This page sets out what BrokeAndBuff collects when you visit, why it is collected, and what you can ask us to do about it.
What this covers
What follows applies to this site alone. Sites we link to run their own policies, and any social platform we post on collects under its own terms, not ours.
What the site collects
Loading a page transmits technical data: your IP address, the browser and device you use, which pages you open, the site you came from, and how long you read. We keep it in aggregate and never link it to a person.
We pass your IP address to an outside service (country.is) when you do something that sends data in — send the contact form or run a search — so we can tell which country the request comes from. It returns only the country; we keep that country code for a day, under a fingerprint of the address rather than the address itself. From outside the countries the site serves, those actions are declined: the form says so, and a search just returns you to the homepage. This check never happens when you simply read a page or an article.
The only information you hand over directly is the content of any message you send through the form, including an email address so we can reply.
How the data is used
- Serve the pages and diagnose faults when something breaks.
- See in bulk which budget high-protein meals pages earn their place and which do not.
- Write back when you contact us.
- Satisfy a legal requirement where one exists.
Third parties
One outside service touches this data: our hosting provider, which keeps the server logs and the database, under its own privacy policy. There is no analytics, no advertising and no mail provider. No cookies are set; some pages call Gravatar for an author avatar, the only other outside domain. This page will be updated before any advertising, analytics or mail service is added.
No data is passed to an outside analytics, advertising or mail service, so none crosses to the United States that way. If such a provider is ever added, this page will say where the data goes before it moves.
Newsletter data
On what basis
European and United Kingdom law asks for a lawful basis, so here they are: consent for anything you opt into, legitimate interest for the operation and aggregate measurement of the site, and legal obligation where applicable. Consent is reversible on request.
How long anything lasts
How long things last: hosting logs are rotated by the host, and contact-form messages are deleted once the conversation is over. The addresses collected until now were deleted from the site on 12 October 2026.
What you can ask for
Ask and you will get a copy of what is held on you, a correction, or a deletion. No cookies are set. Where the law grants more — EEA, UK, California — we apply the same standard to every reader rather than sorting by geography.
What never happens
Nothing here is sold, and nothing is handed to a third party for its own marketing. No broker is involved. For California readers, that is the substance of the CCPA opt-out: the sale that the right protects against does not happen.
Automated decisions
There is no automated decision-making and no significant profiling. The aggregate statistics described above are counts, not judgements about individuals.
Readers under 13
Readers under 13 are not the audience for BrokeAndBuff and we do not knowingly hold their data. A message from a parent or guardian is enough to have anything of the sort erased.
Safeguards
Sensible precautions are taken on the technical and the organisational side. Anyone claiming a website is perfectly secure is selling something.
Raising a problem
Raise a problem with us through the contact page and it gets dealt with. That said, nothing obliges you to come to us first: your national supervisory authority takes complaints directly.
Changes to this page
When this policy changes, the date at the top changes with it. Material changes are announced on the site.
Contact
Questions about any of this go through our contact page.