LightWorks Home Recipes Cookie and Browser Storage Policy

Last updated: October 4, 2026

This policy explains the cookies and browser-storage technologies used by LightWorks Home Recipes. Optional Google Analytics is disabled until you explicitly allow anonymous usage analytics. Advertising cookies are not used.

AI connection preferences and previews

Optional WebMCP read/proposal permissions use account-scoped local storage keys beginning with homeRecipes.webmcp.v1.. Both permissions start off and can be changed in Profile. These choices are not stored in Google Drive. An AI preview and its editor revision exist only in app memory; they are not saved records or queued synchronization changes. Reloading or closing the app discards unsaved previews.

IndexedDB

The app uses the Recipes IndexedDB database to provide offline access and local-first saves. It stores cached recipe collections and embedded images, Kitchens and equipment, Meal Plans, synchronization state and errors, deletion tombstones, conflict records, pending Kitchen-copy offers, a normalized ingredient-name suggestion index, device-local recipe equipment assignments, cooking timer runtime state, and the last successful synchronization time.

Local storage

Local storage retains device preferences and PWA state, including your Auto/Light/Dark theme choice, whether optional Kitchen and ingredient context may be sent with AI requests, whether cooking mode should request a screen wake lock, your cooking-timer alarm tone, PWA install-prompt dismissal state, whether you accepted the hands-free cooking beta disclosure, the completion or dismissal state of the optional Getting Started checklist, and your Analytics choice, policy version, and decision date under homeRecipes.analytics.preference.v1. These settings do not contain your Google access token or full recipe content. The Analytics choice expires after 12 months or when the policy version changes.

Session and authentication storage

The Blazor OIDC authentication library uses browser session storage for the signed-in user's authentication record, which can include identity claims and an access token, so sign-in can survive page reloads during the browser session. It may use additional temporary browser storage for OAuth state, PKCE, cached authentication settings, and callback completion. The app's token service also holds an active token in memory while performing a Google Drive or Picker request.

After sign-in, the OAuth relay sets an essential, HttpOnly Home Recipes application-session cookie used to protect the billable AI API without sending the Google Drive token to that API. It contains a signed pseudonymous account identifier and issue, expiry, and token identifiers; it contains no email, profile, recipe, or Drive data. The cookie is SameSite Strict, Secure on HTTPS, expires after 12 hours, and is cleared during normal sign-out. It is required only for authenticated API features and is not an Analytics or advertising cookie.

The OAuth relay does not intentionally store authorization codes or Google token responses and marks its responses no-store. Signing out and closing or restoring a browser session affect authentication storage according to browser behavior; use browser site-data controls if you need to ensure it is removed.

When hands-free cooking is used, this tab's session storage keeps only the current instruction plus preparation-group and instruction completion identifiers. Recognized speech transcripts are not written to browser storage. Closing the tab normally ends this page-session progress.

Cache Storage and the service worker

The installed PWA and ordinary browser use may cache application code, styles, icons, Help guides, read-only demo fixtures, and other static assets for faster startup and offline use. API responses, OAuth endpoints, and legal pages are excluded from the app's service-worker cache. A replacement cache must finish before an update activates; the old cache remains available if installation fails. Updating or removing the PWA may replace or remove some caches but does not necessarily clear IndexedDB or all site data.

Third-party cookies and sites

Google-hosted authentication and Picker services may contact Google and use cookies on Google's domains during sign-in, account selection, authorization, and file selection. Those cookies are controlled by Google and are described in Google's cookie policy.

The optional “Buy me a coffee” control is a normal external link. LightWorks Home Recipes does not embed Buy Me a Coffee's script or set its cookies. Buy Me a Coffee may process the visit and set its own cookies only after you follow the link. Native Share, Copy, and Email use browser or operating-system features rather than app-set cookies.

Analytics and advertising

In production only, and only after you select Allow anonymous usage analytics, the app loads Google Analytics 4 and may set the first-party _ga and matching _ga_* cookies. These hold a pseudonymous client identifier and have a fixed 12-month lifetime that is not extended on each visit. No Analytics request, cookie, or event occurs before consent, declined events are dropped, and the app keeps no offline Analytics queue.

Analytics receives sanitized page categories, feature actions and outcomes, AI mode and typed outcome, Help usage without search text, synchronization categories without error text or resource identity, display mode/app version, and selection of the external donation link. It does not receive Google account information, authentication state, names or content of Recipes, Collections, Kitchens, equipment, Meal Plans, ingredients, instructions, Drive or Recipe IDs, prompts, URLs, search terms, raw routes, query strings, exceptions, donation completion, amount, or donor identity.

Google Signals, advertising personalization, Ads links, User-ID, cross-domain tracking, and server-side Analytics events are disabled. GA event- and user-level data is configured for 14-month retention. Azure hosting and API infrastructure may still produce necessary request, security, performance, and error logs as described in the Privacy Policy.

Your choices

You can allow or withdraw Analytics in Profile under Anonymous usage analytics. Withdrawal immediately stops future app events, changes Analytics consent to denied, and removes first-party _ga cookies for this site; it does not erase data that was previously aggregated by Google Analytics. Delete Local Data clears IndexedDB but does not delete Google Drive files and does not necessarily clear local-storage preferences, authentication session storage, or service-worker caches. Browser site-data controls can clear all storage and cookies for the site. Blocking required browser storage or Google cookies may prevent offline use, sign-in, Picker, or synchronization from working; blocking Analytics does not prevent ordinary app use.

Contact

Questions may be sent to support@lightworks.app.

Return to LightWorks Home Recipes · Privacy Policy · Terms of Service