Privacy Policy

What we collect

Only what you type into a form, plus the small amount of technical information any web server records.

When you request a quote or booking

Your name, email address, phone number, the type of event, the date, the time of day, roughly how many guests, the suburb or region, the event address if you give one, any dietary requirements you tell us about, and any notes you add.

When you use the contact form

Your name, email address, phone number if you give one, the subject, and your message.

Technical information

Our server records the usual request information, including your IP address, so it can apply rate limits and block abuse. This is ordinary server logging, not analytics or profiling.

We do not ask for and do not want payment card numbers through this website. If a deposit or payment is arranged, it is handled directly between you and Joe.

Dietary requirements can reveal health information, which Australian privacy law treats as sensitive. We only collect what you choose to tell us, we use it to feed your guests safely, and we do not use it for anything else.

Why we collect it

• To work out whether we can do your event, and to price it.
• To contact you about your enquiry, your quote and your booking.
• To turn up at the right place, at the right time, with the right food.
• To keep a record of bookings we have taken, so we know we are not double-booked.
• To keep the site working and to stop automated abuse of the forms.

We do not sell your information. We do not rent it, trade it, or hand it to advertisers. We do not send marketing email unless you have asked us to.

Cookies and things stored on your device

This site sets no advertising cookies and no analytics cookies. There is no Google Analytics, no Meta Pixel and no tracking of you across other websites.

Two things are stored on your device, and both are strictly necessary:

Your cookie choice

When you answer the cookie banner, that answer is stored in your browser so you are not asked again on every page. It is kept for 12 months, then we ask again. It contains nothing that identifies you.

Admin sign-in

If you are Joe signing in to the admin screens, a sign-in token is stored in your browser to keep you signed in. It is only ever set after a successful login, and never for ordinary visitors.

The Analytics and Marketing categories are both enabled. That sounds worse than it is: nothing is installed in either of them, so there is nothing enabled to run. They are switches waiting for something to switch. If analytics or an advertising service is ever added here, this policy will be updated to say what it does and the banner will ask you properly before it runs. You can revisit this notice at any time using the “Cookie settings” link at the bottom of any page.

There is nothing here that a Global Privacy Control or Do Not Track signal would need to stop — no analytics and no advertising service is loaded, whatever your browser asks for.

Who else is involved

We keep this list short on purpose. These are the only parties that can see anything:

Our web host

The site and its database run on hosting infrastructure. The host can technically access the server, as any host can.

Our email provider

Booking and enquiry notifications are emailed to us, so the contents of your enquiry pass through an email service on the way.

Google Fonts

The site loads three typefaces from Google’s font servers. Doing so tells Google your IP address and roughly what browser you are using. Google states it does not use these requests to build advertising profiles. This request happens as the page loads and cannot be switched off by the cookie banner — the only real fix is for us to serve the fonts ourselves, which we can do on request.

Facebook and Instagram

The message buttons and social links are ordinary links. Nothing is embedded, so neither company is told you were here unless you click through to them. Once you do, their own privacy policies apply.

How it is kept safe

This is what is actually in place, not a wish list:

• The site is served over HTTPS, and browsers are instructed to refuse an unencrypted connection.
• A content security policy limits what the page is allowed to load, which blocks most injected-script attacks.
• The forms are rate limited, so they cannot be hammered automatically.
• Requests that a different website tried to make on your behalf are rejected.
• Admin access needs a password, and passwords are stored hashed — not as readable text.
• The admin area can be restricted to specific IP addresses.

No system is perfect, and we will not pretend otherwise. If we ever have a data breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

How long we keep it

Booking records are kept while they are useful for running the business and for the period our tax and business records have to be kept. Enquiries that never turn into a booking are kept only as long as they are useful, and then deleted.

If you want your details removed sooner, ask. If there is no legal reason to keep them, we will delete them.

Seeing and correcting your information

You can ask what we hold about you, ask for a copy, ask us to fix anything wrong, or ask us to delete it. Email or call using the details below and we will deal with it.

We will not charge you for asking. We may need to check who you are first, so we do not hand your details to someone else.

If you are not happy

Tell us first — most things are a misunderstanding and are quicker to fix directly. If you are not satisfied with how we have handled it, you can take a privacy complaint to the Office of the Australian Information Commissioner at oaic.gov.au.

Children

This site is aimed at whoever is organising the event, not at children. We do not knowingly collect information from children. We cook at plenty of children’s parties — we just do not need any personal details about the children to do it.

Changes to this policy

If we change this policy we will update the date at the top. If a change is significant, and it affects choices you have already made about cookies, the cookie banner will ask you again rather than assume your old answer still stands.