Privacy Policy

This policy describes what the app actually does: every item below corresponds to a specific request or data store in the code. When the app changes, the policy changes with it.

1. Who processes your data

Gustable is developed and maintained by Asuras Inc., the name under which an individual developer in the Republic of Belarus releases apps. Asuras Inc. is not a registered company. The developer's full name and address are shown on the developer page in Google Play.

Contact: egorkabercuk@gmail.com

2. What data we collect

2.1. Account data

You can use Gustable without signing in, in which case everything is stored only on your phone. If you sign in with a Google account, Google gives us your email address, your name and your Google account identifier. Your Google password is not passed to us, and we have no access to it.

We need this data so that you have the same profile on different devices. If you are in a family, its members see the name from your Google account (section 2.13). We do not show your email address to other users.

2.2. Profile data

During onboarding and in settings you can provide:

• a display name (nickname)
• gender and year of birth
• dietary preferences and foods you do not eat
• allergies and intolerances
• religion, used only to hide dishes that do not fit it, such as dishes with pork
• favourite cuisines and how much time you are willing to spend cooking

Allergies are health information, and religion is information about religious beliefs. We use them for one purpose only: to avoid offering you dishes you must not eat or that do not suit you. We do not pass them to outsiders, analyse them for any other purpose or use them for advertising. If you are in a family, its members receive your allergies and food restrictions so that the family is not offered dishes someone at the table must not eat (section 2.13). Your religion itself is not shown to them.

All these fields are optional. The app works without them, but it picks dishes less accurately.

2.3. Profile photo

If you choose a photo for your avatar, it is stored on our server. Members of your families see it next to your name, in the family menu and in the chat, and so do people who open an invite link to your family (section 2.13). If you are not in any family, your avatar is not shown to other users.

2.4. What is saved to your account

If you are signed in, our server keeps one snapshot of your app state so that everything can be restored on a new phone. The snapshot contains:

• the profile data from section 2.2
• your weekly menu and the dishes you picked
• your shopping list: what you added and how much to buy
• your pantry (What you have at home): products and their quantities
• which dishes you cooked and when, and your XP and level
• your progress through recipe steps and the serving size for each dish
• shopping days, reminder times and whether reminders are on
• markers showing which onboarding steps you have completed
• kids mode: whether it is on, the age band and the exit code (see section 7)
• your dish ratings

Family data (its members, the family menu, the chat and kids' profiles) is not part of this snapshot. It is stored separately, with the family (sections 2.13–2.16).

2.5. Dish ratings

After cooking, you can rate a dish from 1 to 5 stars. The rating is stored on the server under your account. The dish card shows only the average rating and the number of ratings, with no names.

When you take a dish in the deck, the server records a vote for that dish. There are no dislike votes.

2.6. Subscription, purchases and promo codes

Under your account, our server stores the date until which PRO from a promo code is active, and records of the promo codes you have redeemed.

Gustable PRO subscriptions, personal and family, are paid for through Google Play. Google processes the payment. Your card details are not passed to us, and we have no access to them. A free trial, if offered, is part of the Google Play subscription: Google Play provides and manages it, and the app has no separate trial.

If you are signed in, the app sends the Google Play purchase token to our server, and the server verifies it directly with Google through the Google Play Developer API. Google's response is stored under your account: the purchase token, the plan purchased, the subscription state (active, cancelled, on hold and so on), the date it is paid until, a link to the previous purchase if you changed plans and, for a family subscription, the family it pays for. This is how PRO works on all your devices and family PRO works for the family's members.

When you make a purchase, the app gives Google Play a pseudonymous account identifier so that the purchase is tied to your account. This identifier is a hash of your internal Gustable account number, not your email address or name. Our server receives subscription status notifications from Google (Real-time developer notifications via Google Cloud Pub/Sub) and re-checks subscriptions and refunds once a day through the Google Play Developer API. This way, PRO starts on time after payment and renewal and ends after a cancellation or a refund.

Family PRO is paid for by one family member and covers up to six adult members: the payer and the members who joined the family earliest. Kids' profiles (section 2.15) do not take up places. In the family and on the subscription screen, family members can see who paid for family PRO, the date it runs until and which members it covers.

2.7. Microphone

The app asks for audio recording permission only when you enter voice cooking mode, and only to recognise the commands next, back and repeat.

Speech recognition is handled by the Android system service (usually Google's). We do not record audio, store it or send it to our server. Voice mode is optional: every screen can be used with buttons, and nothing breaks if you deny the permission.

2.8. Dish photo

Recognising a dish from a photo is available once you sign in. The photo is sent to our server, reduced in size there and passed to the Google Gemini service, which identifies the dish. The feature cannot work without this transfer.

We do not store these photos: a photo is passed on at the moment of the request and is not saved in our database. What happens to it on Google's side is governed by Google's terms, not ours.

Please note that we use the free tier of Gemini, and for that tier Google states that request content may be used to improve its products. In other words, the photos you send may be used to train Google's models. If you are not comfortable with that, do not use this feature. It does not affect anything else in the app.

The feature is optional and runs only when you tap it. Your allergies are not sent to Google: we apply them on our side after the dish has been identified.

2.9. Weather and approximate location

To show the weather on the home screen and in the weekly menu, the app asks for access to your approximate location. It never asks for your precise location. If you allow access, the app rounds the coordinates to about 10 km (0.1°) on the phone itself and only then sends them to our server, together with the phone's time zone. Precise coordinates never leave the phone. The location is used only for the weather forecast. The app keeps the rounded location and the latest forecast on the phone so that the weather is still shown when you are offline.

Our server does not store the rounded area, either in its database or under your account. It passes the area to the MET Norway weather service (the Norwegian Meteorological Institute, api.met.no) to get the forecast. MET Norway does not receive your account or your phone's IP address, because the request to it comes from our server. The server keeps forecasts per area only in memory, with no link to you or your account, so that neighbours in the same area get the same forecast and the weather service receives one request per area rather than one per person. If the weather service does not respond, the rounded area may appear in the server's technical log, without an account or an IP address.

Weather data is provided by MET Norway under the CC BY 4.0 licence, which is why the app names the source next to the weather.

Without location access the app works as usual, just without the weather. You can revoke the permission at any time in Android settings.

2.10. What stays on your phone

The following is not sent to our server:

• the cache of recipes and their photos (so that the app works offline)
• appearance and language settings
• cooking timers

Android may copy the app's data to your Google account backup on Google Drive on its own. This is a Google service, not ours, and you can turn it on or off in Android settings.

2.11. What we do not collect

We do not collect your precise location, contacts, call history, SMS or advertising identifiers. The approximate location used for the weather is rounded to about 10 km on the phone and is not stored on our server (section 2.9). Gustable has no ads and no third-party analytics. We collect crash reports and usage statistics ourselves, on our own server, and do not pass them to anyone (see section 2.12).

Our server sees the IP address a request comes from and keeps it only in memory to limit overly frequent requests. We do not store it.

2.12. Crash reports and usage statistics

To find and fix bugs, and to see whether people get all the way to a finished dish, the app sends technical reports to our server:

• crash reports: what broke and where in the code (error type, stack trace)
• diagnostics: errors when talking to the server (the request path without parameters and the response code), store errors during payment, failed sign-ins, photos that failed to load
• in-app actions: opening the app, a screen or a dish card, adding a dish to the menu, adding missing items to the shopping list, ticking off a purchase, starting to cook, moving to the next step, finishing cooking. Each action comes with the number of the dish or product in our catalogue and a few technical values, such as the step number or how long the cooking took

Every report also includes the time and the screen where the event happened, a random installation number (created on first launch, not included in backups and replaced when the app is reinstalled), the app version, the store the app was installed from, the Android version, the phone model and the system language.

If you are signed in, the reports are linked to your account: the server adds your account identifier to them so that we can look into the problem if you contact us about it. If you use the app without signing in, the reports are linked only to the random installation number.

Reports never include your email address, name, passwords or sign-in tokens, the text you type (family chat messages, your own products, searches), your location or your IP address. In addition, the app and the server remove anything that looks like an email address, a token or a phone number from error messages. In kids mode, in-app actions are not sent, only crash and error reports.

Reports are kept in a separate database on our server and are not passed to anyone. Section 5 explains how long they are kept.

You can turn reporting off in the app settings with the Send diagnostics switch, which is on by default. While it is off, the app sends no crash reports, no diagnostics and no in-app actions.

2.13. Family

A family in Gustable is a group of people with their own accounts who decide together what to cook. Families are available only when you are signed in. Creating or joining a family is optional, and the app works as usual without one.

Our server stores the following about a family:

• the family's name, description, sticker and photo, which any adult member can set and change
• who is in the family, who owns it and when each member joined
• the family menu: votes for dishes, who is cooking, the dish and time the cook announced, the result of a dice roll and a separate dish for the kids
• the event feed: who joined, left or was removed from the family, and who changed its name or photo, added a kid's profile, announced a dish, rolled the dice or bought family PRO
• family invites (see below), kids' profiles (section 2.15) and chat messages (section 2.14)

Family members can see the following about each other:

• the name from their Google account and their avatar, if they have one
• who the owner is and when each member joined
• who votes for which dish, who is cooking and what they announced
• allergies and food restrictions from the profile on the server: the app hides dishes someone at the table must not eat and shows in the family menu who a dish does not suit
• who is covered by family PRO (section 2.6)

Family members do not see your email address, gender, year of birth, your religion itself, your personal weekly menu, shopping list, pantry (What you have at home), dish ratings, XP or level. These stay under your account (section 2.4). So that the family can be opened offline, each member's app keeps a copy of the family data on their phone and updates it when it connects to the server.

Invites. Any adult member can invite someone to the family in one of three ways:

• with a link or a code: the link is valid for 14 days and can be revoked
• by email address: the invite is valid for 30 days, and only someone who signs in to Gustable with that address will see it
• by shaking phones next to each other: only the person who is let in receives the invite, and it is valid for 10 minutes

For an email invite, the server stores the address that the inviter entered. We do not send emails: the person learns about the invite in the app or from you. The app does not ask for access to your phone's contacts.

When phones are shaken, the server matches the two phones by timing alone, without using location, Bluetooth or contacts, and keeps the shake in memory for a few seconds. Whoever shakes their phone at the same moment as you sees the family's name, sticker and photo and the inviter's name. The inviter sees that person's name and decides whether to let them in.

Anyone who opens an invite link, even without signing in, sees the family's name, description, sticker and photo, the inviter's name and the members' names and avatars. Allergies, food restrictions, kids' profiles and family PRO details are not shown in an invite. If you share the link in a messaging app, its preview may include the family's name and the inviter's name.

2.14. Family chat and reports

Families with an active family PRO subscription have a chat. You can send text (up to 1,000 characters) and a dish from the catalogue. Photos and files cannot be sent, and a sent message cannot be edited.

Messages are stored on our server. Everyone in the family can see them, including people who join later: new members see the whole chat history. The author's name and avatar are shown next to each message. The server also stores how far each member has read the chat, so that it can show the number of unread messages. The app fetches new messages from our server itself and does not use third-party notification services such as Firebase.

Messages are not end-to-end encrypted: they are stored on the server in the same way as the rest of the data (section 4). We do not read families' conversations and use them only to run the chat. The exception is messages that have been reported.

A message can be deleted by its author and by the family owner. When a message is deleted, its text and dish are erased from the server, and a Message deleted note takes its place.

You can report someone else's message and choose a reason. Reports are reviewed by a moderator, currently the developer. In the moderation panel the moderator sees only the reported messages in their current form (if a message has already been deleted, only the deletion note), the family's name, the author's name, the name of the person who reported it, the reason and the time. The rest of the family's conversation is not visible in the panel. If a message breaks the Terms of Use, the moderator deletes it in the same way an author does. The author is not told who reported them.

The chat rules are set out in the Terms of Use.

2.15. Kids' profiles in a family

A child does not create a Gustable account and does not sign in to the app. An adult family member can create a kid's profile in the family so that dishes are picked for the child too. The profile contains a name (a nickname will do), a year of birth (the app asks for the child's age) and the child's allergies. The server can also store food restrictions if they are entered. We do not ask for a photo, an email address or any other information about the child.

A child's allergies are information about their health. We use them for one purpose only: to avoid offering the family dishes the child must not eat.

All family members can see a kid's profile: the name, age and allergies. Kids' profiles are not shown in family invites. Any adult family member can create, change and delete kids' profiles. When a profile is added, an entry with the child's name appears in the family feed. If the profile is deleted, the name is removed from the feed as well.

A kid's profile belongs to the family. If the adult who created it leaves the family or deletes their account, the profile stays in the family. It is deleted when an adult member deletes it or when the family itself is deleted.

By creating a kid's profile, the adult confirms that they are the child's parent or legal guardian, or are acting with their consent (see the Terms of Use).

2.16. Family: retention, leaving and deletion

Family data is kept for as long as the family exists. Chat messages have no separate retention period: a message is kept until its author, the family owner or a moderator deletes it, or until the family is deleted.

There is no separate button for deleting a family: a family is deleted when its last member leaves. At that point its name, description and photo, its member list, invites together with email addresses, kids' profiles, the menu, the event feed, the whole chat and reports about its messages are removed from the server immediately. If the family had family PRO, the purchase stays with the payer, who can move PRO to another of their families.

When you leave a family or its owner removes you:

• you stop seeing the family, and the family stops seeing your allergies and food restrictions
• your votes in the family menu and your chat read marker are deleted, and if you were cooking, the cook's place becomes free
• your chat messages stay in the family's history with your name and avatar, as do entries in the event feed and the family menu (for example, Anna rolled the dice). If you do not want your messages to stay, delete them before you leave. If you have already left, write to us from your account's email address and we will delete your messages in that family
• if the owner leaves, the member who has been in the family longest becomes the owner

When you delete your account:

• you leave all your families as described above. If you were the last member of a family, the family is deleted entirely
• your messages in family chats stay, but without your name and avatar, like messages from a deleted user. If you do not want them to stay, delete them beforehand
• your reports and the records of your Google Play purchases on our server are deleted. Family PRO that you paid for ends for the family immediately, and the Google Play subscription has to be cancelled separately
• kids' profiles you created and invites you sent stay with the family, because they were created and issued by the family, not by you personally

3. Who we share data with

We do not sell data or pass it to advertisers. Data is received only by those the app cannot work without and by the people you choose to share it with in a family:

• Google: account sign-in (Google Sign-In), speech recognition and synthesis in voice mode, subscription payments through Google Play and, if you use it, dish recognition from a photo (Gemini). Google determines the payment terms and how payment data is processed. The Google Play services libraries that sign-in and payment run on may send diagnostic data to Google under Google's privacy policy.
• Google Play Developer API and Google Cloud Pub/Sub: our server uses them to check purchases and subscriptions. It sends the purchase token to Google and receives the purchase's state and expiry, subscription status notifications and refund information (section 2.6). When you make a purchase, Google Play receives a hash of your internal Gustable account number, not your email address or name.
• MET Norway (the Norwegian Meteorological Institute, api.met.no) receives from our server an area rounded to about 10 km so that it can return a weather forecast (section 2.9). It does not receive your account or your phone's IP address.
• Members of your family see what is described in sections 2.13–2.15: your name, avatar, allergies and food restrictions, votes in the family menu, chat messages and kids' profiles. Anyone who opens an invite link to your family sees the family's name and photo and the members' names and avatars.
• Our server is a rented server that runs Gustable Service. Only the developer has access to it. Crash reports and usage statistics (section 2.12) are also kept there, in a separate database, and are not passed to third-party analytics services. Reported chat messages are seen by a moderator, currently the developer (section 2.14).

We may disclose data where the law requires it.

4. How your data is protected

All requests between the app and the server go over a secure connection (HTTPS). Your data on the server can be accessed only with your token, which is issued when you sign in, and a family's data only with its members' tokens. The exceptions are what an invite link shows, and images: family photos and avatars open by link without signing in, but each such link contains a random identifier known only to the people the app has shown the image to.

No one can guarantee complete protection, and we will not promise it. What we do promise is to collect the minimum and store nothing beyond it.

5. How long we keep data

Data is kept for as long as your account exists. When you delete your account, the account and the data under it are removed from the server immediately. The exception is what remains with your families: chat messages (without your name), kids' profiles you created and invites you sent (section 2.16). Server backups are overwritten on a rotating basis, so the data disappears from them within 30 days.

Family data is kept for as long as the family exists and is deleted with it. Chat messages are kept until their author, the family owner or a moderator deletes them. Email addresses in invites are kept for as long as the family exists, including after an invite has expired or been declined or revoked. A report is kept for as long as both the message and the reporter's account exist. Google Play purchase records are kept for as long as the payer's account exists. A phone shake stays in the server's memory for a few seconds and is never written anywhere. Deleted data disappears from backups within the same 30 days.

Crash reports and usage statistics (section 2.12) are deleted automatically: in-app actions after 30 days, crash and error reports after 90 days. When you delete your account, the account identifier is removed from these reports within a day. The remaining records are linked only to the random installation number and are deleted on the same schedule.

6. Your rights

At any time, you can:

• view and change your data in the profile settings in the app
• delete your account and the data under it in the app, under Profile → Delete account (section 2.16 explains what stays with families)
• delete your account without installing the app, on the page https://gustables.xyz/en/account-deletion
• delete your messages in a family chat and leave a family in the family section of the app. A family owner can delete any message and remove a member, and an adult member can change or delete a kid's profile
• report a message in a family chat with the Report button on the message
• withdraw permissions (microphone, location, notifications) in Android settings
• turn off crash reports and usage statistics (section 2.12) with the Send diagnostics switch in the app settings
• write to us at egorkabercuk@gmail.com about anything concerning your data

Deleting your account is irreversible: your menu, shopping list, picked dishes, ratings and accumulated XP cannot be restored.

Deleting your account does not cancel a Google Play subscription automatically. You have to cancel it separately in your Google Play subscription settings. This also applies to a family subscription: the family loses family PRO as soon as the payer's account is deleted, but Google Play keeps charging until the subscription is cancelled.

7. Children

Gustable is meant for users aged 13 and over and is not intended for children under 13.

The app has a kids mode. An adult turns it on from their own phone so that a child can cook under their supervision, and sets a four-digit exit code. In kids mode the child does not create an account, and the mode collects no information about the child. The adult's account stores only the mode's settings: whether it is on, the age band the adult chose and the exit code. While kids mode is on, the app does not send in-app actions or screen views (section 2.12), only technical crash and error reports.

In a family, an adult can create a kid's profile (section 2.15). It is not an account: the child does not sign in to the app, does not write in the chat and does not tell us anything about themselves. The child's name, year of birth and allergies are entered by an adult. Family members can see them, and we use them only to pick dishes.

If you believe that a child under 13 has given us their data, or you want a profile of your child that someone else created to be deleted, write to egorkabercuk@gmail.com and we will delete it.

8. Changes

If this policy changes, we will publish the new version on this page and state at the top both the version date and the date it takes effect. We will announce the changes in the app before they take effect.