Privacy policy

Who we are

This policy explains how DupeEats handles personal data when you use the Services: the website at dupeeats.com, The Friday Drop newsletter and our other emails, and the DupeEats accounts on social media.

The data controller, the one who decides how your data is used, is:

Controller

DupeEats, run by the sole trader identified in our Legal notice (name, tax ID and postal address), based in Spain

Email

dupeeats@gmail.com

DupeEats is run by one person as a sole trader, not by a company. The controller is also our privacy officer: write to dupeeats@gmail.com about anything in this policy. We haven’t appointed a data protection officer because the law doesn’t require one for a service like ours.

Because we’re based in Spain, the EU General Data Protection Regulation (GDPR) and Spanish data protection law apply to everything we do with personal data, wherever you live. If you’re in the UK, the UK GDPR also applies. If you live in the United States, Canada, Australia, New Zealand or Switzerland, the sections US state privacy rights and Other countries add what your local law gives you.

“DupeEats”, “we”, “us”, “you”, “Services”, “Content” and “Community Content” mean the same as in our Terms of use.

What we collect and why

We collect as little as we can. You don’t need an account, and reading DupeEats sets no cookies and stores nothing on your device. Except for copyright notices and counter-notices, where the law requires them, we never ask for your real name, phone number, home address, date of birth or payment details. We don’t collect health or diet information or any other sensitive data, and we don’t follow you around other websites.

For each feature, here is what we collect, why, the legal basis under EU and UK law, and how long we keep it. The exact periods are in How long we keep data.

Votes and ratings

• What: a random device ID kept in a cookie (de_vid), your choice or rating, the date, and the country your connection comes from. We read the country from our network provider; we don’t store your IP address with your vote. Each vote is saved with a code that is different for every debate and recipe, so your votes can’t be linked to each other.
• Why: to count one vote per device, show results, build country rankings and stop vote rigging.
• Legal basis: our legitimate interest in fair, honest results (GDPR art. 6(1)(f)). The cookie is strictly necessary for the vote you asked to cast.
• How long: results stay. The link between your votes and your device ends when the cookie expires (400 days) or when you clear it.

Debates you start

• What: the text of the debate (it will be public), a one-way hash of your device ID, the results of our automatic checks, and the version of the Terms of use you agreed to.
• Why: to check the debate against our rules, publish it and stop abuse.
• Legal basis: our agreement with you to publish it (art. 6(1)(b)) and our legitimate interest in keeping DupeEats safe (art. 6(1)(f)).
• How long: as long as the debate is online. A debate nobody decided on is closed after 60 days. A debate we don’t publish is deleted, with the hash of your device, 30 days after we decide.

Quizzes

• What: your answers are sent to us only to work out your result. We don’t store them. The link to your result contains only the result. We keep anonymous counters, such as how many people finished a quiz and how results split. Your latest result is saved on your own device.
• Why: to give you your result and show how others did.
• Legal basis: providing the quiz you asked to take (art. 6(1)(b)).
• How long: we keep nothing personal.

The Friday Drop newsletter

• What: your email address; your status (waiting for confirmation, subscribed, paused or unsubscribed); your region (US or UK); where on the site you signed up; the consent text version you agreed to and when; when you confirmed; one-way hashes of the private links in your emails; a hash of the IP address you signed up from; your preferences; delivery records; bounces and spam complaints; and which links you click in each issue.
• Why: to send you The Friday Drop and, now and then, news about DupeEats, including DupeEats Insider; to keep the list healthy; and to make sure we never email someone who left.
• Legal basis: your consent (art. 6(1)(a)), given with a double opt-in: nothing is sent until you click the link in our confirmation email. Counting link clicks and keeping a do-not-email list are based on our legitimate interest (art. 6(1)(f)) in a healthy list that people actually want.
• No tracking pixels: we count clicks on links, never opens.
• How long: unconfirmed sign-ups are deleted after 30 days. If you stop clicking for 12 weeks, we ask once whether you still want the newsletter, and unsubscribe you quietly 4 weeks later if you don’t click. When you unsubscribe, we delete your record 30 days later.
• Your choice: every email has a one-click Unsubscribe link and a Settings link. Unsubscribing withdraws your consent and is immediate.

We don’t offer paid plans yet.

Dupes and photos you send

• What: the recipe and photos you send, the display name, credit choice and social handle you pick, your email address if you give it, one-way hashes of your email, device ID and IP address, your answers to the consent boxes, the version of the Community content license you accepted and a fingerprint of its text, a reference code, and our moderation notes. Before storing a photo we remove its location and camera data and re-encode it.
• Why: to check what you send, publish it with the credit you chose, share it on our social accounts as the license allows, tell you what happened, and stop abuse.
• Legal basis: our agreement with you under the Community content license (art. 6(1)(b)), our legitimate interest in moderating and preventing abuse (art. 6(1)(f)), and your consent if you tick the newsletter box (art. 6(1)(a)).
• What is public: only the recipe, the photos and the name or handle you chose to show. If you choose to be credited, your name may also appear on a cook page listing what you shared. Your email address is never public.
• How long: your email address and network hash are deleted 30 days after we decide. Submissions nobody decided on are closed after 60 days. If we don’t publish something, its photos are deleted after 7 days and the rest after 30 days. Photos uploaded but never sent are deleted after 2 hours. Published content stays until you ask us to remove it, and so do the one-way hashes of your email and device on it, so we can find it if you ask us to delete it and keep abuse bans working.
• Proof of the license: for published content we keep a short record of the license (reference, license version, text fingerprint, date and credit choice, with no name or email), for the 5,000 most recent submissions, even after you delete your email, so we can show we had permission.

Photos on DupeEats that don’t come from the community are free-license stock photos or clearly labeled AI-generated illustrations. See Photo credits.

Reports and legal notices

• What: the reason, your details, the content you reported, your name and email address (required for copyright notices, optional otherwise), the statements you confirm, and one-way hashes of your email, device ID and IP address.
• Why: to handle notices as the EU Digital Services Act, the UK Online Safety Act and the US Digital Millennium Copyright Act require, to tell you what we decided, and to stop the report tool being abused.
• Legal basis: our legal obligations (art. 6(1)(c)) and our legitimate interest in a safe service (art. 6(1)(f)).
• Who sees it: when we restrict content after a report, we tell the person who posted it what was reported and why, but never your email address. For copyright notices this can include the name of the rights owner. If they send a counter-notice, US law requires us to send it to you.
• How long: your name, email and IP hash are deleted 30 days after we decide (or after 90 days if the report is still open). For a copyright notice whose content stays down, we keep your name and email until the content is restored or deleted, at most 3 years, so we can forward a counter-notice. The report itself is deleted after 365 days.
• Counter-notices: your name, postal address, phone number and statements. We forward them in full to the person who sent the original notice, who may be outside the EU, because the law requires it (GDPR art. 49(1)(e), legal claims). We keep them in our inbox for 2 years after the matter is closed.

Privacy requests

• What: your email address and a one-way hash of it, what you asked for, any details you add, a single-use confirmation link, and a one-way hash of your device ID (the de_vid cookie is set when you send the form) to stop the form being abused.
• Why: to confirm the request comes from you, carry it out and keep proof that we did.
• Legal basis: our legal obligation to handle your rights (art. 6(1)(c)).
• How long: requests never confirmed are deleted after 48 hours. Your email is deleted 30 days after we finish, and the record that we handled the request after 365 days. So that we never email you again by mistake, we keep a one-way hash of your email address on a do-not-contact list.

Emails you send us

• What: your email address, your name if you give it, and your message.
• Why: to reply, fix mistakes, and handle legal notices and requests from authorities.
• Legal basis: our legitimate interest in answering you (art. 6(1)(f)), or a legal obligation when the email is a legal notice or request (art. 6(1)(c)).
• How long: we delete emails 2 years after the matter is closed, at our yearly inbox clean-up. Our inbox is provided by Google (Gmail).

Security and anti-abuse

• Bot checks: before a vote, a copycat rating, a new debate, a newsletter sign-up, a submission, a report or a privacy request, Cloudflare Turnstile checks that you are a person. It loads only when you tap or type in one of these, never while you just read. It reads signals from your browser and your IP address inside its own frame and tells us only “pass” or “fail”.
• Abuse limits: to stop spam and vote rigging we keep short-lived counters based on a daily-changing hash of your IP address (IPv6 addresses are grouped by network), your device ID or a hash of your email. They expire within 7 days.
• Blocks: if a device or email address is blocked for abuse, we keep its one-way hash for as long as the block lasts. Blocks for repeated copyright infringement are permanent.
• Server and network logs: our hosting and network providers record IP addresses, browser details, the pages requested and the time, to keep the Services secure and working. They keep these logs for short periods; we choose 30 days or less wherever the provider lets us.
• Backups: we keep rotating backups of our database for recovery. Deleted data disappears from them as they rotate.
• Legal basis: our legitimate interest in keeping the Services and your data secure (art. 6(1)(f)).

Cookies and storage on your device

Reading DupeEats sets no cookies. Something of ours is stored on your device only when you do something that needs it: the de_vid cookie when you vote or send something, and preferences, saved recipes, quiz results and form drafts that stay in your browser and never reach us. The full list, and how to clear it, is in our Cookie policy.

Advertising

We don’t show ads yet. This section explains how ads will work when we turn them on. We’ll update this policy and our Cookie policy before the first ad appears.

When ads are on:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.
• You can opt out of personalized advertising by visiting Google’s Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalized advertising at aboutads.info or, in Europe, youronlinechoices.eu.
• Learn how Google uses information from sites that use its services.

Your consent: in the European Economic Area, the UK and Switzerland, a message from Google’s certified consent tool asks you first, with “Consent”, “Do not consent” and “Manage options” on the first screen. No advertising cookies are set until you choose. If you say no, you may still see ads, but they won’t be based on your browsing. In US states with privacy laws, you can opt out of the “sale” or “sharing” of your data for ads, and we honor Global Privacy Control. Elsewhere, you can opt out at any time with the links above.

Legal basis: your consent (art. 6(1)(a)) where the law requires it. Google acts as a separate controller for the data it collects for ads, under its own privacy policy.

Affiliate links

We don’t use affiliate links yet. When we do, they’ll be clearly marked, and we’ll count only a daily total of clicks, without knowing who clicked or what anyone bought. See How we make money.

We never put affiliate links in our emails.

Who we share data with

We never sell your personal data, and we never rent out or give away our email list. We share data only with the providers below, and only what each one needs. A “processor” works for us, under a contract, and may use the data only on our instructions. A “controller” decides for itself how to use the data it collects, under its own privacy policy.

We also share data when the law requires it, for example with a court or an authority, or to protect people’s safety. If DupeEats were ever sold or transferred, your data would go to the new owner only under this policy, and we’d tell you first.

What you choose to publish, such as a recipe, a photo, a debate or your credit, is public and anyone can see it.

Data outside Europe

We choose providers in the European Union where we can, so most data never leaves it. Some providers, such as Cloudflare and Google, may process data in the United States or elsewhere. When they do, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework and its UK extension) or by standard contractual clauses approved by the European Commission, with the UK addendum where UK law applies. Write to dupeeats@gmail.com for a copy of these safeguards.

How long we keep data

We keep personal data only as long as we need it. These periods come from the same settings our automatic clean-up jobs use, so they are the periods we actually apply:

Published content stays until you ask us to remove it. Anything we must keep for longer to meet a legal obligation, or to establish or defend a legal claim, we keep only for that purpose and only for as long as needed.

Your rights

Under the GDPR and the UK GDPR you have the right to:

• access your data and get a copy of it;
• correct data that is wrong;
• delete your data;
• restrict how we use it while we check a request;
• take your data with you in a common format (portability);
• object to what we do based on our legitimate interests, and at any time to direct marketing;
• withdraw your consent at any time, without affecting what we did before;
• not be subject to decisions based only on automated processing that have legal or similarly significant effects on you (see Automated decisions);
• complain to a data protection authority (see Complaints).

How to use them: go to Your privacy choices, or write to dupeeats@gmail.com. It’s free.

How we check it’s you: we email a confirmation link to the address involved and act only once it is clicked. We never ask for ID documents.

How fast: confirmed deletions run automatically within 72 hours. A copy of your data is emailed to you as soon as you confirm, also as a JSON file you can open or import elsewhere. Anything else gets an answer within one month. If a request is complex we may need up to two more months; if so, we’ll tell you why within the first month.

What we can’t link to you: votes, ratings and quiz answers are tied only to a random device ID, so we can’t find them from your name or email (GDPR art. 11). You control them yourself: clearing your browser data for DupeEats removes the link between your device and your votes.

US state privacy rights

If you live in California or another US state with a consumer privacy law, this section is our notice at collection and explains your extra rights. Some of these laws may not apply to a service our size yet, but we give these rights to everyone.

What we have collected in the past 12 months:

• Identifiers: email address, a random device ID, and hashes of IP addresses.
• Internet activity: votes, ratings, and clicks on links in our newsletter.
• General location: country only, from your connection. We never collect precise location.
• Content you send: recipes, photos, debates, display name and social handle.
• Sensitive personal information: none.
• Inferences or profiles: none.

We collect this from you, from your device and from our network provider, for the purposes described in What we collect and why, and we disclose it only to the service providers in Who we share data with. Retention periods are in How long we keep data.

Selling and sharing: we have never sold personal information for money. We don’t share personal information for cross-context behavioral advertising. We don’t knowingly sell or share the personal information of anyone under 16. We don’t share personal information with third parties for their own direct marketing.

Your rights: to know what we collect and access it, to delete it, to correct it, to get a portable copy, to opt out of its sale, sharing or use for targeted advertising, and not to be treated differently for using any of these rights. We don’t use sensitive personal information, so there is nothing to limit.

How to use them: go to Your privacy choices or write to dupeeats@gmail.com. We answer within 45 days and, if we need more time, tell you why (up to 45 more days). An authorized agent can act for you, as explained in Authorized agents.

Appeals: if we turn down your request, reply to our answer within 60 days with the word “Appeal”. A person will review it and answer within 45 days. If you’re still not satisfied, you can contact your state attorney general.

Other countries

• Canada: our privacy officer is the sole trader identified in our Legal notice, reachable at dupeeats@gmail.com. You can access and correct your data and withdraw consent as described above, and complain to the Office of the Privacy Commissioner of Canada.
• Switzerland: you have the same rights as under the GDPR, and can complain to the Federal Data Protection and Information Commissioner (FDPIC).
• Australia and New Zealand: you can access and correct your data as described above, and complain to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

Children

DupeEats is for people aged 16 and over. Our forms ask you to confirm you are 16 or older, and the Services are not directed at children under 13. We don’t knowingly collect personal data from anyone under 16. If we learn we have, we delete it. If you’re a parent or guardian and think your child has sent us something, write to dupeeats@gmail.com and we’ll delete it.

We keep privacy settings high for everyone: no accounts, no location tracking, no profiling, and no personalized ads without consent where the law requires it. We don’t publish photos in which anyone under 18 can be identified.

Automated decisions

DupeEats runs largely on automatic systems. We use them to:

• check debates, recipes and photos against our rules before they go live (word lists, spam and link checks, duplicate-photo checks and image checks);
• discard duplicate or suspicious votes (we discard duplicates, never opinions);
• hide a photo after several reports from different devices, and take content down as a precaution after a sworn copyright notice, until it is decided.

These systems decide whether content is published and whether a vote counts. They don’t have legal or similarly significant effects on you, and we don’t use them to profile you. You can always ask a person to review a decision: reply to our email or write to dupeeats@gmail.com.

How we protect your data

• The whole site uses HTTPS.
• Instead of raw IP addresses, and wherever we can instead of email addresses, we store one-way hashes made with a secret key.
• The device cookie is signed, so it can’t be forged, and it can’t be read by scripts.
• Photos are stripped of location data and re-encoded. Photos waiting for a decision are kept in a private folder.
• Only the site owner can access the admin area, and our automations never receive more than they need.

No system is perfectly secure. If a data breach puts your data at risk, we’ll report it to the Spanish Data Protection Agency within 72 hours where the law requires it (and to the UK Information Commissioner’s Office when UK residents are affected), and tell you without undue delay if the risk to you is high.

Technical records

To run DupeEats safely on autopilot we keep technical records: a log of admin decisions and settings changes, alert history and records of scheduled jobs. They are designed to contain no personal data, and anything that could identify someone, like an email address, is removed before they are saved. We keep them for up to 365 days (job records for 30 days).

We also keep aggregate statistics with no personal data, such as daily counters by country, quiz counters and rankings. Because nobody can be identified from them, we keep them indefinitely.

Complaints

If you’re unhappy with how we handle your data, please write to dupeeats@gmail.com first. We’ll acknowledge your complaint within 30 days and try to put things right.

You also have the right to complain to a data protection authority at any time:

• in Spain, our lead authority: the Agencia Española de Protección de Datos (AEPD);
• in the UK: the Information Commissioner’s Office (ICO);
• or the authority where you live or work. EU authorities are listed by the European Data Protection Board.

Changes to this policy

When we change this policy, we update the version and date at the top of this page, and from then on list earlier versions at the bottom. If a change matters to you, we’ll mention it in the next issue of The Friday Drop and, where the law requires it, ask for your consent again before using your data in a new way.