Cookie policy
The short version
- Reading DupeEats sets no cookies and stores nothing on your device.
- Something is stored only when you do something that needs it, like voting, saving a recipe or filling in a form.
- Most of it stays in your browser and never reaches us.
- That’s why there’s no cookie banner: the law doesn’t require consent for storage that is strictly necessary or that you ask for.
- If we show ads, we’ll ask before any advertising cookies are set wherever the law requires it, and you can change your mind at any time.
- We honor Global Privacy Control.
What we store on your device
A cookie is a small file a website saves in your browser and gets back with each visit. Local storage, session storage and IndexedDB are similar places in your browser where a website can keep data; unlike cookies, they are never sent to us on their own. Session storage is wiped when you close the tab.
We group everything by why it exists:
- Strictly necessary
- Needed for security or for something you asked for, such as casting one vote per device.
- Functional
- Remembers a choice or a feature you used, such as your saved recipes or your units. It is created only by your own action.
- Analytics
- Helps us count visits. We use only tools that set no cookies and store nothing on your device.
- Advertising
- Used to show and measure ads. Only when ads are on, and only with your consent where the law requires it.
This is the complete list. Nothing on it is set when you only read a page. Cloudflare’s security cookie can appear on any page, but only when it sees unusual traffic.
Strictly necessary
| Name | Type | What it’s for | When it’s set | How long |
|---|---|---|---|---|
de_vid | Cookie | A random, signed device ID. It lets each device vote once, keeps abuse limits working and makes blocks stick. It contains no personal details. HttpOnly, Secure, SameSite=Lax. | When you vote, rate a copycat, start a debate, add a photo to a form, send a dupe or a photo, report something or make a privacy request. Never when you only read. | 400 days |
Cloudflare Turnstile | Third-party service · Cloudflare | A privacy-friendly check that you are a person, not a bot, loaded from challenges.cloudflare.com. It reads signals from your browser inside its own frame; it does not show ads or track you across sites. | Only when you tap or type in something we protect (a vote button, a form, a report or a sign-up). Never when you only read or scroll. | Set by Cloudflare for the check |
__cf_bm | Cookie · Cloudflare | Bot protection by our network provider (__cf_bm, and cf_clearance after a security challenge). | Only if Cloudflare detects unusual traffic or shows a challenge. | 30 minutes (__cf_bm); as set by the challenge (cf_clearance) |
Functional (set when you ask for something)
| Name | Type | What it’s for | When it’s set | How long |
|---|---|---|---|---|
de_saved | Local storage | The recipes you saved (up to 100 recipe IDs). Stays on your device. | When you press Save on a recipe. | Until you remove it |
de_voted | Local storage | Which side you picked in each debate (up to 200), so the page shows your vote. Stays on your device. | When you vote in a debate. | Until you remove it |
de_rated | Local storage | Your copycat ratings on this device (up to 200), so the page shows them back to you. | When you rate how close a copycat is. | Until you remove it |
de_region | Local storage | Your region (US or UK) for prices and local menu names. | When you choose a region. | Until you change it |
de_units | Local storage | Your units for recipes (US cups or metric). | When you choose units on a recipe. | Until you change it |
de_cook_* | Local storage | The ingredients and steps you ticked while cooking a recipe (one key per recipe). | When you tick an ingredient or a step. | Until you untick everything |
de_quiz_mine | Local storage | Your latest result for each quiz, so you can see it again. | When you finish a quiz. | Until you remove it |
de_quiz_progress_* | Session storage | Your answers so far in a quiz, so a reload does not lose them. | While you take a quiz. | Until you close the tab |
de_quiz_done | Session storage | Shows your result straight away after you finish a quiz. | When you finish a quiz. | Until you close the tab |
de_submit_draft | Local storage | A draft of your "Submit your dupe" form (including the email you typed, and the temporary code that links the photos you already uploaded), so you can finish later. It is not sent to us until you press Send. | When you type in or change the "Submit your dupe" form. Never when you only open it. | Up to 14 days; deleted when you send it or press Start over |
dupeeats | IndexedDB | Database "dupeeats", store "submit_photos": the already-shrunk photos of your unsent draft. | When you add photos to a "Submit your dupe" draft. | Up to 14 days; deleted when you send the draft or press Start over |
de_cook_profile | Local storage | Your display name, credit choice and social handle (never your email), to prefill your next dupe or photo. | After you send a dupe or a photo. | Until you remove it |
YouTube (youtube-nocookie.com) | Third-party service · Google (YouTube) | Plays a recipe video. The player loads only after you press play, in YouTube's privacy-enhanced mode; from then on, YouTube may store cookies or data on your device under Google's privacy policy. | Only when you press play on a video. | Set by YouTube |
Analytics
| Name | Type | What it’s for | When it’s set | How long |
|---|---|---|---|---|
Cloudflare Web Analytics | Third-party service · Cloudflare | Counts page views in aggregate. Uses no cookies and no browser storage, and does not identify you. | When a page loads. | Nothing stored on your device |
Admin area only (never set for visitors who just read)
| Name | Type | What it’s for | When it’s set | How long |
|---|---|---|---|---|
wordpress_* | Cookie | Sign-in session of the site owner in the admin area (wordpress_logged_in_*, wordpress_sec_*). WordPress also sets wordpress_test_cookie if anyone opens our sign-in page, to check cookies work. | Only when the site owner signs in, or if you open our sign-in page. | Session, up to 14 days |
wp-settings-* | Cookie | Admin screen layout of the site owner (wp-settings-*, wp-settings-time-*). Visitors never get these. | Only when the site owner uses the admin area. | 1 year |
None of this is shared with other websites. Storage in your browser stays there: it reaches us only when you press a button that sends it, such as “Send” on a dupe draft.
Why there’s no cookie banner
EU and UK law (the ePrivacy Directive, Spain’s LSSI-CE art. 22.2 and the UK’s PECR) require your consent before a website stores or reads anything on your device, except when it is strictly necessary for a service you asked for. Everything above is either strictly necessary or created by your own action, such as voting, saving a recipe or choosing your units. So there is nothing to ask consent for yet, and we’d rather not interrupt you with a banner that does nothing.
Automatic tests in our code fail if anyone adds a new cookie or storage key without listing it on this page, or if anything is stored or loaded from another website while a page is only being read.
Third parties
- Cloudflare Turnstile (from
challenges.cloudflare.com) loads only when you tap or type in something we protect from bots, such as a vote button, a sign-up or a form. It never loads while you just read or scroll. It checks that you are a person and doesn’t show ads or follow you across sites. - YouTube: recipe videos load only when you press play, in YouTube’s privacy-enhanced mode (
youtube-nocookie.com). Until then, nothing from YouTube loads. After you press play, YouTube may store cookies or data on your device under Google’s privacy policy. - Cloudflare delivers our pages and protects them from attacks. It may set a short-lived security cookie (
__cf_bm, orcf_clearanceafter a challenge) only when it sees unusual traffic. Cloudflare Web Analytics counts visits without cookies and without storing anything on your device. - Share buttons are plain links. Nothing from a social network loads until you click one.
- Our fonts and images are served from our own site. We don’t use Google Analytics, Facebook pixels or any other cross-site tracker.
Consent for ads
We don’t show ads yet. When we start, we’ll use Google’s free, certified consent tool before any advertising cookie is set, and we’ll update this policy first. This is how it will work:
- In the European Economic Area, the UK and Switzerland, a message asks you first. “Consent”, “Do not consent” and “Manage options” are all on the first screen, and saying no is as easy as saying yes. No advertising cookies are set until you choose. If you say no, you may still see ads, but they won’t be based on your browsing.
- In US states with privacy laws, you can opt out of the “sale” or “sharing” of your data for ads from a message or from Your privacy choices. A Global Privacy Control signal counts as that opt-out (see below).
- Everywhere else, you can turn off personalized ads at any time in Google’s Ads Settings or at aboutads.info.
- Your choice is saved in a cookie on your device, so we don’t ask again on every page. We ask again at least every 13 months, or sooner if what we ask for changes.
Global Privacy Control and Do Not Track
Global Privacy Control (GPC) is a setting in some browsers and extensions that tells websites you don’t want your data sold or shared. If your browser sends it, we treat it as a valid request to opt out of the sale or sharing of your personal data and of targeted advertising, for that browser. Today there is nothing to switch off, because we don’t sell or share your data.
Do Not Track is an older browser signal with no agreed standard, so websites read it in different ways. We don’t track you across other websites anyway, whether or not you send it.
Your choices
- Clear what we stored: in your browser settings, look for “Site data”, “Cookies and site data” or “Storage” and delete the data for DupeEats. Your saved recipes, settings, quiz results and drafts will be gone, and your votes will no longer be linked to your device.
- Block cookies or storage: you can block them in your browser settings. DupeEats stays readable, but some things won’t work: you can’t vote, rate or send anything without the
de_vidcookie, and saved recipes, preferences and drafts won’t be remembered. - Private browsing: everything is deleted when you close the private window.
- Your personal data: to get a copy of it or delete it, see Your privacy choices. Our Privacy policy explains everything else.
Changes to this policy
When we add, change or remove something we store, we update the table above and the version and date at the top of this page, and from then on list earlier versions at the bottom. Before we turn on ads, we’ll update this policy with the exact cookies our ad partners use.