Privacy Policy

Overview

Gratin is a personal recipe manager available as a desktop app (macOS & Windows), mobile app (iOS & Android), and Chrome extension. It is made by Reb Software Limited, a New Zealand company (company number 8243306, NZBN 9429049945768) at 6 Ocean View Rise, Ruakaka 0116, New Zealand, and when this policy says "we", "us" or "our", that is who it means. Gratin is built, from the ground up, to keep your recipes private and in your hands. This policy explains, in plain language, what little data Gratin handles and the commitments we make to you. It covers the apps and the extension, the optional account and hosted sync, and this website.

Our promise to you

We make money from an optional sync subscription, never from your data. We do not, and will not:

• sell, rent, or trade your personal information;
• show you ads, or work with advertising or data-broker networks;
• build a profile of you or of what you cook;
• track you across other apps or websites; or
• share your data with anyone, beyond the minimal infrastructure needed to run a feature you have asked for.

The few companies whose infrastructure we use for that are each named in this policy, and each is bound to protect what it receives at least as well as this policy promises. Wherever a line in this policy could be read two ways, read it as the one that favours you. That is the intent behind all of it.

Local-first architecture

Gratin is a local-first application. All of your content (recipes, recipe books, magazines, menus, grocery lists and meal plans) lives on your device. The app needs no account to use it. An account is optional and exists for one thing only, hosted sync: it is a username and a password, and we never ask for an email address. Used without one, Gratin collects no personal information about you. The one thing it reveals is the network address that an update check shows our update server, described under Desktop & mobile apps below.

Sync

A fresh install syncs nothing and sends nothing anywhere. Sync is off until you turn it on, and there are two ways to do that.

Simple mode is hosted sync. Nothing leaves your device until you create a Gratin account with an active plan, at which point the app connects to the relay we run on Cloudflare's global edge network. The relay stores an end-to-end encrypted copy of your data, so your devices stay in sync and you can recover everything on a new device. It cannot read your recipes or any other content: the data is encrypted on your device with a key only you hold, so the relay only ever holds scrambled data that neither we nor Cloudflare can read. Because the edge is spread across many locations worldwide, we make no claim about where any particular encrypted blob physically rests, and it does not matter: no location holds anything readable.

Advanced mode is a relay you choose. You can point Gratin at a relay you run yourself, or at any other Evolu-compatible relay. If you switch to Advanced mode and leave the relay address empty, the app uses the public Evolu relay at evoluhq.com, which is run by the Evolu project, not by us; it too only ever holds the end-to-end encrypted copy, and its own policies cover what it does with the connection.

Because Gratin is local-first, your own devices remain the source of truth. You can switch relays or turn sync off entirely at any time, and your data remains fully functional on your device without any relay connection.

Accounts

You only need an account for hosted sync. Here is everything we store for one:

• your username;
• salted verifiers for your password and for your one-time recovery code, which let our server check them without ever knowing them;
• an encrypted escrow of your sync code, which only your password or your recovery code can open;
• your subscription record: which plan you are on and whether it is active; and
• an identifier for your encrypted copy and how much storage it uses.

That is the whole list. There is no email address, no name and no payment details. Your password never leaves your device, so we cannot reset it: if you lose it, the recovery code is the only way back in. None of this is, or can be, linked to the content of your recipes, which reaches us only as end-to-end encrypted data we cannot read.

AI connectors

Gratin can be linked to an AI assistant, such as Claude or ChatGPT, through its MCP connector. That is the one thing besides your own devices that can read your recipes, and only because you switched it on. While the connector is on, a server of ours (a process on Cloudflare that exists for your account alone) keeps a readable, decrypted working copy of your recipe books, because that is what the assistant works from when it answers a question or makes a change for you. The AI service you connected sees whatever the assistant reads, under that service's own privacy policy. Nothing is linked unless you authorise it yourself. Switching the connector off, from the app, erases that copy; so does deleting your account.

Paid sync and payments

Paid sync is the one part of Gratin that involves a little more. Payment is handled by Polar, our merchant of record; we do not see or store your card details. Polar collects the billing details it needs to take payment and issue your invoice, and Polar's privacy policy covers them. If you buy inside the iOS or Android app instead, the purchase is handled by Apple or Google under their own privacy policies, and we receive only a purchase identifier, which we use to confirm your plan. To run your plan, our systems keep only the minimum needed: the identifier for your encrypted copy and how much storage it is using, as listed under Accounts. That is never linked to the content of your recipes, which stays end-to-end encrypted and unreadable to us. If you cancel, the encrypted copy stays on our relay so that sync resumes if you come back, and deleting your account is what removes it; your own devices keep everything either way.

This website

gratin.app uses limited, cookieless website analytics. We currently enable this automatically for visitors Cloudflare locates in the United States, Canada, Australia and New Zealand. In other regions, including Germany, the rest of the EEA, the UK and Switzerland, we show an analytics choice and keep measurement off until you choose “Allow analytics”. If your region cannot be determined, we ask first too. Once you choose, we remember your answer rather than ask on each page. Use “Website analytics settings” at the bottom of any page to change it. Your choice does not affect signup or the app.

• Limited website analytics. When measurement is enabled, we use Plausible Analytics to understand which pages and campaigns lead to successful signup requests, and whether website changes help. We send page paths, campaign labels, external referring website names, form placement, website release and the device categories selected on the beta form. We do not send email addresses, free-text answers, advertising click identifiers or account details to Plausible.
• Plausible processes analytics in the EU. It derives device/browser categories and approximate location from the connection and uses a daily, website-specific identifier to group visits. It stores event and session records to produce statistics, without retaining raw IP addresses or tracking you across days, websites or devices. We do not enable session recordings or advertising pixels.
• Your choice and campaign context. We save your analytics choice in this browser for up to six months. We do not save campaign information in browser storage. When measurement is enabled, sanitized campaign labels travel in links between our pages and can accompany signup requests. Referrer information is the external website referring the current page; internal referrals are excluded. We do not store advertising click IDs or a persistent visitor ID. Cloudflare supplies a country classification for the regional switch; we do not save that lookup in a tracking database.
• Signup forms. Our beta and launch-interest forms send the information you enter through Web3Forms, which emails it to us. Beta requests include your device choices and any optional answers. Each form identifies where it appears on the site. When measurement is enabled, it also includes the campaign context described above. We use beta details to send testing links and respond about the beta and launch. Launch-interest addresses are used to announce launch, then deleted. You can ask us to delete your details at any time. Web3Forms’ own privacy policy covers its processing.
• Fonts. Every page loads its typefaces from Google Fonts, so Google’s servers see your device’s network address when a page loads. Google’s privacy policy covers that. We do not install Google Analytics on this website.

Analytics counts accepted form submissions, not whether someone installed or used Gratin. Browser blocking, regional settings and analytics choices mean those counts may differ from the signup emails we receive. Website measurement does not change the apps’ privacy behavior.

Chrome extension

The Gratin Recipe Clipper Chrome extension reads the content of web pages you visit to detect structured recipe data (such as JSON-LD and Microdata). This processing happens entirely within your browser. No page content is sent to our servers.

When you choose to save a recipe, the extension temporarily stores the recipe data in local browser storage to transfer it to the Gratin app. This temporary data is automatically deleted after use.

The extension also fetches recipe images from their original hosts to convert them to a portable format. No browsing history or page content is collected, stored, or transmitted beyond what is needed to clip the specific recipe you choose to save.

Desktop & mobile apps

The desktop and mobile apps may periodically check for available updates by contacting our update server. These requests include your current app version and platform. No personal data is sent during update checks.

As with any online connection, reaching our update or sync servers reveals your device's network address to that server, as it must for the response to come back. We use it only to deliver what you asked for, never to track or profile you.

Analytics & tracking

The Gratin apps and Chrome extension use no third-party analytics, advertising trackers or tracking cookies. We do not measure what you do inside the app or build any picture of you from it. We would rather not know.

The app sends no crash reports either. If it fails, the only record is on your device, and the only way it reaches us is if you choose to email support.

Data security

All communication with a relay or our servers uses encrypted connections (HTTPS and WSS). Anything that passes through a relay is end-to-end encrypted and cannot be read by the relay operator, including us. There are two secrets involved, and it helps to know which is which:

• Your sync code (the app also calls it your recovery phrase) is a set of words the app generates on your device the first time it runs, and your encryption key comes from it. If you run your own relay, it is what restores your recipes on a new device. We never have it in the clear, so it is the one thing we cannot recover for you.
• Your recovery code, if you have an account, is the one-time code shown when you sign up. With an account you never handle the sync code yourself: we keep it in an escrow that only your password can open, and the recovery code opens the same escrow, so it is your way back in if you forget your password. We hold neither your password nor your recovery code, only verifiers for them, so we cannot open the escrow ourselves.

Keep whichever of them you have somewhere safe.

Your rights and control

Because your data lives on your device, you hold the controls, not us:

• Access and export: your recipes are yours to read and export at any time, as open JSON-LD with your photos included.
• Delete: remove any data, or all of it, from within the app. If you have an account, you can delete that from Settings too. Know first that deleting the account erases Gratin's data from every device signed in to it, not only the one you delete from, so export anything you want to keep; see how to delete your account. There is nothing you need to request from us, though we will help if you cannot open the app.
• Relays: switch relays, self-host, or turn sync off whenever you like.

We are a New Zealand company, so the Privacy Act 2020 governs how we handle personal information, and if you are unhappy with how we have handled a request you can complain to the Office of the Privacy Commissioner at privacy.org.nz. Where the GDPR, the UK GDPR, the CCPA or another data-protection law gives you more, we honour that in full, and Gratin's design already puts most of those rights in your hands by default. If you are ever unable to exercise a right yourself, contact us and we will help.

Changes to this policy

We may update this policy from time to time. If we ever make a change that would reduce your privacy or widen what we handle, we will say so clearly and give you notice, not bury it. The current version always lives here, with its effective date.

Contact

This policy is issued by Reb Software Limited, 6 Ocean View Rise, Ruakaka 0116, New Zealand. If you have any questions about it, or want help exercising any right above, contact us at consult@reb.nz.