Privacy policy

What this Sandwitches instance stores about you, why it stores it, who else sees it, and how to get it back or remove it. Last updated 2026.

Who is responsible

the operator of this Sandwitches instance runs this instance and decides what is done with the data described here. The instance is hosted in the European Union.

This instance has not published a dedicated privacy address. Requests can be made from the account itself (see Delete your account), or through the administrator who runs this server.

What is stored, and why (GDPR Article 13)

• Account and profile. Username, email address, first and last name, optional bio and avatar, language and theme preference, the date you joined and the time you last signed in. If you sign in with a password we store a bcrypt hash of it, never the password itself. Legal basis: performance of a contract with you.
• External login identity. When you sign in through the configured OpenID Connect provider, we store the provider's subject identifier (the oidc_sub value) and any name, email and group information the provider returns at sign-in. We do not receive your provider password. Legal basis: performance of a contract and our legitimate interest in offering single sign-on.
• Recipes and contributions. Recipes you create (title, description, ingredients, instructions, servings, price, images), ratings and comments you post, and the history of edits made to recipes. Legal basis: performance of a contract and our legitimate interest in running the community.
• Orders. Orders you place, their items, status, total and an order tracking token, plus the delivery/contact information the instance asks for at checkout. Legal basis: performance of a contract; order records are also kept for accounting and dispute handling where the law requires it.
• Cart and favorites. Which recipes you put in your cart or marked as a favorite. Legal basis: performance of a contract.
• Security and sign-in data. The signed session cookie described below, password-reset tokens (stored only as SHA-256 hashes, valid for 24 hours), mobile one-time sign-in codes (hashed, valid for two minutes), IP addresses used for rate limiting and abuse prevention, and request logs containing the request path, status, timing, a request ID and possibly a trace ID. Legal basis: legitimate interest in keeping the service secure and working.
• Email delivery. If email is enabled, your address and the content of order/reset/notification messages are passed to the configured SMTP provider so it can deliver them. Legal basis: performance of a contract and legitimate interest in notifying you.
• Push notifications. This instance sends order and recipe notifications to a Gotify server configured by its operator. Those messages include the order or recipe details and the username involved. Legal basis: legitimate interest in operating the instance.
• Analytics. This instance uses a self-hosted Umami instance at https://umami.vandijke.xyz. It records page views without advertising cookies or cross-site profiles. Legal basis: legitimate interest in understanding which pages are used.

What other people can see

Recipes are public: anyone can read a recipe page, including its title, description, ingredients, instructions, images and the username, display name and avatar of the account that created it. Ratings and comments are public together with the username and avatar of the person who posted them. Favorites are not listed publicly, but a recipe page shows how many people favorited it.

The public JSON endpoint GET /api/v1/users lists the public profile of accounts: id, username, first and last name, avatar and bio. It does not return email addresses, password hashes, sign-in identities, language/theme preferences, staff flags or any order data. Profiles and recipes you create are therefore visible without signing in; the rest of your account data is only visible to you and to instance administrators.

Who else receives data

Data is not sold and is not shared for advertising. It reaches the following recipients only when the corresponding feature is enabled:

• The SMTP provider configured by the operator, which delivers email and therefore sees the recipient address and message content.
• The Gotify server configured by the operator, which receives notification text and delivers it to the operator's devices.
• The self-hosted Umami server, which records page views.
• Your OpenID Connect identity provider, which authenticates you and returns your identity to us.
• The hosting provider that runs this server and its backups.

Some providers may process data outside the European Economic Area. Where that happens, transfers rely on an adequacy decision or the provider's standard contractual clauses.

Cookies, sessions and tracking

This site uses one cookie, sandwitches_session. It is HttpOnly, signed by the server, valid for up to 30 days, and sent only with requests to this site. It contains a CSRF token and, once you sign in, your user id and a session version. There is no separate server-side session database: the cookie itself is the session, and the server checks on every request that the account still exists, is active and still has the version recorded in the cookie.

Signing out deletes the cookie. Changing your password or deleting your account bumps the account's session version or removes the account, which makes every previously issued cookie stop working, including cookies on other devices.

There are no advertising cookies, no third-party tracking pixels and no cross-site profiling. The Umami analytics above is self-hosted and cookieless; it does not receive the session cookie.

How long it is kept

• Account and profile data: while your account exists, then deleted as described below.
• Password-reset tokens: 24 hours, or until used. Mobile sign-in codes: two minutes, or until used.
• Session cookies: up to 30 days, or until you sign out, change your password or delete your account.
• Recipes: while the recipe exists. If you delete your account, recipes you authored stay published with no author attached, unless an administrator removes them.
• Ratings, comments, favorites, cart rows, group memberships and reset/mobile tokens: deleted immediately when the account is deleted.
• Orders: retained as the instance's transaction record after the account is deleted, with the link to your account removed. The order's tracking token remains valid. Accounting retention periods may require this.
• Logs and backups: kept for the operator's normal log and backup rotation window and then overwritten. Backups are not used to restore an individual deleted account.

Deleting your account

You can delete your account at any time from Settings (in the web app) or Settings → Delete account (in the Android app). The deletion is immediate and there is no waiting period.

Removed: your account row, username, email address, first and last name, bio, avatar reference, language and theme, password hash, OIDC subject, active sessions, group memberships, favorites, ratings and comments, cart, password-reset tokens and mobile sign-in codes.

Retained, detached from you: recipes you authored (with the author field cleared), recipe edit-history entries you made (author cleared), and orders (account link cleared, tracking token and item/price record retained).

If you cannot sign in, use the fallback described on Delete your account. If you signed in through an external identity provider, deleting the Sandwitches account does not delete your account at that provider; delete or disable it there as well if you want the identity removed.

Your rights

• Access and portability. Download your data as JSON from the app (GET /api/v1/me/export) or from the signed-in settings page.
• Rectification. Most profile fields can be changed under Settings and Profile.
• Erasure. Use Delete your account; it takes effect immediately.
• Restriction and objection. Ask the contact above to restrict processing, or object to processing based on legitimate interest.
• Complaint. You may lodge a complaint with the data protection authority (DPA) in the country where you live, work, or where the alleged infringement took place. In the Netherlands this is the Autoriteit Persoonsgegevens.

Requests that are not covered by the self-service pages are answered within one month, as Article 12 GDPR requires. You can also ask for the data described here to be corrected or for an explanation of how it was processed.

Children

This instance is not intended for anyone under 16. Accounts for younger users are not knowingly created; if you believe a child under 16 has an account, contact the operator so it can be removed.

Automated decisions

No automated decision-making with legal or similarly significant effects is performed. Recipes may be reviewed by an administrator before publication.

Changes

If this policy changes in a way that affects you, the change is announced on this page before it takes effect. The date at the top shows the current version.

See also the terms of use and account deletion page.