Privacy Policy

Last updated: July 15, 2026

WhatTo (whatto.life) is a single-page recommendation tool for what to cook and what to watch. It's run by an individual, not a company. This page explains what information WhatTo collects when you use it, and what it doesn't.

No accounts, no passwords

WhatTo doesn't have user accounts or logins. Nothing you type into a filter is tied to an identity.

What stays on your device

Your recent picks, saved favorites, and preferences (theme, language, Watch region) are stored in your browser's localStorage, not on WhatTo's servers. Clearing your browser data clears them.

Cross-device sync (optional cookie)

To let your favorites and recent picks follow you across devices, WhatTo sets one functional cookie (whatto:uid) containing a randomly generated id — not your name, email, or any other identity. If you've favorited or viewed picks, that id is used to store and retrieve them from WhatTo's database so they show up again on another device or after clearing localStorage. This cookie isn't used for advertising or cross-site tracking, and no third party can read it. Clearing your cookies resets it and starts a new, empty sync identity.

Email digest (optional)

If you subscribe to the "today's pick" email digest, WhatTo stores your email address encrypted at rest (AES-256-GCM) — it's never stored or logged in plain text, and a direct look at the database would not reveal a readable address. Your email is used only to send the digest, via Resend, WhatTo's transactional email provider, and is never sold or shared for any other purpose. Every digest email includes a one-click unsubscribe link that permanently deletes your subscription record.

Analytics

WhatTo uses Vercel Analytics and Vercel Speed Insights to understand aggregate traffic and site performance — page views, a small set of interaction events (e.g. that a recommendation was generated, an outbound link was clicked, or a pick was shared), and technical performance metrics. These are cookieless and aren't tied to your name, email, or any other identity. See Vercel's Analytics privacy documentation for detail on what they collect.

Third-party data sources

WhatTo's recommendations are pulled live from third-party APIs. Your selected filters (e.g. genre, meal type) are sent to these services as search parameters — nothing that identifies you personally.

• TMDB, for movie/TV data. This product uses the TMDB API but is not endorsed or certified by TMDB.
• fatsecret Platform API, for recipe data. Powered by fatsecret Platform API.
• JustWatchand food-delivery services (e.g. Uber Eats), which WhatTo links out to for "where to watch" and "order this dish" — clicking these takes you to their site directly; WhatTo doesn't share any data with them ahead of that click.

Advertising (not yet active)

WhatTo does not currently run ads. If it starts using Google AdSense in the future, Google and its advertising partners may use cookies to serve ads based on your visits to this and other sites; you would be able to opt out of personalized advertising via Google Ads Settings or aboutads.info. This section is disclosed in advance and will be revised with specifics if and when ads actually go live.

Affiliate links

Some outbound links (e.g. delivery-service or streaming links) may become affiliate links, meaning WhatTo could earn a small commission if you make a purchase after clicking, at no extra cost to you. This doesn't affect what gets recommended.

Children's privacy

WhatTo isn't directed at children under 13, and doesn't knowingly collect information from them.

Changes to this policy

This policy may be updated as WhatTo changes — the "Last updated" date above will reflect the latest revision.

Contact

Questions about this policy or a privacy request? Email the site owner.