Privacy

Your account — your name, your email address, and a one-way hash of your password. We never see the password itself.

Where you came from — if you join the waitlist or create an account, we note the site that sent you (just its name, like news.ycombinator.com, never the page you were on), which of our pages you signed up from, and whatever you wrote in “How did you hear about Buk?” It tells us which posts bring people here. It stays with your account or your waitlist entry, and it's deleted with it.

What you put in — recipes you import, type or photograph, the books you assemble from them, cover images, and the settings that decide how a page looks. Photographs of recipe cards are stored as-is, so if a card has someone's handwriting or a note in the margin, we hold that too.

Ordinary technical records — server logs with IP addresses and request paths, kept short and used for fixing things.

Feedback you send us — the message, plus the page you were on, your plan, and your browser, so we can reproduce what you saw.

When a page breaks — if Buk hits an error in your browser, it tells our server the page you were on, the error and its technical trace, which browser you were using, which version of Buk you were running, and whether the page recovered. That is the whole of it: nothing you had written, nothing you were looking at, and nothing about what you were doing. We keep it for a short while, against your account if you were signed in, so we can find the bug without waiting for someone to describe a blank page to us. If you delete your account, these reports lose the link to it, and they're cleared out after 30 days like any other.

How you use Buk — a short line each time you finish something (a book made, a book organized, a PDF exported), each time a limit stopped you, each time we put a price in front of you, and each time an import failed, plus one row per day you were signed in and doing something. Kept on our own server, against your account. The section below lists every one of them, and what is never in them.

On a server we run in Amazon Web Services' Oregon region, in a Postgres database on an encrypted disk. Your photographs are in that same database rather than a public file store, so there is no shareable URL to leak.

Five companies, and what each one does:

• Amazon Web Services — the server, its storage, and the email Buk sends you: your invitation, password resets.
• Google — the Gemini API reads a recipe or a photo when you import one, and writes the tidied version. We use the paid tier specifically because content sent to it is not used to improve or train Google's models.
• Cloudflare — carries traffic between your browser and our server.
• Purely Mail — our mailboxes. It takes the mail you send us and carries our reply back.
• Paddle — payments, and only if you buy something. Paddle is the merchant of record: your email goes to them so they can send the receipt, and your card details go to them and never to us.

We measure how Buk gets used. We do it ourselves, on our own server. The numbers never leave it, and we will never sell or share them with anyone. Not with an analytics company, not with an advertiser, not at any price. There is no third-party tracker here to hand them to in the first place.

Buk is built by one person, and the plain reason this exists is that we cannot otherwise tell which parts of it work and which ones quietly waste your time. So here is all of it. What gets counted:

• That you finished something — a book created, a book organized, a recipe or a book exported as a PDF, a recipe sent to one of your collection links by a family member, and one of those accepted into a book. Which of those it was, which book or recipe, and when.
• That a limit stopped you — which limit it was, and which plan you were on. This is how we find out we have put a wall somewhere silly.
• That we showed you a price — when an export goes out with the “Made with Buk” stamp on it, we count that, along with which plan you were on. It is the one place we charge for something without stopping you, so it is the one place we cannot tell from a limit whether the price is fair.
• That you opened a checkout — which of the things we sell you went to buy, and which plan you were on. Not whether you finished, and never a card number: the payment processor holds all of that, and we never see it.
• That an import failed — the site's domain (say bbc.co.uk, never the full address), whether you gave us a link, typed text or a photo, and a one-word reason. Recorded the moment it breaks, so it still tells us something after you dismiss the failure.
• One row per day you were active — literally your account number and a date, nothing else. It is how we tell whether people come back, without watching what they do while they are here.
• Plan changes — started, canceled, given for free, a pack bought or expired.

What never goes in: anything you wrote. No recipe, note, title or book content. No photographs. No free text of any kind. Not your name, your email or your IP address. Not the full web address of anything — a domain at most. And nothing that watches you inside a page: no session recording, no screen replay, no heatmaps, no scroll, mouse or keystroke tracking, no fingerprinting, and nothing that follows you to another site. Nothing extra is stored in your browser for any of it.

It sits in the same Postgres database as your recipes, on the same server, read by the same one person. Deleting your account deletes it. See below.

We don't sell your data. Nobody gets it for advertising or for analytics, at any price, and we don't train anything on your recipes. The only companies that see any of it are the five above, each doing the one job listed there. We count how Buk gets used, in the narrow way described just above, and those numbers never leave our server. There is no Google Analytics, no third-party tracker, no advertising pixel and no session recording on this site: nothing follows you around the web, and nothing records your screen. The only things stored in your browser are your sign-in token and your display preferences.

The database is backed up every night. A dump goes to encrypted storage at 03:17 UTC and is kept for 90 days. We have restored one into a scratch database to check that it works, because a backup nobody has restored is not a backup. Your photographs sit in versioned storage, so an overwrite or a misplaced delete can be walked back.

Keep your original cards and printouts anyway. Backups protect you from our mistakes; they are not a reason to part with something a person wrote in their own hand.

Out: every recipe and book exports as a PDF from inside the app, whenever you like.

Deleted: email [email protected] from your account address and we'll erase the account, every recipe, every photograph, every book, and every usage record described above — the counts, the failures and the day rows. That happens immediately: from that moment nothing of yours is served to anyone, here or anywhere.

Then there is a 90-day window, and it exists for you. Backups of the database, and the previous versions of your photographs, are kept for 90 days — so if you change your mind, write to us and we can put your account back. After 90 days they are erased and nobody can, including us. We keep the same copies in a second region in case the first is ever lost; deleting reaches both, on the same clock.

We won't go into those backups to look at your data once you've asked us to delete it. Putting your account back because you asked us to is the only reason we'd open them. And how long we keep the recipes, photographs and books you make — while the account is open, rather than after you close it — is a question about the service rather than about you, so it lives in the Terms.

Two things outlive the 90 days, and we would rather name them than have you find them. If we ever had to remove something from your account because somebody showed us it was theirs, we keep a record of what was removed and when — without it we could not answer honestly if you or they asked later, and we could not run the repeat-complaint rule in our Terms. And any feedback you sent us is kept, with your account details stripped off it. Someone leaving shouldn't erase the reason they left, and once it isn't attached to you it isn't about you. Ask and we'll remove that too.

Buk is in beta, and for the moment it's meant for people in the United States. We aren't set up for the data-protection obligations that come with serving the EU or UK yet, so we're asking people there to wait — not a judgement about those rules, just honesty about what a one-person beta is ready for.

Buk isn't intended for children, and we don't knowingly collect their data.

If this page changes in a way that matters, everyone with an account gets an email — not a quietly updated date. That starts when registration opens. Buk is invite-only today, the accounts are a few testers we know by name, and we tell them directly; until then the date above is the record. See also the terms.