Your details
Lo Fo Tong collects as little as possible. This page says exactly what we hold and what you can ask us to do with it. You can read every recipe on this site without giving us anything at all.
What we collect
We hold personal details in two cases only: if you join the weekly soup letter, and if you make an account. For the letter we store your email address, the language you chose, and a record of the consent you gave with its date; a name is optional. For an account we store your email address, the name you ask Ah Ma to call you if you give one, the date it was made and when you last signed in, your language, the number of people you usually cook for, the favourites you save, and the weekly cooking plans you save. We keep a salted hash of your IP address and the browser user-agent string your device sends, both to stop abuse, never the IP address itself. We do not run advertising trackers.
Your cooking plans
A saved plan records which dishes you meant to cook on which nights, for how many people, any short note you add, and whether you marked a night cooked or skipped. Kept week after week, that is a record of what your household eats, and we want to be plain about it: it is used for one thing only, showing your plans back to you. We do not analyse it, sell it, share it or use it for advertising. Your account has room for three months of past plans. We never delete them without asking you. When that space is full, we ask you to delete either the oldest month or everything, and you cannot save a new plan until you have chosen; your shopping list and favourites keep working meanwhile. You can also delete the oldest month, or everything, whenever you like. Either way we ask you to confirm first, because a deleted plan cannot be brought back. If you do not sign in for two years, we email you once to say your account will be deleted; if you still have not signed in 30 days later, we delete it and everything in it. Signing in at any time stops that.
What stays on your device
Your shopping list is never sent to us. It lives in this browser only, whether or not you are signed in, so it works in a shop with no signal and there is no copy of it anywhere else. If you are not signed in, your favourites stay in this browser too. Clearing your browser clears them.
Why we collect it
To send you the weekly letter, and to keep your plans and favourites so they follow you from one device to another. Nothing else.
Signing in
An account is optional. You sign in with a link we email you, or with your Apple or Google account. There is no password, so we hold none. Sign-in is handled by Google Firebase Authentication. If you use Google, Google passes your name and profile photo along with your email address. If you use Apple, Apple passes your name the first time, and you can choose to hide your real email address, in which case we only ever see an address Apple relays for you. Firebase keeps these with your sign-in record, and we do not use them.
Asking Ah Ma
If you use the 問阿媽 assistant, the question you type is sent to an AI provider (Google Gemini, or Anthropic as a fallback) so it can be answered, together with the matching entries from our own soup and ingredient records. Those providers process it on servers outside Australia. We do not attach your name or email to it, and we do not keep a record of your questions. If you have told Ah Ma what to call you, she uses that name to greet you on your own device only; it is never sent with your questions. If you ask her to change a week, the week’s dishes go with your question so she knows which week you mean, and nothing else of yours does. If you save a week she plans for you, we keep the plan, which dishes on which nights, and never the conversation. Do not type anything into it you would not want handled that way; if a question is private, the recipes are all on the site to read directly.
Consent and unsubscribing
Ticking the consent box on the letter form is your consent, and we store the exact wording you agreed to together with the date. Making an account does not sign you up to the letter; the two are separate. Every letter carries a one-click unsubscribe that we honour immediately, and you can unsubscribe without contacting us.
Where it is stored
Your letter details, favourites and plans are kept in an encrypted Google Firestore database in Sydney. Three honest caveats. Sign-in runs through Google Firebase Authentication, which Google operates only from data centres in the United States, so your email address and sign-in records are processed there. The website itself is served from a global network. Our letters pass through our mail provider, which operates outside Australia.
Access and deletion
If you have an account, the account page lets you download everything we hold for it, or delete it yourself. Deleting the account removes your plans, favourites and account from our database straight away, and you can no longer sign in. Google clears the sign-in record from its backup systems within 180 days, and keeps the IP addresses it logs at sign-in for a few weeks. For anything else, ask us and we will tell you what we hold about you, or delete it; that takes effect within 30 days, usually sooner. Nothing on this site is for sale, so there are no orders to keep.
Sharing
We do not sell your details and we do not share them for anyone else’s marketing. Our email provider processes your address only to deliver our letters and account notices, and Google processes it only to sign you in. Nothing here is for sale, so there is no payment processor and no card details anywhere.
Contact
Email hello@lofotong.com for any privacy question, correction or deletion request.
Last updated 3 October 2026.