Privacy

Without an account

The calculators need no account, and what you type into them stays in your browser's own storage on your device. When you copy a recipe or its link, the recipe is kept on our server so that its link can be short: its ingredients, figures and name, with nothing about who you are. Anyone with the link sees it. Cloudflare, which hosts the site, counts page views without cookies and without identifying you, and keeps the logs a web server keeps. If you allow it, Google Analytics counts your visit too, as the next part says. A script error in your browser is reported to us without your IP address, so we can fix it.

If you rate a calculator, we keep the stars, the page's language and a scramble of a random number your browser made, so that choosing again replaces your first rating; your browser keeps the number and your choice. Nothing else about you is kept with it. On this site the rating is checked by Cloudflare Turnstile, which looks at your browser to tell people from bots, as sign-up is.

Analytics

We use Google Analytics to see which pages and tools get used, where visitors come from, and how many of them sign up or buy a plan. It sets two cookies, _ga and _ga_5ZTFFX6PWJ, holding a random number for your browser, kept for up to thirteen months. It tells Google the page you open and its title, the page you came from, your browser, device, screen size and language, whether you are signed in, and the rough location Google works out from your IP address, which Google does not keep. A page's address goes without anything after the ? except a link's campaign tags, and a shared recipe's link goes without its key. It also tells Google when you get a result from a calculator, save, publish, export, share or import a recipe, log a batch, ask the assistant, rate a tool, change the language, sign up or sign in (and whether with a password, a passkey, a mailed link, Google, Apple or Facebook), are shown a plan or open one, start or finish buying a plan (the plan and its price, never your card), or join the launch list. It never sends what you type into a tool, what is in a recipe, or your email address. Google signals and Google's advertising features are off, so none of it is used to show you ads or to follow you to other sites.

If your device is set to a European time zone, and on every page not in English, nothing from Google loads until you choose Allow. Elsewhere it loads unless you have said no, and a browser that sends Global Privacy Control has said no. You can change your answer at any time with "Cookie settings" at the foot of every page; saying no stops it straight away and deletes the cookies. Your answer is kept in your browser for thirteen months, and then you are asked again. Google handles this data for us under its data processing terms, in the United States among other places, and keeps it for up to fourteen months.

The phone app

The soapformulator app for Android and iPhone keeps your recipes, batches and settings on your phone. It has no analytics, no advertising and no advertising id: nothing in it counts what you do or reports it to us or to anyone else. Cure reminders are notifications your phone schedules itself. Without an account the app talks to us only when you share a recipe, which is kept as "Without an account" says, or open one someone shared.

An account is optional. You sign in on this site, in your phone's browser, and the app is given a key to your account, which it keeps in your phone's secure storage and never in a backup or an export, with your account's id, public name, page address and email address. While you are signed in, the recipes on your phone and on your account are kept the same both ways, so a recipe you make in the app is kept with your account as one saved on the site is. Batches stay on the phone. Signing out leaves everything on the phone. You delete your account on this site, linked from the app's Settings.

A plan bought in the app is sold by Google Play or the App Store, which take the payment under their own privacy notices; we never see your card. If you are signed in, the app sends us the store's id for the purchase, which we check with Google or Apple, and a random id that ties the purchase to your account and says nothing else. Bought while signed out, nothing about the purchase leaves your phone.

With an account

We keep your email address, a scramble of your password (the password itself never leaves your browser), a scramble of your recovery code, the country the sign-up came from, the public name you chose and its page address, and what you save: recipes, batches, photos, fragrances, stock, products and the rest. Two cookies keep you signed in; neither tracks anything. We keep no IP address and no browsing history. Sign-up is checked by Cloudflare Turnstile, which looks at your browser to tell people from bots.

A saved recipe's notes and photos are part of it: anyone with the recipe's link sees them, as they see the recipe. Photos are kept without the place they were taken or the camera details, and only a signed-in owner adds or removes them. They go when the recipe is deleted, and with your account even if you choose to leave your recipes behind for their links.

Signing in without a password

You can sign in with a passkey, with Google, Apple or Facebook, or with a link we email you. For a passkey we keep its public half, the kind of device it was added from and when it was last used; the private half never leaves your device. Google, Apple and Facebook tell us your email address, your name and their own id for you. We keep the id so we know you next time, and a new account starts with the name as its public name, which you can change. We ask them for nothing else and post nothing anywhere.

While you are signed out, Google may offer to sign you in with your Google account in a small box at the top of the page. It comes from Google's own sign-in script, which loads by the same rule as Google Analytics above: where you are asked first, only after you choose Allow, and never after you say no. Loading it lets Google know you opened a page here. Nothing about you reaches us unless you choose to continue, and then it is what the paragraph above says. Closing the box keeps it away for a while, and longer each time.

Teams and API keys

On Business, the owner of an account can invite up to four people by email. The owner sees their addresses and roles, and a log of what each person changed in the workspace and when; the people invited see the owner's address. An API key is kept as a scramble, with the name its owner gave it and when it was last used, and reads only the account it belongs to.

Payments

Plans are sold by Paddle, which is the merchant of record: Paddle takes the payment, keeps your card and billing details, charges tax and sends the receipt, under its own privacy notice. We receive your plan, its status and dates, and Paddle's ids for your customer record and subscription. We never see your card.

Email

We send email only if you switch it on in your account, and only once you have confirmed the address: a note when a batch has finished curing, a notice before a yearly plan renews or a trial ends, and reminders of regulatory dates in the markets you choose. If you switch it on on "Your page and privacy", we also write about your page, your recipes and your messages: who made, remixed or wrote on one of your recipes, who followed you, asked to be friends or wrote to you, and what the makers you follow published, each right away, in a Monday digest or never, as you choose. Such a mail says who wrote to you, never what they wrote. A password reset or sign-in link goes to your address only when you ask for one, and a team invite only when a team's owner sends it. It is all sent through Amazon SES, and every notice has a one-click unsubscribe. There is no newsletter unless you ask for the launch list. Amazon SES tells us what became of each mail (delivered, bounced, or marked as spam), and we keep that with the address and the subject for a year, so we stop writing to an address that does not work. Mail you send to one of our addresses is received by Amazon SES and kept in Amazon S3, in the United States, until we delete it. A message sent with the contact form reaches us the same way, as a mail from the site to our support address: what you wrote, the topic, the name and address you gave, the page you came from, your country and, if you are signed in, your account's id and address. On this site the form is checked by Cloudflare Turnstile, as sign-up is. Nothing is sent to the address you give except our reply.

The assistant

When you ask the assistant a question, the question, the recipe or text it is about, and any photo you add are sent to Anthropic, whose model writes the answer. Anthropic does not train its models on what is sent this way. We keep a count of how many questions you asked each month, for the allowance your plan has, and not the questions themselves.

Community recipes

What you publish there is public, and search engines can index it: the recipe's formula, the title, description and tags you give it, the licence you choose for it, your notes and comments on other makers' recipes and the photos with them, and the public name and line about yourself that they are signed with. A recipe you save while signed in goes there only if you choose Public when you save it. Your email address is never shown. When someone saves a copy of a published recipe, the recipe counts it, and not who they are. A photo is published without the place it was taken or the camera details that a phone writes into the file. A flag you send goes to the moderators without your name. Unpublishing a recipe, deleting a note or a comment, or deleting your account takes them off the site straight away.

Makers' pages, following and messages

A public name gives you a page of your own. It shows what you put on it: the name, a picture, a line about yourself, where you are, how you make soap, your links and languages, and what you have published. You choose whether it shows your plan, your activity, and who you follow and who follows you, and whether people who are not signed in can see it. A picture is kept without the place it was taken or the camera details, and goes when you remove it. We keep who you follow, your friends, and who you have muted or blocked; nobody is told when you mute or block them.

Your page also shows the stamps you have earned. They are worked out from what is already public: your published recipes, the notes, remixes and answers on them, and your notes on other makers' recipes. Stamps for the batches you log, and what is curing on your rack (a batch's name, when it was made and when it is ready, never its quantities, costs or lot codes), show only if you switch on "On the rack". To show makers whose soap is close to yours we keep the average fatty acids of your published recipes, and nothing unpublished goes into it. A challenge entry is one of your published recipes and stays public as long as the recipe does. When a recipe's maker thanks you for a note, that shows on the recipe. The market card is drawn in your browser from your public name and page, and nothing about it is kept.

A list you make of recipes you want to come back to is yours. It shows on your page only if you switch on "Your lists", and a list you mark "Only me" never does. Nobody is told when their recipe goes in someone's list, and a recipe that is unpublished leaves every list it was in.

Messages are between the two makers in a conversation and are never published. Nobody else reads them unless one of you reports the conversation; a moderator can then read it until the report is dealt with. Nothing tells either of you whether a message has been read. A recipe you attach is sent as its link, which lets the other maker open it. Deleting a conversation hides it from you and not from the other maker; deleting your account deletes all your conversations, for both sides.

Deleting your account

Sign in on soapformulator.com, open your account page and go to "Delete this account" at its foot; in the phone app, Settings, Delete account takes you there. Choose what happens to the recipes you saved: deleted with the account, or kept without your name so the links you shared keep working. Then confirm. It happens straight away and cannot be undone. Everything else we hold about you goes with it: your email address, sign-in details, batches, photos, stock, messages, your page and the record of the mail we sent you. Mail you wrote to us is kept as correspondence. A plan bought through Google Play or the App Store is not cancelled by deleting the account, so cancel it there first. If you cannot sign in, write to support@soapformulator.com from the account's address and we will delete it for you.

To delete only part of it and keep the account, delete that thing where you see it: a recipe, batch, photo, note, conversation or anything else you saved goes from our server as soon as you delete it, on the site or, for a recipe, in the app while you are signed in.

How long, and your rights

We keep your account until you delete it; deleting it deletes everything we hold about you, straight away, including photos and the record of the mail we sent you. Mail you wrote to us is kept as correspondence. You can export all of it from your account page at any time. You have the right to see, correct, take away and delete your data, and to object to how it is used; write to support@soapformulator.com, and you may complain to your data protection authority. Data is handled in the European Union, the United States and wherever Cloudflare serves the site from, by the companies named here, under their data protection terms.

What we do not do

No advertising, no tracking across sites, no selling or renting data, and nothing shared with anyone not named on this page.