Cestavo — Privacy Policy
Last updated: 15 October 2026
Cestavo ("we", "us") is run by Nicholas Syrianoudis, 25 Camelot Ct, Canfield, OH 44406. Contact: nsyrianoudis@gmail.com. We reply to support emails within 5 business days.
Short version
- No cookies. No account. We don't ask for your name or email to use free meal plans.
- Your saved plan stays in your browser. We don't receive it.
- We count page visits and measure page speed without identifying you.
1. Stored on your device (not sent to us)
We use your browser's local storage for one thing only:
l1_plan: the meal plan you chose to save (the number of people and which dishes, stored as numbers). It is written only when you click Save, and it stays on your device.
Delete it any time by clearing this site's data in your browser settings. Our analytics tool stores nothing on your device.
2. Analytics
We use Cloudflare Web Analytics, provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), to count visits and measure how fast our pages load. It does not use cookies, local storage or any other storage on your device, and it does not identify you or follow you across other websites.
When a page loads, a small script from Cloudflare sends Cloudflare: a random ID for that single page load, the page address (without anything after a "?"), the referring page, and page-speed timings. Cloudflare receives your IP address as part of delivering that request, but discards it at the nearest Cloudflare data centre and does not store it in its core databases or logs. Our dashboard shows only totals, such as visits by page, referrer, country, device type, browser and operating system. We don't record clicks or anything you type, and we don't use this data to identify you, sell it, or use it for advertising.
Retention: Cloudflare keeps the detailed data for 7 days and then keeps an aggregated sample (about 10%) for long-term statistics; our dashboard shows up to the previous six months. We don't keep our own copies of analytics data beyond 30 days.
Opt out: blocking the script static.cloudflareinsights.com/beacon.min.js (most ad or tracker blockers do this) or turning off JavaScript stops it. The site works the same either way.
3. Hosting
Our host, Cloudflare Pages (provided by Cloudflare, Inc.), processes your IP address and request details to deliver and protect the site, under its privacy policy (https://www.cloudflare.com/privacypolicy/). Cloudflare keeps server logs as described in its privacy policy. We don't keep our own copies of host logs beyond 30 days.
4. Google Search Console
We use Google Search Console to see aggregated data about how our pages appear in Google Search. It adds no code to this site and gives us no data about individual visitors.
5. Why we may process data (EU/EEA, UK, Brazil)
- Hosting logs: our legitimate interest in running, securing and improving the site (GDPR art. 6(1)(f); LGPD art. 7, IX).
- Analytics (Cloudflare Web Analytics, section 2): our legitimate interest in knowing which pages are used and keeping them fast. You can object at any time by blocking the script or writing to us.
- Device storage: only
l1_plan, which is strictly necessary to save the plan you ask us to save. Because nothing else is stored on or read from your device, we don't show a cookie banner.
6. Your rights
Depending on where you live (EU/EEA and UK GDPR, Brazil LGPD, Mexico LFPDPPP, California CCPA/CPRA), you may ask to access, correct, delete or port your data, object to or restrict processing, and withdraw consent. We do not sell or share personal information for cross-context behavioural advertising. Write to nsyrianoudis@gmail.com; we reply within one month. You may complain to your data protection authority (e.g. CNIL in France, Garante in Italy, ANPD in Brazil, or the data protection authority in Mexico). We have not appointed an EU or UK representative.
7. International transfers
Our providers may process data in the United States and other countries. Cloudflare may process analytics data in a country other than yours, usually at the data centre nearest to you. For data from the EU/EEA, the UK and Switzerland, Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework), and on the EU Standard Contractual Clauses if that certification lapses. Cloudflare, Inc. (United States) also hosts this site (section 3) under the same safeguards. If you email us, your message is handled in Gmail by Google LLC in the United States; Google is certified under the EU-U.S. Data Privacy Framework and its UK Extension.
8. Children
The site is not directed at children under 13 (under 16 in the EU/EEA, or the age your country sets). We don't knowingly collect their data.
9. Changes
We'll change the date above when this policy changes, and give notice on the site for material changes.