Privacy & cookies

Prepared 25 October 2026 for Chilli Lab, chilli-lab.com. Contact: chillilabapp@gmail.com.

Who operates the service

Chilli Lab is the service name. Before release, add the legal person or registered company that determines how personal data is used, and its contact/postal details where required.

Information used

Google and Supabase handle sign-in using your account identity, email and basic profile information. Supabase stores the authentication identity and your saved recipes, ingredients, batch records, notes and settings. Hosting and authentication services process connection details, such as IP addresses and operational/security logs. Support emails contain what you choose to send.

Purpose and legal basis

Data is used to sign you in, provide your private workspace, resolve support requests and protect the service. Before release, document and insert the appropriate lawful basis for each purpose; do not treat signing in as blanket consent to unrelated processing.

Providers and access

The planned providers are Google for sign-in and support email, Supabase for authentication and database storage, and Render for hosting. The operator can administer the database and respond to support requests. The app has no public recipe-sharing feature. Before release, confirm the actual providers, database/host regions, subprocessors and any international-transfer arrangements.

Cookies and browser storage

The app uses HttpOnly authentication cookies for login, session refresh and sign-out. Cookies are Secure on HTTPS and use SameSite=Lax. Session cookie lifetimes are set to up to 30 days and may renew; the login verifier is set to 10 minutes. Browser storage also remembers display/measurement preferences. No advertising or analytics integration is included in this candidate. Google and other providers have their own notices during sign-in. Explain any added tracking before enabling it.

Retention and deletion

The app currently has no automatic inactivity deletion. Workspace reset clears saved content and keeps revision/deletion markers; it does not remove the authentication identity. Full identity deletion is handled by verified support requests. Before release, insert the adopted periods for accounts, notes, support email, security logs and backup expiry, and confirm these against provider settings. Backups may retain deleted records until they expire; restored backups must have verified deletion requests reapplied.

Your choices and rights

You can export your workspace through Menu → Backup & import and correct saved content in the app. Contact the support address to request access, correction, deletion, restriction, portability or to object where applicable. You may complain to the relevant data-protection regulator; for the UK, see the ICO. Before release, confirm jurisdiction, applicable rights, response handling and whether an ICO fee is payable.

Changes

Update this notice when the service or its data handling changes and give material changes appropriate visibility.