Privacy and cookies
Partial information: the privacy contact and legal details still need to be completed.
Data controller
Liliana Bazoli, as confirmed by the site owner. The contact for privacy requests has not yet been provided.
Preferences and reading progress
The lilly-language and lilly-recipe-mode cookies remember the language and kitchen selection for up to 12 months. You can change both using the selectors. The browser stores guest favourites (lilly.favorites.v1), dismissal of the notice (lilly.cookieNotice.v1) and recipe checklist and guided preparation progress (lilly-reading:v1:…). These local entries have no automatic expiry in the application; you can remove them by clearing this site's data in your browser.
Accounts and favourites
Access uses Supabase authentication with email and password or the Google sign-in option through Lovable. A session token is stored to keep you signed in and renewed by the authentication client. Signing out removes the active local session; it does not delete the account or its saved favourites. Signed-in favourites are stored in the database and linked to the account. Each favourite can be removed using its save button. The temporary lilly.auth.next session entry stores the return page during sign-in.
Recipe editing
Authorised editors use the online database and photo storage to save drafts, private revisions and recipe photographs. Published recipe photographs are served through a public access check. Account roles control editing access.
External services
The application uses the Lovable hosting environment and a Supabase backend. Historic photographs are requested from the original WordPress servers; fonts load from Google Fonts. These requests transmit connection data to the service receiving them. Google sign-in involves Google's authentication service if you choose that option. In Lovable preview, authentication storage may be shared with the editor using its preview bridge.
Errors, statistics and advertising
The code contains hooks for reporting runtime errors to Lovable when its reporting interface is present. No advertising or dedicated visitor analytics integration was found in the application source checked during stabilisation. This source check does not establish the hosting provider's full logging or retention behaviour. The notice is informational and does not collect advertising consent.
Information still required
The owner must provide a privacy contact and confirm the legal bases, applicable rights and request procedure, account deletion process, retention periods for accounts, favourites, revisions and service logs, and the providers' contractual roles and any international transfers. These details have not been inferred. This technical information is incomplete and is not a declaration of GDPR compliance; the full notice needs legal review.