← Return to Secret Recipes

Privacy Policy

Effective Date:

1. About this policy

Dk4Q's Koháu Secret Recipes is a fan-made tool for looking up secret recipe combinations for the Roblox game and Koháu community. You can use the recipe site without making an account or giving the site your name, email address, phone number, password, Roblox login, or Discord login.

This policy explains what the recipe site does and does not collect, what information stays in your browser, what information is requested from Dk4Q services, what our web infrastructure may receive when it serves the site, what public contributor/donor information may be displayed, and what happens when third-party services such as Ko-fi, Google Fonts, jsDelivr, Roblox, or Discord are involved.

2. Privacy at a glance: what we do not collect

When you are simply browsing and searching the recipe site:

There are important exceptions to this simple summary. The page makes normal network requests to Dk4Q infrastructure, automatically loads Font Awesome through jsDelivr and the Ko-fi widget, and can request Google-hosted fonts when a selected or imported theme uses them. Those services necessarily receive requests from your browser. The details are below.

3. Information stored in your browser

The recipe site uses browser Local Storage for a small number of preferences and theme features. Local Storage is browser storage similar in effect to a persistent preference file; it is not the same thing as a server-side account.

These values normally remain in that browser until you change or remove the relevant setting, clear site data, use a reset/delete control where available, or the browser removes the storage. The site's own JavaScript does not use Local Storage to save your recipe search text, recipe-filter choices, or sorting choices.

The current page code does not use Session Storage or IndexedDB for these preferences, and it does not set its own analytics or advertising cookies. A third-party service loaded by the page may use its own cookies or similar technologies under its own rules, as described below.

4. Theme editor, sharing, saved themes, and clipboard

The recipe site includes a theme editor. Your current theme and any named themes you save are stored in Local Storage as described in Section 3.

Because Paste Theme reads the current text clipboard when you invoke it, unrelated clipboard text may briefly be read by the page code if it happens to be on your clipboard at that moment. The current recipe-page code does not send copied or pasted theme text to Dk4Q, the recipe data service, or an analytics service.

Current theme-sharing links use a URL fragment. When you choose Copy Link, the page creates a link containing an encoded copy of the current theme after #theme=. A URL fragment is handled by the browser and is not included in the normal HTTP request sent to the web server. Someone you send the link to can, of course, see and use the theme information contained in the link. The shared data is the current appearance/theme configuration; it does not contain your recipe searches, saved-theme library, account details, or contact information.

The page still supports older shared-theme links that use a ?theme= query parameter. Unlike a fragment, a query string is part of the requested URL and may therefore appear in hosting, proxy, CDN, or security logs. After a valid shared-theme preview is accepted or dismissed, the current page code removes the theme value from the address bar.

5. Web requests and server/security logs

Every website needs technical information in order to send a page or file back to your device. When your browser requests the recipe page, recipe data, contributor data, donor data, notifications, images, or other files from Dk4Q-controlled domains, the hosting, CDN, proxy, and security infrastructure handling those requests receives the network request.

Depending on the configuration of the service handling a request, standard access or security logs may include:

Dk4Q does not use these logs to reconstruct your local recipe searches or filters, build advertising profiles, or track you across unrelated websites. Logs may be used for security, abuse prevention, troubleshooting, reliability, capacity planning, and investigating technical problems.

The exact fields and retention periods of infrastructure logs can depend on the hosting, CDN, proxy, or security provider in use. We do not describe IP addresses as "masked" or promise a fixed log-retention period unless that is actually guaranteed by the relevant infrastructure configuration.

As explained in Section 4, the #theme= fragment used by current share links is not sent as part of the ordinary HTTP request. Ordinary query strings, including legacy ?theme= links, can be.

6. Dk4Q data and content services

The recipe page requests data and media from Dk4Q-controlled origins:

The page also uses browser DNS-prefetch/preconnect hints for some Dk4Q and third-party origins. On browsers that support them, these hints can cause an early DNS lookup or network connection before the later file request is made.

Recipe data is requested when the application starts. After the core recipe data loads, the page also requests its last-updated information, contributors, and notifications. The Robux donation-option list is currently requested when its donation component starts, even if you have not expanded the section yet. The Ko-fi donor board loads its Dk4Q-hosted list when that board starts, and the Robux donor data is also requested to build its preview.

While the page remains open and visible, the current code checks version.json roughly once per minute so it can show an update notice when the page version is out of date. That check is not a Dk4Q analytics event, although the web request itself can appear in ordinary infrastructure logs as described in Section 5.

7. Ko-fi donation widget

Ko-fi is the most significant third-party integration on the recipe page, so it is explained separately.

The Ko-fi widget currently loads automatically. After the page has loaded or the browser has an idle opportunity, the site schedules a request for Ko-fi's floating donation-widget script from storage.ko-fi.com. You do not have to press the Donate button before that first connection to Ko-fi happens. The Ko-fi-controlled script may then make additional requests needed to render or operate the widget.

This means Ko-fi or the infrastructure serving its widget receives a direct network request from your browser. Ko-fi's current Privacy Policy says its Technical Data can include IP address, browser type and version, time-zone setting and location, browser plug-in information, operating system/platform, device ID, and information about how Ko-fi is used. Ko-fi also describes its use of cookies and similar technologies. The exact cookies, identifiers, or follow-on requests used by the embedded widget may vary over time, browser, region, and Ko-fi's own implementation, so we do not claim that every category in Ko-fi's policy is used on every visit.

If you choose to support Dk4Q through Ko-fi, additional information is involved. Ko-fi says creators can receive a supporter's chosen display name or username and email address, and may receive a support message. Its help documentation also explains that connected payment providers can expose further normal merchant/transaction information to the creator: PayPal may show a supporter's legal name and email address, while Stripe may make a legal name, email address, card-linked address information, and limited bank/payment information available to the connected Stripe account.

Dk4Q does not receive your full payment-card number through the recipe webpage itself. Ko-fi, PayPal, Stripe, and any other payment option presented by Ko-fi handle their parts of a transaction under their own terms and privacy notices. Ko-fi also states that creators are responsible for how supporter information made available to them is used.

Ko-fi's current Terms state that a person must be at least 18 years old to use Ko-fi and create an account. If you are under 18, do not use the Ko-fi donation feature.

For more information, see Ko-fi's Privacy Policy, Ko-fi's Terms, Ko-fi's supporter-information help page, PayPal's privacy information, and Stripe's Privacy Policy.

8. Robux donation options and donor boards

The recipe page contains Robux donation links and public donor-board features. The page itself does not ask for your Roblox password or payment-card details.

A donor entry can show a display name or handle, an associated platform such as Roblox, Discord, or Ko-fi, a displayed donation amount, a ranking, and an optional image. Information that may be visible to Dk4Q through Ko-fi, PayPal, Stripe, Roblox, or another transaction system, such as an email address, legal name, billing address, or payment-account details, is not automatically published on the donor boards merely because a donation occurred.

If a public donor entry refers to you and you would like it corrected, anonymised, or removed, contact us using Section 17. Removing something from a public board does not necessarily require deletion of separate transaction, accounting, security, fraud-prevention, refund, or dispute records that still need to be kept.

9. Fonts, icons, and other third-party assets

The recipe page uses a small number of outside services to deliver visual assets:

The recipe data itself currently restricts contributor and donor images used by those components to Dk4Q's cdn.dk4q.com origin. This privacy-policy page itself uses system fonts and does not need to contact Google Fonts to display its text.

10. Roblox, Discord, the status page, and other external links

The recipe site links to the Koháu Roblox experience, the Koháu Discord server, Dk4Q's status page and contact pages, the Shift Timings site, donation destinations, and other external pages. These are links, not visitor-account integrations: the recipe page does not read your Roblox or Discord login cookies, passwords, private messages, friends list, or account history.

When you choose to open another service, that service receives the visit and handles it under its own privacy and security rules. Depending on the link, browser configuration, and destination, the destination may receive normal request information such as your IP address and browser headers. The site's links that open a new tab use browser security attributes intended to prevent the new page from controlling this one and to suppress referrer information where supported.

You can review Roblox's Privacy and Cookie Policy and Discord's Privacy Policy.

11. Contributors and public recognition information

The recipe site publicly credits some people who have contributed to the project or supported it financially. Public-facing Roblox, Discord, Ko-fi, or other handles can still be personal information when they identify or relate to a person.

If a contributor or donor entry refers to you and is inaccurate, unnecessarily identifying, or should be reviewed for removal, contact us using Section 17. We will review requests in light of the recognition purpose, the source and accuracy of the entry, applicable privacy rights, and any legal, security, accounting, dispute, or recordkeeping need that may require some information to remain.

12. Children and younger visitors

This is a Roblox-related fan site, so we recognise that children and teenagers may visit it. Ordinary recipe browsing does not ask visitors for their age, real name, email address, phone number, Roblox login, or Discord login.

We do not knowingly ask children under 13 to submit personal information directly to Dk4Q through the recipe page. Contributor and donor datasets may refer to public-facing Roblox, Discord, Ko-fi, or other identities. If you are a parent or guardian and believe that a child's personal information has been provided directly to Dk4Q or is unnecessarily included in a public contributor/donor entry, contact us so we can review it and take the action required by applicable law.

The Ko-fi donation service is separate from ordinary recipe browsing and, as explained in Section 7, Ko-fi's current Terms require users of the platform to be at least 18 years old.

13. Your privacy rights

Privacy rights depend on where you live, what information is involved, and whether a particular law applies to this site or activity. Depending on those circumstances, laws such as the EU GDPR, UK GDPR, California privacy law, or other national or state privacy laws may give you rights over personal information Dk4Q controls.

Where applicable, those rights can include asking for access to personal information, correcting inaccurate information, requesting deletion, restricting or objecting to certain uses, receiving portable data, withdrawing consent where processing is based on consent, opting out of a sale or legally defined sharing where relevant, and complaining to a privacy regulator.

Some privacy laws apply only to organisations that meet particular location, business, revenue, or data-processing thresholds. We do not claim that every privacy law applies to this fan site, and we do not claim that a law is irrelevant simply because visitors do not have accounts.

Dk4Q does not currently sell ordinary recipe-site visitor data or use it for cross-context behavioural advertising. If the site's practices change in a way that creates a legally required opt-out or consent mechanism, the site and this policy should be updated accordingly.

14. Lawful bases, third parties, and international processing

If EU or UK data-protection law applies to a particular Dk4Q-controlled activity, Dk4Q is responsible for personal data where Dk4Q decides why and how that data is used. Examples can include Dk4Q infrastructure logs, contributor/public-recognition records maintained by Dk4Q, donor-board information maintained by Dk4Q, and supporter information made available to Dk4Q through a donation provider. Ko-fi, Google, jsDelivr, Roblox, Discord, PayPal, Stripe, hosting/CDN providers, and other third parties are separately responsible for processing they control.

For Dk4Q's own processing, purposes are limited to operating and securing the site, providing and updating recipe content, responding to requests, maintaining public contributor/donor recognition, troubleshooting, preventing abuse, and meeting legal, accounting, refund, fraud-prevention, or dispute-related obligations where they apply. Where a privacy law requires a lawful basis, the basis must match the particular activity. Depending on the activity and the facts, relevant bases can include legitimate interests in operating and securing the service, consent or permission where appropriate, and compliance with a legal obligation where required.

Web infrastructure and third-party services can process network, account, or transaction information in countries other than the country where you are located. The relevant provider's privacy notice explains the international-transfer mechanisms and safeguards it uses for information it controls.

The recipe page does not make solely automated decisions about ordinary visitors that produce legal or similarly significant effects. Its automated searching, filtering, sorting, pagination, theme logic, notification timing, and page-version checks are display or convenience functions.

15. How long information is kept

16. Security and practical privacy choices

We take reasonable steps to limit access to information Dk4Q controls and to use it only for the purposes described above. No website, hosting provider, CDN, third-party widget, external service, or payment provider can guarantee perfect security, so this policy does not make that promise.

You can remove the recipe site's saved Local Storage by using the site's relevant reset/delete controls or by clearing site data in your browser. You can avoid using the theme-paste function if you do not want the page to request access to clipboard text. You can keep a system-font theme if you do not want the recipe page to request optional Google-hosted fonts. Browser privacy tools can also block third-party requests, although blocking jsDelivr, Google Fonts, Ko-fi, or other required resources may change how the page looks or works.

You can contact us about a contributor, donor, or other public entry that refers to you. You can also choose not to follow external donation, Roblox, Discord, or other third-party links.

17. Contact

If you have a privacy question, want to exercise a right that applies to you, or want a contributor/donor/public entry corrected or reviewed for removal, contact:

18. Changes to this policy

We update this policy when the recipe site's features, integrations, data sources, storage, or data practices change. If a change materially affects what visitors or people named in site data should know, the effective date above should be updated as well.