Cookie Policy

Spoonify uses a small number of cookies and similar technologies so you can stay signed in and so basic product features work. We do not use third-party advertising cookies, and we do not sell your personal information.

This Cookie Policy is part of our Privacy Policy. Words like “personal information” and “Service” have the same meaning there.

A cookie is a small text file that a website asks your browser to store. When you come back, the browser sends the cookie to the website so it knows things like “this person is signed in.”

We also use a few related technologies:

• Local storage — browser storage that stays on your device until cleared (for example, recent searches).
• Secure on-device storage — used by the mobile apps to keep your session and similar tokens.
• Mobile SDKs — libraries inside the Spoonify apps that perform similar functions to cookies (session, push delivery, crash reporting, and product analytics).

We refer to all of these collectively as “cookies” in the rest of this page for simplicity.

Strictly necessary

These are required for the Service to work. They sign you in and keep your session active on the web. You can block them in your browser, but doing so will prevent you from staying signed in.

Functional

These remember choices that make the product nicer to use — today, that means recent search terms stored in local storage. They are not used for advertising.

Product analytics

These help us understand how the Service is used so we can improve it. On app.spoonify.dev, PostHog sets first-party cookies (and similar storage) identified by a user id only. We do not record session replays, and we do not use these cookies for advertising.

What we do not use

We do not use advertising or targeting cookies. We do not use Google Analytics. We do not allow third parties to place advertising cookies through the Service. We do not record session replays.

The exact items you see depend on whether you are signed in and which features you use. The table below covers what most people will encounter on Spoonify’s own sites.

Durations are the maximum lifetime; we may rotate or clear them sooner. Names with a wildcard (*) cover related cookies or storage keys set by the same provider.

The Spoonify mobile apps (and some payment flows on the web) use a small number of vendors. These usually do not set cookies on spoonify.dev, but they may store identifiers on your device or on the vendor’s own domain.

On spoonify.dev we primarily set our own (first-party) session cookies via Supabase. On app.spoonify.dev we also set first-party PostHog product-analytics cookies. Other third-party cookies appear mainly when you leave our site for a vendor-hosted flow.

• Stripe — when you check out, open the billing portal, or complete Connect onboarding, Stripe may set cookies on its own domain for security and fraud prevention. See Stripe’s cookie settings.
• Sentry — used in the mobile app for crash reporting. It does not set advertising cookies on our websites.
• PostHog — used on the web app and in the mobile apps for product analytics. On app.spoonify.dev it sets first-party cookies (and similar storage) with an analytics identifier. It does not set advertising cookies and we do not record session replays.

Browser settings

Most browsers let you block or delete cookies through their settings. Blocking strictly necessary cookies will prevent you from signing in or staying signed in on the web. Guides:

• Google Chrome
• Apple Safari
• Mozilla Firefox
• Microsoft Edge

Local storage

You can clear recent searches by clearing site data for spoonify.dev / app.spoonify.dev in your browser, or by removing those keys from local storage.

Mobile app

Uninstalling the app removes on-device session and SDK data stored by Spoonify. You can also control notification permissions in your phone settings. Account deletion is available from the Help Center in the app and also queues deletion of your PostHog analytics profile.

Do Not Track and Global Privacy Control

There is no consistent industry standard for “Do Not Track,” so we do not respond to it. Where required by law, we treat the Global Privacy Control signal as a valid opt-out of sales or sharing of personal information — though, as noted above, we do not sell or share personal information for advertising.

EEA, UK, and Switzerland

Where required by the GDPR, UK GDPR, ePrivacy rules, or the Federal Act on Data Protection, we ask for prior consent before setting advertising or other non-essential cookies that are not needed to operate the Service. Today we set strictly necessary session cookies and first-party PostHog product-analytics cookies on app.spoonify.dev (user id only, no session replay, not for advertising). We treat those analytics cookies as first-party measurement of our own Service — the same purpose as the mobile SDK — and we do not currently show a cookie banner. You can block them in your browser, and deleting your account queues deletion of your PostHog profile. If we add advertising cookies or session replay, we will update this policy and obtain consent where required. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

California

Spoonify does not sell or share personal information for cross-context behavioral advertising as defined by the CCPA/CPRA. California residents can still exercise their other privacy rights described in our Privacy Policy.

We may update this Cookie Policy from time to time as we add features or change providers. When we make material changes we will update the “Effective” date at the top of this page and, where appropriate, notify you in the Service.

Questions about cookies or this policy? Email support@spoonify.dev, or use our contact page.