. Clearing site data or browser eviction can remove local copies.
Family preferences
Adults can optionally save household nicknames, favorite recipe IDs, dietary preferences, allergens and foods to avoid. We do not ask for ages, birth dates, medical histories or children’s accounts. A nickname or initial is enough. Family details remain in your private account and browser copy, and are not included in public recipes, shared links, grocery-price research or GitHub. Removing a person retains only a random deletion identifier to avoid restoring that person during a later merge.
No sale of personal information
We do not sell personal information or use it for targeted advertising. We do store the account information you choose to save and rely on hosting and sign-in providers to deliver the service. Contact us with privacy questions. This policy describes current behavior; it does not claim universal legal compliance.