Privacy Policy

Overview

Gratin is a personal recipe manager available as a desktop app (macOS & Windows), mobile app (iOS & Android), and Chrome extension. It is made by Reb Software Limited, a New Zealand company (company number 8243306, NZBN 9429049945768) at 6 Ocean View Rise, Ruakaka 0116, New Zealand, and when this policy says "we", "us" or "our", that is who it means. Gratin is built, from the ground up, to keep your recipes private and in your hands. This policy explains, in plain language, what little data Gratin handles and the commitments we make to you. It covers the apps and the extension, the optional account and hosted sync, and this website.

Our promise to you

We make money from an optional sync subscription, never from your data. We do not, and will not:

• sell, rent, or trade your personal information;
• show you ads, or work with advertising or data-broker networks;
• build a profile of you or of what you cook;
• track you across other apps or websites; or
• share your data with anyone, beyond the minimal infrastructure needed to run a feature you have asked for.

The few companies whose infrastructure we use for that are each named in this policy, and each is bound to protect what it receives at least as well as this policy promises. Wherever a line in this policy could be read two ways, read it as the one that favours you. That is the intent behind all of it.

Local-first architecture

Gratin is a local-first application. All of your content (recipes, recipe books, magazines, menus, grocery lists and meal plans) lives on your device. The app needs no account to use it. An account is optional and exists for one thing only, hosted sync: it is a username and a password, and we never ask for an email address. Used without one, Gratin collects no personal information about you. The one thing it reveals is the network address that an update check shows our update server, described under Desktop & mobile apps below.

Sync

A fresh install syncs nothing and sends nothing anywhere. Sync is off until you turn it on, and there are two ways to do that.

Simple mode is hosted sync. Nothing leaves your device until you create a Gratin account with an active plan, at which point the app connects to the relay we run on Cloudflare's global edge network. The relay stores an end-to-end encrypted copy of your data, so your devices stay in sync and you can recover everything on a new device. It cannot read your recipes or any other content: the data is encrypted on your device with a key only you hold, so the relay only ever holds scrambled data that neither we nor Cloudflare can read. Because the edge is spread across many locations worldwide, we make no claim about where any particular encrypted blob physically rests, and it does not matter: no location holds anything readable.

Advanced mode is a relay you choose. You can point Gratin at a relay you run yourself, or at any other Evolu-compatible relay. If you switch to Advanced mode and leave the relay address empty, the app uses the public Evolu relay at evoluhq.com, which is run by the Evolu project, not by us; it too only ever holds the end-to-end encrypted copy, and its own policies cover what it does with the connection.

Because Gratin is local-first, your own devices remain the source of truth. You can switch relays or turn sync off entirely at any time, and your data remains fully functional on your device without any relay connection.

Accounts

You only need an account for hosted sync. Here is everything we store for one:

• your username;
• salted verifiers for your password and for your one-time recovery code, which let our server check them without ever knowing them;
• an encrypted escrow of your sync code, which only your password or your recovery code can open;
• your subscription record: which plan you are on and whether it is active; and
• an identifier for your encrypted copy and how much storage it uses.

That is the whole list. There is no email address, no name and no payment details. Your password never leaves your device, so we cannot reset it: if you lose it, the recovery code is the only way back in. None of this is, or can be, linked to the content of your recipes, which reaches us only as end-to-end encrypted data we cannot read.

AI connectors

Gratin can be linked to an AI assistant, such as Claude or ChatGPT, through its MCP connector. That is the one thing besides your own devices that can read your recipes, and only because you switched it on. While the connector is on, a server of ours (a process on Cloudflare that exists for your account alone) keeps a readable, decrypted working copy of your recipe books, because that is what the assistant works from when it answers a question or makes a change for you. The AI service you connected sees whatever the assistant reads, under that service's own privacy policy. Nothing is linked unless you authorise it yourself. Switching the connector off, from the app, erases that copy; so does deleting your account.

Paid sync and payments

Paid sync is the one part of Gratin that involves a little more. Payment is handled by Polar, our merchant of record; we do not see or store your card details. Polar collects the billing details it needs to take payment and issue your invoice, and Polar's privacy policy covers them. If you buy inside the iOS or Android app instead, the purchase is handled by Apple or Google under their own privacy policies, and we receive only a purchase identifier, which we use to confirm your plan. To run your plan, our systems keep only the minimum needed: the identifier for your encrypted copy and how much storage it is using, as listed under Accounts. That is never linked to the content of your recipes, which stays end-to-end encrypted and unreadable to us. If you cancel, the encrypted copy stays on our relay so that sync resumes if you come back, and deleting your account is what removes it; your own devices keep everything either way.

This website

gratin.app, the site you are reading, is a static site with no analytics and no cookies of ours. Two things on it involve another company:

• The launch-interest form. If you give us your email address to hear when Gratin launches, the form sends it to Web3Forms, a form-to-email service, which passes it on to us. We use it once, to tell you about launch, and then delete it. Web3Forms' own privacy policy covers its part in passing it on.
• Fonts. Every page loads its typefaces from Google Fonts, so Google's servers see your device's network address when a page loads, as any server you fetch from must. Google's privacy policy covers that. We send Google nothing else.

Chrome extension

The Gratin Recipe Clipper Chrome extension reads the content of web pages you visit to detect structured recipe data (such as JSON-LD and Microdata). This processing happens entirely within your browser. No page content is sent to our servers.

When you choose to save a recipe, the extension temporarily stores the recipe data in local browser storage to transfer it to the Gratin app. This temporary data is automatically deleted after use.

The extension also fetches recipe images from their original hosts to convert them to a portable format. No browsing history or page content is collected, stored, or transmitted beyond what is needed to clip the specific recipe you choose to save.

Desktop & mobile apps

The desktop and mobile apps may periodically check for available updates by contacting our update server. These requests include your current app version and platform. No personal data is sent during update checks.

As with any online connection, reaching our update or sync servers reveals your device's network address to that server, as it must for the response to come back. We use it only to deliver what you asked for, never to track or profile you.

Analytics & tracking

Gratin uses no third-party analytics, no advertising trackers, and no tracking cookies. We do not measure what you do inside the app or build any picture of you from it. We would rather not know.

The app sends no crash reports either. If it fails, the only record is on your device, and the only way it reaches us is if you choose to email support.

Data security

All communication with a relay or our servers uses encrypted connections (HTTPS and WSS). Anything that passes through a relay is end-to-end encrypted and cannot be read by the relay operator, including us. There are two secrets involved, and it helps to know which is which:

• Your sync code (the app also calls it your recovery phrase) is a set of words the app generates on your device the first time it runs, and your encryption key comes from it. If you run your own relay, it is what restores your recipes on a new device. We never have it in the clear, so it is the one thing we cannot recover for you.
• Your recovery code, if you have an account, is the one-time code shown when you sign up. With an account you never handle the sync code yourself: we keep it in an escrow that only your password can open, and the recovery code opens the same escrow, so it is your way back in if you forget your password. We hold neither your password nor your recovery code, only verifiers for them, so we cannot open the escrow ourselves.

Keep whichever of them you have somewhere safe.

Your rights and control

Because your data lives on your device, you hold the controls, not us:

• Access and export: your recipes are yours to read and export at any time, as open JSON-LD or a full SQLite copy of your database.
• Delete: remove any data, or all of it, from within the app. If you have an account, you can delete that from Settings too. Know first that deleting the account erases Gratin's data from every device signed in to it, not only the one you delete from, so export anything you want to keep; see how to delete your account. There is nothing you need to request from us, though we will help if you cannot open the app.
• Relays: switch relays, self-host, or turn sync off whenever you like.

We are a New Zealand company, so the Privacy Act 2020 governs how we handle personal information, and if you are unhappy with how we have handled a request you can complain to the Office of the Privacy Commissioner at privacy.org.nz. Where the GDPR, the UK GDPR, the CCPA or another data-protection law gives you more, we honour that in full, and Gratin's design already puts most of those rights in your hands by default. If you are ever unable to exercise a right yourself, contact us and we will help.

Changes to this policy

We may update this policy from time to time. If we ever make a change that would reduce your privacy or widen what we handle, we will say so clearly and give you notice, not bury it. The current version always lives here, with its effective date.

Contact

This policy is issued by Reb Software Limited, 6 Ocean View Rise, Ruakaka 0116, New Zealand. If you have any questions about it, or want help exercising any right above, contact us at [email protected].