Privacy

Without an account

The calculators need no account and send nothing about you anywhere. What you type stays in your browser's own storage on your device. Cloudflare, which hosts the site, counts page views without cookies and without identifying you, and keeps the logs a web server keeps. A script error in your browser is reported to us without your IP address, so we can fix it.

With an account

We keep your email address, a scramble of your password (the password itself never leaves your browser), a scramble of your recovery code, the country the sign-up came from, the public name you chose and its page address, and what you save: recipes, batches, photos, fragrances, stock, products and the rest. Two cookies keep you signed in; neither tracks anything. We keep no IP address and no browsing history. Sign-up is checked by Cloudflare Turnstile, which looks at your browser to tell people from bots.

Signing in without a password

You can sign in with a passkey, with Google, Apple or Facebook, or with a link we email you. For a passkey we keep its public half, the kind of device it was added from and when it was last used; the private half never leaves your device. Google, Apple and Facebook tell us your email address, your name and their own id for you. We keep the id so we know you next time, and a new account starts with the name as its public name, which you can change. We ask them for nothing else and post nothing anywhere.

Teams and API keys

On Business, the owner of an account can invite up to four people by email. The owner sees their addresses and roles, and a log of what each person changed in the workspace and when; the people invited see the owner's address. An API key is kept as a scramble, with the name its owner gave it and when it was last used, and reads only the account it belongs to.

Payments

Plans are sold by Paddle, which is the merchant of record: Paddle takes the payment, keeps your card and billing details, charges tax and sends the receipt, under its own privacy notice. We receive your plan, its status and dates, and Paddle's ids for your customer record and subscription. We never see your card.

Email

We send email only if you switch it on in your account, and only once you have confirmed the address: a note when a batch has finished curing, a notice before a yearly plan renews or a trial ends, and reminders of regulatory dates in the markets you choose. If you switch it on on "Your page and privacy", we also write about your page, your recipes and your messages: who made, remixed or wrote on one of your recipes, who followed you, asked to be friends or wrote to you, and what the makers you follow published, each right away, in a Monday digest or never, as you choose. Such a mail says who wrote to you, never what they wrote. A password reset or sign-in link goes to your address only when you ask for one, and a team invite only when a team's owner sends it. It is all sent through Amazon SES, and every notice has a one-click unsubscribe. There is no newsletter unless you ask for the launch list.

The assistant

When you ask the assistant a question, the question, the recipe or text it is about, and any photo you add are sent to Anthropic, whose model writes the answer. Anthropic does not train its models on what is sent this way. We keep a count of how many questions you asked each month, for the allowance your plan has, and not the questions themselves.

Community recipes

What you publish there is public, and search engines can index it: the recipe's formula, the title, description and tags you give it, the licence you choose for it, your notes and comments on other makers' recipes and the photos with them, and the public name and line about yourself that they are signed with. A recipe you save while signed in goes there too, unless you choose Private when you save it. Your email address is never shown. When someone saves a copy of a published recipe, the recipe counts it, and not who they are. A photo is published without the place it was taken or the camera details that a phone writes into the file. A flag you send goes to the moderators without your name. Unpublishing a recipe, deleting a note or a comment, or deleting your account takes them off the site straight away.

Makers' pages, following and messages

A public name gives you a page of your own. It shows what you put on it: the name, a picture, a line about yourself, where you are, how you make soap, your links and languages, and what you have published. You choose whether it shows your plan, your activity, and who you follow and who follows you, and whether people who are not signed in can see it. A picture is kept without the place it was taken or the camera details, and goes when you remove it. We keep who you follow, your friends, and who you have muted or blocked; nobody is told when you mute or block them.

Your page also shows the stamps you have earned. They are worked out from what is already public: your published recipes, the notes, remixes and answers on them, and your notes on other makers' recipes. Stamps for the batches you log, and what is curing on your rack (a batch's name, when it was made and when it is ready, never its quantities, costs or lot codes), show only if you switch on "On the rack". To show makers whose soap is close to yours we keep the average fatty acids of your published recipes, and nothing unpublished goes into it. A challenge entry is one of your published recipes and stays public as long as the recipe does. When a recipe's maker thanks you for a note, that shows on the recipe. The market card is drawn in your browser from your public name and page, and nothing about it is kept.

Messages are between the two makers in a conversation and are never published. Nobody else reads them unless one of you reports the conversation; a moderator can then read it until the report is dealt with. Nothing tells either of you whether a message has been read. A recipe you attach is sent as its link, which lets the other maker open it. Deleting a conversation hides it from you and not from the other maker; deleting your account deletes all your conversations, for both sides.

How long, and your rights

We keep your account until you delete it; deleting it deletes everything we hold about you, straight away, including photos. You can export all of it from your account page at any time. You have the right to see, correct, take away and delete your data, and to object to how it is used; write to support@soapformulator.com, and you may complain to your data protection authority. Data is handled in the European Union, the United States and wherever Cloudflare serves the site from, by the companies named here, under their data protection terms.

What we do not do

No advertising, no tracking across sites, no selling or renting data, and nothing shared with anyone not named on this page.