Privacy

Forklet has no ads, no trackers and no third party scripts. We keep what the service needs to work, for as long as it needs it, and nothing else.

Last updated 2026-09-27. Forklet is in private beta; this text is reviewed again before the public launch, and changes are announced by email to account holders.

What We Keep

Your account: email address, username, display name, and your password stored only as an Argon2id hash (or no password at all if you sign in with email links or passkeys).
What you make: recipes, photos, catalogs, shopping lists, profile text and links, and your unit and display preferences.
Security records: your sessions and devices, and sign in and security events with the device name and an approximate region (a city or country). We do not store IP addresses in the database. Security events are deleted after 90 days.
Two step verification: the secret of your authenticator app (encrypted), passkey public keys, and recovery codes stored only as keyed hashes.

Photos

When you upload a photo, all its metadata (including camera and location data) is removed and it is saved in several sizes. The original file is not kept.

Cookies and Browser Storage

Session cookie (__Host-fk_s): keeps you signed in, for up to 30 days of inactivity; a short lived one (2 hours) protects forms when you are signed out.
Trusted device cookie (__Host-fk_d): set only when you tick Remember This Device, for up to 400 days, so two step verification is not asked every time.
Browser storage: the lines you checked off, your unit choice, make or buy and substitute choices, timers, and shopping list changes made offline. These stay in your browser and are never sent to us unless you save them.

There are no analytics, advertising or social media cookies, and no fonts or scripts loaded from other companies.

Who Else Sees Data

Cloudflare sits in front of the site to protect it from attacks and serve it quickly. It processes your IP address and the pages you request to do that.
Have I Been Pwned: when you choose a password we check it against known breaches by sending only the first 5 characters of its SHA-1 hash, never the password.
Websites you import from: when you import a recipe link, our server fetches that page. The website sees our server, not you.
Email is sent from our own mail server. We do not sell or share data with anyone else.

Logs and Backups

The web server logs requests (IP address, page, browser) for security and debugging; these logs are deleted after 14 days. The database and photos are backed up nightly; backups are kept for up to five weeks, so deleted content can remain in a backup for that long before it is gone for good.

Who Can See Your Recipes

Everything starts private. Recipes and catalogs you share by link can be opened by anyone with the link but are not listed or indexed; public ones appear on your profile and in search engines. Your profile shows only public recipes and catalogs.

Your Choices

Export: download everything you made as a ZIP (recipes as JSON and Markdown, photos, catalogs, lists, profile) from My Recipes, any time.
Correction: edit your profile, email and recipes in Settings.
Deletion: delete your account in Settings, Account. After a 30 day grace period (signing in cancels it) your account, recipes, photos, catalogs and lists are removed. Published recipes that other people include in theirs are kept as text on their pages, marked as no longer available; your username stays reserved so nobody can take it over. Backups follow within five weeks.

Age

Forklet is for people aged 13 and older.

Contact

Questions about privacy: [email protected].