Privacy Policy

Waatokok ("we", "us") operates waatokok.com, an independent, bilingual cooking site developed in Guadalajara, Jalisco, Mexico: reviewed recipes, tools that help you cook with what you have, estimated ingredient costs, where to buy ingredients, and official food-safety notices (WaatoSafe). This policy explains what information we collect, how we use it, and the choices you have.

Account information: your name, email address, and a securely hashed password when you register. We never store your password in plain text.

Content you submit: recipes, photos, ratings, and comments you post.

Recipe views: to count a view at most once per network, per recipe, per day (UTC), we compute a code from your IP address, the recipe, the date and a random key that changes every day, using a secret key. Your IP address is used only for that calculation; this feature doesn't store it. Requests from bots, and requests that don't identify a browser, aren't counted. The codes and each day's random key are deleted by a cleanup that runs during our daily scheduled tasks and, at times, when a view is counted. A day's records are deleted only after that day has ended, usually during the following day, but we don't promise a fixed deadline, because the cleanup depends on those tasks running. Once a day's random key is deleted, the link between that day's codes and an IP address can no longer be reconstructed through this view-counting mechanism alone; this doesn't, by itself, make a visit anonymous with respect to other information.

Earlier recipe-view records: until October 14, 2026, we counted views differently. For each recipe viewed, we stored a version of the visitor's IP address processed with a hash function without a secret key (SHA-256), together with the recipe and the date. Because no secret key was used, these values can in principle be matched to an IP address by testing possible addresses. These historical records are no longer created, but they are still stored and will be deleted in a separate cleanup for which we haven't set a date.

Abuse protection (rate limits): to limit repeated or automated use, we keep counters for signing in, registering, resetting or changing a password, verifying an email address, commenting, rating, submitting recipes, uploading photos and loading the recipe list. Each counter is identified by a code derived from your IP address with a secret key, separate for each purpose, and never by the IP address itself. For a rating without an account there is also a counter based on a code derived from the anonymous rating cookie, and for “Near me” the counter is based on a code for an area of about 1 km around the location you shared, not your exact coordinates. Some counters for actions you take while signed in also include your account identifier. A counter stores only that code, a number of attempts and when its time window ends. There is currently no general process that automatically deletes expired counters, so they can remain stored in our database with no set deletion date.

Site analytics: we use Google Analytics to understand how the site is used overall — which pages and recipes get visited, on what kind of device, and roughly from where. Google Analytics sets its own cookies and processes this data on our behalf. We do not intentionally use your Waatokok account identifier as the Google Analytics user identity.

Visit counts: separately from Google Analytics, we keep a simple count of visits over time using a randomly-generated, anonymous session identifier and timestamps. This isn't derived from your IP address, isn't linked to your account, and doesn't record which pages you viewed.

Ratings without an account: if you rate a recipe without logging in, we set a random, anonymous cookie on your device so a repeat rating from the same browser updates your existing rating instead of creating a new one. This identifier isn't your name, email, or IP address, isn't linked to any account, is never shown publicly, and isn't used for anything else.

Searches we couldn't match: when a recipe search or a pantry ingredient doesn't match anything in our catalog, we may save that search text so we know what to consider adding. We don't save who searched, your account, or your IP address alongside it.

Approximate location for WaatoSafe: to show the official food-safety notices that apply where you are, our hosting provider (Vercel) tells our server the country and first-level region (for example, a Mexican or U.S. state) associated with your IP address on each request. We use only those two values, only for that request, to decide which notices apply and to suggest a language once. We don't store them, your IP address, or any coordinates, and this never uses your device's precise location.

A location you choose in WaatoSafe: if you pick a location yourself, we save only the country, state and (optionally) city codes you chose, in a cookie on your device (ws_loc) for up to one year, so the same notices keep applying. It isn't linked to your account, and you can change it or go back to approximate detection at any time. Choosing a location never changes your language, and choosing a language never changes your location.

WaatoSafe interactive map: when it's available and you open it, your browser downloads the map images (tiles), fonts and symbols from our map server, tiles.waatokokmaps.com, which we operate on Cloudflare. Like any web server, it receives your IP address and ordinary technical details from your browser, and the tiles requested approximately reveal the area of the map you're viewing. That server sets no cookies, receives no account information, and we don't enable request logging for it; Cloudflare processes those requests to deliver them. The map library itself loads from waatokok.com. Map data comes from OpenStreetMap (via Protomaps), INEGI and the U.S. Census Bureau.

Device location on the WaatoSafe map (optional): only if you tap “Use my location” on the interactive map do we first explain how it's used, and only if you then tap “Allow location” does your browser ask your permission. If you allow it, your location is read once (we don't track it in the background) and the precise location stays on your device: it isn't sent to any server, isn't saved in cookies or browser storage, and is never put in web addresses, analytics, logs or community reports. To identify your municipality or county, your browser downloads a general file covering an area of roughly 100 km (1 degree) from our map server and does the matching on your device. When the map centers on your location, the tiles requested are for that area, so the map server can infer your approximate area (on the order of a few kilometers), just as with any area you view on the map. If you're near a boundary we say so instead of guessing, and if we can't load that data we tell you so: we never treat it as if you were outside coverage. “Stop using my location” clears it from the page, and it's also cleared when you leave or reload.

Language suggestion: on a first visit, if the language of your approximate country differs from the page's (for example, a U.S. visitor on a Spanish page), we may suggest the other language once. Your answer is saved in the language-preference cookie; we never switch the language for you automatically.

Cookies and similar storage: cookies to remember your language preference (up to one year) and the visual theme you chose (NEXT_THEME, up to one year), a cookie for a WaatoSafe location you choose (ws_loc, up to one year), a session cookie to keep you logged in (it expires after 30 days without activity), a cookie for our own visit counts (up to 400 days, renewed on each visit), a cookie for an anonymous rating (described above; up to 180 days), and cookies set by Google Analytics. In your browser's own storage we also keep a draft of a recipe while you write it (local storage, removed when you save the recipe or discard the draft) and your position in the recipe list for the current tab (session storage). If advertising is enabled on the site, Google and its advertising partners may also set cookies and use similar storage — see "Advertising" below.

Location for “Near me”: only if you tap “Near me” in a recipe’s “Where to buy” panel, your browser asks your permission to share your location. If you allow it, your device’s coordinates are sent to our server and on to Foursquare for that lookup, to find nearby shops. We do not store your coordinates in our database and do not put them in our logs; there is no location saved to your account.

To operate your account: authenticate you, let you submit and manage recipes, and send you transactional emails (email confirmation, password reset, and a welcome message).

To improve the site: view counts help us understand which recipes are popular, and unmatched searches help us decide which recipes or ingredients to add next.

To protect the site: the rate-limit counters described above are used only to limit repeated or automated attempts.

To show relevant food-safety notices: WaatoSafe uses your approximate or chosen location only to decide which official notices apply to you. If you use your device's location on the interactive map, it's used only on your device to show where you are and what information applies to your area.

To translate content: recipes are written in Spanish. On the English version of the site (addresses starting with /en), recipe text is machine-translated with DeepL so you can read it in English; the translation may contain errors, and the original Spanish recipe is always available.

We rely on a few service providers, each of which processes data only as needed to provide their service to us: Vercel (hosting; it also provides the approximate country/region used by WaatoSafe, described above), Resend (transactional email such as password resets and confirmations), DeepL (machine translation of recipe text), Microsoft Azure (database hosting and storage of uploaded recipe photos), Google Analytics (site-usage measurement, described above), Cloudflare Turnstile (a bot check on the sign-up and password-reset forms), Cloudflare (hosting for our WaatoSafe map server, tiles.waatokokmaps.com, described above), and OpenAI (an automated check of new comments for offensive content before they post — the comment text is sent to OpenAI for that check), and Foursquare (finding shops near you when you use “Near me” — your coordinates are sent to Foursquare only for that lookup).

Waatokok may show advertising served by Google AdSense. If advertising is enabled, Google and its advertising-technology partners may use cookies, local storage, and device or online identifiers to serve and measure ads and, where consent or applicable settings allow, to personalize them. Before personalized advertising is enabled for visitors in regions where consent is required, Waatokok will use the consent controls required for its advertising setup.

You can review Google's advertising practices and your choices at https://policies.google.com/technologies/ads and manage ad personalization at https://myadcenter.google.com.

We keep your account and content for as long as your account is active.

Recipe-view codes are deleted by the daily cleanup described above. These records currently have no automatic deletion: visit records (the random session identifier and when each visit started and was last active), expired rate-limit counters, unmatched search text (with how many times it was searched and when it was first and last seen), and the earlier recipe-view records described above.

If you'd like your account or data deleted, contact us using the details below.

Waatokok is not directed at children under 13, and we don't knowingly collect information from them.

We may update this policy from time to time. The "Last updated" date above reflects the most recent revision.

Questions about this policy or your data? Email us at admin@waatokok.com.