Your privacy.

Updated 22 October 2026

Reading the journal

You can read Kumora without creating an account. Advertising is not currently active. Recipe checkboxes and quantity controls live in the current page and are not sent to a server.

Community accounts and posts

When you join, we store your username, display name, a salted password hash and a hashed recovery code. No email address is required. Your profile name, username, bio, optional location and avatar are public. Published posts, recipes, comments, follower relationships and vote totals are public; saved posts and recipes, drafts, passwords, recovery codes and session tokens are not shown publicly. Photos are served through public image links, including photos uploaded to drafts. Only share photos you are comfortable making public.

An essential HttpOnly session cookie keeps you signed in for up to 30 days. The server stores only a hash of its token. Signing out revokes that session; changing or recovering your password revokes other sessions. Temporary abuse-prevention counters use hashed network or account identifiers and expire within 24 hours; expired counters are removed when the next limited operation runs. Uploaded photos are resized and re-encoded without their original metadata.

You can edit your profile, posts and recipes, remove your comments, and delete your account in account settings. Account deletion removes your posts, recipes, comments, votes, follows, saved posts and recipes, sessions and uploaded photos from the live application. Reports may remain without your account association so the owner can investigate abuse. Operational backups may retain earlier data until their normal rotation; the operator will reapply deletions if a backup is restored. Community content stays until you delete it or the operator removes it for moderation. Contact the operator below for privacy or content-removal requests.

Visitor analytics

Kumora measures visits on its own server. We collect public page paths, referring website names, Pinterest source attribution, active reading time, article scroll depth, and clicks on recipe, print and copy-link controls. We do not store search terms, complete referrer URLs or arbitrary query parameters in this analytics database.

The server uses an IP address and browser user-agent transiently to filter known internal and automated traffic and derive a secret-keyed identifier that changes daily. The analytics database stores neither raw IP addresses nor raw user-agent strings. The daily estimate may group people sharing a network and browser. Measurement records are retained for up to 90 days and removed during the next collection cleanup.

Aggregated statistics are publicly visible at /stats. Individual visitor records and identifiers are not public. This first-party measurement does not use an analytics identity cookie. A one-year preference cookie remembers browsers excluded by the owner’s network or the “Exclude this browser” control on the stats page. We also respect Do Not Track and Global Privacy Control. Blocking scripts can prevent measurement. Umami Cloud collection was replaced on 15 October 2026; earlier totals are not mixed into the new view.

Optional Google Analytics

With your permission, we also use Google Analytics 4 to understand public page visits, referring websites, Pinterest campaigns, engagement, and clicks to open, print or copy links to recipes. Those clicks do not prove that a recipe was made, a print completed, or a link was successfully copied. Google receives browser and device information and uses IP addresses for coarse location and service operation. Google says it discards raw IP addresses after use and does not associate them with user identifiers. IP processing differs by region; see Google’s regional privacy information.

Google Analytics stays off until you choose “Allow analytics.” Rejecting it does not affect access to Kumora. Your choice is saved in local storage for 180 days. If you agree, Google uses first-party _ga cookies to distinguish browsers and sessions; our configuration limits their lifetime to 180 days. You can change your choice through “Analytics choices” in the footer. Withdrawing consent stops collection and removes these analytics cookies from this website. You can also clear local storage and cookies in your browser.

We exclude known owner networks, the VPS, editor sessions, opted-out browsers and detected automation before loading Google Analytics, and respect Do Not Track and Global Privacy Control. We do not send account pages, member profile names, search terms, form contents, email addresses, arbitrary query parameters or full referrer URLs. Only recognized Pinterest campaign values are retained. We do not enable Google signals, advertising personalization or user-provided data collection. Our Google Analytics event-level retention is set to two months; aggregated reports can remain longer. This optional service is separate from the first-party public statistics above, so its totals can differ.

Google processes this information under its privacy policy and information for partner websites. Processing may take place outside your country. The Google Analytics opt-out browser add-on is another available control. Advertising consent, if ads are enabled later, is handled separately.

Optional self-hosted analytics

With the same optional analytics consent, Minilytics runs on Kumora’s own server. It records public page views, referring website names, recognized Pinterest campaign tags, browser and device categories, active reading time, recipe interactions and outbound destination hosts. First-party ml_vid and ml_sid cookies distinguish a browser for up to six months and a visit for 30 minutes of inactivity. A browser identifier is not proof of a unique person. No account names, email addresses, form contents, search text, precise location or raw IP addresses are stored in this database. IP addresses are used transiently by Kumora’s collection endpoint to exclude internal traffic.

The dashboard is private to the site owner, retains event and visitor records for 90 days, and does not share analytics records with Cloudflare or Minilytics’ hosted service. Known owner networks, VPS traffic, editor sessions, opted-out browsers and detected automation are excluded. We respect Do Not Track and Global Privacy Control. Withdraw consent through “Analytics choices” to stop collection and remove these cookies. Visitors who decline analytics, use blockers or are excluded will not appear, so these are measured consenting visits, not a complete count of every person.

Advertising and your choices

Kumora has applied to Google AdSense. Ads are not currently enabled. The ads.txt file identifies our authorized Google publisher account; it does not itself load an advertisement, set a cookie or measure visitors.

When advertising is enabled, Google and its advertising partners may use cookies, local storage, web beacons, IP addresses and other device identifiers to deliver ads, limit repeated ads, measure their performance and prevent fraud. Depending on your consent and location, ads may be personalized using activity on this and other websites. Third parties may place or read cookies in your browser as a result of ad serving.

Read how Google uses information from sites and apps that use its services and Google’s advertising technology information. You can manage Google ad personalization in My Ad Center and manage or remove cookies in your browser settings.

Before activating ads that require consent, we will provide the applicable consent message and a way to revisit your choices. In the EEA, UK and Switzerland, we will use a Google-certified consent management platform. Rejecting optional advertising purposes will not prevent you from reading recipes. Non-personalized ads may still involve cookies and measurement; they do not replace the consent process.

Technical information

Our web host may process request information, such as IP addresses, requested pages, and browser details, to deliver and secure the website. Search terms appear in the page URL and may appear in hosting access logs. Hosting log retention is controlled by the site operator.

Images, fonts, and links

Our images and fonts are served by this website. External links take you to another service with its own privacy practices. The copy-link button uses your browser’s clipboard only when you choose it.

Editorial tools

The publishing interface is restricted to the site operator. It stores article content and uploaded images on the site’s persistent storage. Signing in sets an essential, HttpOnly session cookie that expires after 12 hours. The database stores a password verifier, hashed session tokens and a temporary login-attempt counter. Signing out revokes that session; changing the password revokes all sessions. The separate, operator-only Growth dashboard can connect our own Pinterest business account to read account, board, pin and performance information. It does not connect visitors’ Pinterest accounts or give Pinterest access to member passwords. Its integration privacy notice explains this separately.

Questions and changes

Kumora is operated by Conyro. For privacy questions, contact hello@conyro.io.

We will update this page when the site’s data practices change, including before adding new integrations or changing analytics providers.