Terms of Service

Overview

Thank you for using Gratin. It is made by Reb Software Limited, a New Zealand company (company number 8243306, NZBN 9429049945768) at 6 Ocean View Rise, Ruakaka 0116, New Zealand, and when these terms say "we", "us" or "our", that is who they mean. The company is run by one person, Russell, so we cannot know everyone who uses Gratin personally, and that is why a document like this exists: to say once, and plainly, what you can expect from us and what we ask of you in return.

When these terms say "Gratin", they mean the Gratin app for macOS, Windows, iOS and Android, the Gratin Recipe Clipper extension for Chrome, the optional Gratin account, and hosted sync, which is the one part of Gratin you can pay for. "You" means the person using Gratin or holding the account.

By creating an account or buying hosted sync you agree to these terms. If you only ever use the free app, without an account, the parts that concern you are the licence in the next section and the sections on your content, bugs and liability; the rest is about the account and the service. We have tried to write all of it the way we would want to read it: short, plain and honest. Our privacy policy is a separate document that explains what little data Gratin handles, and it is worth the five minutes. These terms do contain a limitation of our liability; it is in the section of that name.

Gratin is local-first. Your recipes live on your own devices, and nothing in these terms changes that. Most of what follows is about the small part we run for you: the account, and the relay that carries an end-to-end encrypted copy between your devices.

The Gratin app

The Gratin app is free, on every platform, with no limit on how many recipes you keep. It is really free: we do not ask for a card, there is no trial that runs out, and, just as for the people who pay us for sync, we do not sell your data.

We grant you a personal, non-exclusive licence to install and use Gratin on any number of devices you control. You may use it for any kind of cooking, including commercial cooking: a cafe, a caterer or a test kitchen is as welcome as a home cook. The Chrome extension is part of the app and is covered by the same licence.

We plan to publish Gratin's source code under an open-source licence. Once we do, that licence governs the code, and it can only give you more freedom than this one, never less. The Gratin name and logo stay ours either way; ask before using them to promote something.

If you installed Gratin from the App Store or Google Play, that store's terms also apply, to the app you downloaded from it and to any purchase you make in it. Where those terms and these say different things about that app or that purchase, the store's terms win. For the iOS app, Apple's standard Licensed Application End User License Agreement governs the licence wherever it differs from these terms, and Apple is a third-party beneficiary of these terms and may enforce them against you.

Account terms

1. You do not need an account to use Gratin. An account exists for one thing, hosted sync, and if you never take hosted sync you never need one.
2. An account is a username and a password. We do not ask for an email address and we never collect one. Your password never leaves your device: what our server holds is a set of salted verifiers, which let it check your password or recovery code without knowing either, and an encrypted escrow of your sync code (the recovery phrase that encrypts your data) that only your password or your one-time recovery code can open.
3. That design has one consequence you should know before you sign up: we cannot reset your password. If you forget it, the recovery code is the only way back in, so keep it somewhere safe. Your recipes are on your own devices either way.
4. You are responsible for keeping your password and recovery code to yourself. If you let them out, you are responsible for what is done with them; we stay responsible for our own failures. If you think someone else has got into your account, tell us at once.
5. Because we hold no email address or name for an account, we can only act on it (cancel a plan, delete it, look into a problem) for someone who proves they control it, usually by signing in. We never delete an account as a sanction or on anyone else's say-so; we delete one only at the request of the person who proves they control it, and the in-app path is the only one that erases devices.
6. You must be a human. Accounts registered by bots or other automated means are not permitted.

Acceptable use

Hosted sync is for the data the Gratin app produces: your recipes, photos, tags, grocery lists, magazines, menus and meal plans. Please do not:

• use the relay to store or move anything other than what Gratin itself produces;
• try to break into, overload or otherwise interfere with the relay, or with anyone else's account or sync;
• work around the storage allowance;
• resell hosted sync, or bundle it into something you charge other people for; or
• use hosted sync for anything unlawful.

If an account is used in those ways we may suspend its hosted sync, and you can email us to talk about it. If we suspend a plan and do not lift the suspension, we refund the unused part of the plan pro rata, unless the use was unlawful or deliberate. Suspension is the whole of our power. The only thing that ever clears Gratin's data from a device is deletion of the account it is signed in to, and only the account holder can trigger that (see Deleting your account); a suspension never touches your devices.

Hosted sync

Gratin syncs across your devices through an Evolu-compatible relay, and you can run that relay yourself for free. Hosted sync is our offer to run it for you: no server to manage, every device in step, everything end-to-end encrypted so that we cannot read it. There are two plans:

• Hosted sync, yearly. A subscription. Payment is charged when you buy. It renews for another year, at the price then current, unless you turn auto-renew off at least 24 hours before the current year ends, and the renewal is charged within the 24 hours before it ends. You manage it where you bought it: in Apple Account Subscriptions, in Google Play Subscriptions, or in Polar's customer portal. Where the law where you live limits renewal terms or requires a reminder before a renewal, that law applies instead of this paragraph.
• Buy once. Paid one time, with no renewals. It includes hosted sync for the life of Gratin 1, and for at least five years from the day you buy it, whichever is longer.

The price of each plan is shown where you buy it: on gratin.app, in the App Store or in Google Play, in your local currency. Any sales tax or VAT is handled by whoever takes your payment and is included in what you see there.

Both plans include about 50 GB of hosted storage, room for roughly 100,000 recipes with a photo. The recipes on your own devices have no limit; the allowance is for the encrypted copy we host, which is nearly all photos. If you reach it, new changes pause until you make room. We never delete anything already synced to make space.

"The life of Gratin 1" means for as long as we ship updates to Gratin 1 or run hosted sync for it, whichever is later. If a Gratin 2 ever comes, it will be a separate product, and buy-once customers will be offered a discounted upgrade to it. We do not intend to retire Gratin 1 inside your five years. If we ever must, we give the notice described under Modifications and refund the unexpired part of the five years pro rata, counted against the five-year term from the day you bought. Whenever Gratin 1 is eventually retired, your recipes are already on your devices and you can export them or self-host. You may lose the convenience, never the data.

Whichever way you buy, the plan belongs to your Gratin account, not to one device, so it covers every device you sign in to.

Payment, refunds and plan changes

There are three ways to buy hosted sync, and the same two plans are on offer in each. Which one you used decides who takes your money, who handles the tax on it, and who can give it back.

• On the website or in the desktop app, through Polar, our merchant of record. Your payment contract is with Polar, and Polar's buyer terms govern the payment itself. Polar issues your invoice, collects any sales tax or VAT that applies where you live, and holds the billing details it needs to take payment. We never see your card number.
• In the iOS app, through Apple In-App Purchase. Apple takes the payment under its own terms, bills you, and handles any tax. We receive only a purchase identifier, which we use to confirm your plan.
• In the Android app, through Google Play Billing. Google takes the payment under the Google Play terms, bills you, and handles any tax. As with Apple, we receive only a purchase identifier.

Where these terms and a store's terms say different things about a purchase made in that store, the store's terms win for that purchase, as The Gratin app says above.

Here is our refund policy in full. It differs by channel, because only the party that took a payment can give it back:

• Bought through Polar. Within 14 days of the first time you buy each plan, we refund it in full, no questions asked. Email [email protected] with the username the plan is on. After 14 days, the yearly plan can still be cancelled at any time; it runs to the end of the period you have paid for, then stops, and the unused part is not refundable under this policy. After 14 days, the buy-once plan is not refundable under this policy. Your statutory rights are unaffected either way.
• Bought through Apple. Apple refunds App Store purchases under Apple's own policy, and only Apple can issue one; ask at reportaproblem.apple.com. Our 14-day guarantee covers payments we took ourselves, so it does not extend to a purchase made through Apple. We say so here so that it is not a surprise later.
• Bought through Google. Google can refund a purchase itself within 48 hours, from your order history in the Play Store. After that, email us with your username and we will refund through the Play Console, on the same 14-day rule as Polar.
• If we discontinue hosted sync inside the five years promised on the buy-once plan, or inside a period you have already paid for on the yearly plan, we refund the unexpired part pro rata. For a Polar or Google purchase that happens automatically, without you having to ask. For an Apple purchase only Apple can move the money: we tell Apple, and we support your refund request to Apple; if Apple declines it, email us and we will agree another way to pay you back.

The 14-day window covers the first time you buy a plan, not a renewal, so if you would rather not be renewed, cancel before the renewal date. That said, the edges are always case by case. If something outside these rules has gone wrong with a Polar or Google purchase, for example a renewal you meant to cancel and have not synced since, email us; we would rather be fair than technical.

If you are on the yearly plan and want to buy once instead, we do not want you to pay twice for the same stretch of time. For a plan bought through Polar or Google, email us and we credit the unused part of your year against the buy-once price. For a plan bought through Apple, buy once and then ask Apple to refund the unused part of the year; Apple decides that under its own policy, because we cannot refund an Apple purchase.

Nothing here removes any right you have under the New Zealand Consumer Guarantees Act 1993 or the consumer law where you live. If the service is faulty, those laws apply on top of the above.

Cancellation and termination

We want satisfied customers, not hostages. Cancelling is done where you bought, and needs no phone call and no reason:

• Polar: open Gratin on your desktop and choose "Manage billing" in your account settings, which opens Polar's customer portal, or use the links in the emails Polar sent you when you bought. If you get stuck, email us and we will cancel it for you.
• Apple: on your iPhone or iPad, open Settings, tap your Apple Account, then Subscriptions. Only you can cancel an Apple subscription; we cannot do it from our side.
• Google: open the Play Store, go to Subscriptions, and cancel there.

The buy-once plan has nothing to cancel; it simply runs its term.

When a plan ends, here is what happens:

• Sync pauses. Your devices stop exchanging changes through our relay.
• Every recipe, photo, list, magazine, menu and meal plan stays on your own devices, exactly as it was. Nothing is held back.
• The encrypted copy stays on our relay, so that sync simply resumes if you come back. Deleting the account is what removes it.
• Your account stays until you delete it, so you can return later with the same username.
• You can export everything, or point Gratin at a relay you run yourself, at any time, before or after.

On our side, the only thing we ever end is hosted sync, and only for the reasons in Acceptable use. We do not close accounts on our own initiative, and nothing we do from our side ever clears Gratin's data from a device: the only thing that does that is deletion of the account the device is signed in to, which only the account holder triggers.

Deleting your account

You can delete your account from inside the app: open Settings, choose the Sync tab, and in the Account panel choose "Delete account", then type your username to confirm. It takes effect immediately and cannot be undone.

Deleting an account erases everything, on our side and on yours:

• the account, its username, and your subscription record;
• every synced copy on our relay, including recipe books you shared with other people, who lose access to them;
• the readable copy held for any AI connector you had switched on;
• Gratin's data on the device you delete from, which is wiped as part of the deletion; and
• Gratin's data on every other device signed in to the account, each of which wipes its copy the next time it opens.

So export first. If there is anything you want to keep, take a JSON-LD or SQLite export before you delete; there is no grace period and nothing to recover afterwards. If what you actually want is to stop paying, cancel the plan and keep the account, or simply turn sync off; your recipes stay put either way.

On money: deleting the account asks Polar to stop a yearly plan renewing, and the time left on it is not automatically refunded, though the refund rules above still apply, including the 14-day window on a first purchase. A subscription bought through Apple or Google is controlled by the store, so cancel it there too, or the store may renew it. A buy-once plan has nothing to cancel; deleting the account detaches it. A buy-once purchase made through Apple or Google stays on your store account, and "Restore purchases" in Settings attaches it to a new Gratin account if you ever create one. A buy-once plan bought through Polar is tied to the account it was bought under, so if you want to keep it, email us before you delete. Polar, Apple and Google keep whatever payment records tax law requires them to keep; those never held your recipes or your password.

The step-by-step version, and what we can and cannot do if you cannot open the app, is on the delete your account page.

Modifications to the service and prices

Gratin will keep changing. We add features, improve them, and sometimes remove ones that did not work out. We reserve the right to change or discontinue any part of Gratin, but with two promises attached. Because Gratin is local-first, no change we make to hosted sync can take your recipes away from you. And if we ever have to discontinue hosted sync, or retire Gratin 1, we will:

• give you at least 90 days' notice, in the app;
• keep export working the whole time, so you can take everything with you;
• honour the five-year floor on the buy-once plan: if the service ends before your five years are up, we refund the unexpired part of the five years pro rata, counted against the five-year term from the day you bought; and
• refund anyone on the yearly plan for the part of their paid period that falls after the end date.

Those refunds follow the channel rules under Payment: automatic through Polar and Google, and for an Apple purchase we tell Apple and support your refund request to Apple, with our own arrangement if Apple declines.

Prices can change for new purchases. A change never touches a buy-once plan you already hold. A change to the yearly price applies to you only from a renewal, and only after we have given you at least 30 days' notice, in the app and through whoever bills you.

Whatever happens to us, the safety net is the architecture: your recipes live on your devices, they export to open formats, the relay can be run by anyone, and the code is on its way to being open source. If our own maths ever catches up with us, you lose nothing and point the app elsewhere.

Uptime, security and privacy

Hosted sync is provided as is and as available. We take its uptime seriously, but we offer no service-level agreement, and we cannot promise it will be there every minute of every day. Local-first means that matters less than it would elsewhere: when the relay is unreachable, Gratin keeps working on every device and catches up when it is back.

Everything that reaches our relay is encrypted on your device first, with a key only you hold, and travels over encrypted connections. The relay stores and carries ciphertext it cannot read, and there is no support mode, admin view or spare key on our side that changes that. The one exception is one you control, and it is described two paragraphs down. What we can see for an account is what the privacy policy lists: the username, the verifiers, the encrypted escrow, your plan, and how much storage the encrypted copy is using. We look at that only to help with a request you make, to fix something that has broken, or to keep the relay safe for everyone.

We use Cloudflare to run the relay and our servers, Polar to take payments on the website and desktop, and Apple and Google to take payments in their stores. That is the whole list of companies involved in hosted sync, and none of them can read your recipes. While an AI connector is on, the AI service you connected joins that list, and it can read what the assistant reads.

The exception is an AI connector you turn on yourself. If you link Gratin to an assistant through its MCP connector, a server of ours keeps a readable copy of your recipe books for as long as the connector is on, because that is what the assistant works from, and the assistant's maker (whichever AI service you connected) sees whatever the assistant reads. It exists because you asked for it. Switch the connector off and the copy is erased; deleting your account erases it too.

If a New Zealand authority ever compels us by lawful order to hand over what we hold for an account, what we hold is the list above and the ciphertext; we have no key and cannot produce a readable recipe for anyone, except that while an AI connector is on, the readable copy it works from exists on our server and could be the subject of such an order too. We will not hand over anything without a binding New Zealand order, and if we are allowed to, we will post a notice in the app. Cloudflare, which stores the relay's data and holds only ciphertext, could be ordered directly under its own policies.

Our privacy policy describes all of this in more detail. You agree that we may handle your data as it describes, and for no other purpose.

Copyright and content ownership

Your recipes, photos, notes, tags, grocery lists, magazines, menus and meal plans are yours. We claim no rights over them, now or ever. Whether you typed a recipe in, clipped it from a website or imported it from another app, it is your content and you are responsible for it, including for having the right to keep it and to share it with the people you share a recipe book with.

You give us the licence that hosting needs, and nothing more: to store the encrypted copy, pass it between your devices, deliver it to anyone you choose to share a recipe book with, and, while an AI connector is on, hold the readable copy it works from. Because we cannot read what you store, we do not and cannot pre-screen it, and we cannot remove a single recipe from it. If you believe an account is using hosted sync to distribute something it has no right to, email us; the acceptable use section is how we respond.

You can export all of your content at any time, as open JSON-LD or as a full SQLite copy of your database, and take it anywhere you like. Nothing in Gratin is a format only Gratin can read.

Gratin's code, design, name and artwork are ours, or our licensors'. Using Gratin does not make you their owner. The app licence above says what you may do with the app, and the open-source licence will say more once the code is published. Evolu, the sync protocol Gratin is built on, belongs to its authors and comes under its own open-source licence.

Features and bugs

We design Gratin with care, based on our own cooking and on what the people who use it tell us. Even so, there is no such thing as software that pleases everyone, and we make no guarantee that Gratin will meet your particular requirements.

We test before we ship, and Gratin still has bugs, as all software does. We keep no analytics and receive no crash reports, so the only way we learn about one is from you: tell us, with a screenshot if something looks wrong. We work through what is reported, security and data-loss bugs first. Not every bug will be fixed, and we do not promise an error-free Gratin.

Keep your recovery code safe and take an export now and then. Local-first means your devices are the copy that matters, and an export is cheap insurance against a bug on any of them.

Liability

We mention liability in a few places above; here it is in one place.

Gratin, the account and hosted sync are provided as is. To the extent the law allows, our total liability to you for anything arising from Gratin, hosted sync or these terms, whether in contract, tort (including negligence) or otherwise, is limited to the greater of the amount you paid us in the 12 months before the claim and the price of a buy-once plan, and we are not liable for indirect or consequential loss, or for loss of profit, business, goodwill or data. For the free app, that means our best efforts and no warranty.

Nothing in these terms limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else that cannot lawfully be excluded or limited. If you are a consumer in New Zealand, the Consumer Guarantees Act 1993 applies and nothing here takes away the guarantees it gives you. If the consumer law where you live gives you protections that cannot be taken away by contract, you keep them too.

If you acquire Gratin or hosted sync in trade, the Consumer Guarantees Act 1993 does not apply to the extent section 43 of that Act permits, and you agree it is fair and reasonable that you are bound by this.

Relays you run yourself, or that someone other than us runs, are not ours. Gratin will happily talk to them, but we are not responsible for them.

In other words: choosing hosted sync is a bet on us. We do our best to be a safe bet, and Gratin is built so that the bet is a small one. If it does not work out, your recipes are still on your devices, and you point the app elsewhere. If you choose to bet on us anyway, thank you.

Governing law

These terms are governed by the law of New Zealand, and the courts of New Zealand have non-exclusive jurisdiction over any dispute about them. If the law where you live gives you protections that cannot be taken away by a choice of law, you keep them.

If something goes wrong, please email us first. We would much rather fix it than argue about it.

Changes to these terms

We may update these terms from time to time. We will show you a notice in the app at least 30 days before a change takes effect, and the current version always lives here, with its effective date. If a change would reduce your rights or cost you more, you can tell us within 30 days of the notice that you do not accept it; we will then end your plan and refund the unexpired part of it pro rata. No change to these terms will shorten the five-year commitment on a buy-once plan you already hold.

If at some point we do not enforce one of these terms, that does not mean we have given it up.

Contact

Gratin is made by Reb Software Limited (company number 8243306, NZBN 9429049945768), 6 Ocean View Rise, Ruakaka 0116, New Zealand. If you have any questions about these terms, contact us at [email protected].

Adapted from the Basecamp open-source policies, CC BY 4.0.