1. What this covers

Gruby helps your household decide dinner from what is already in your kitchen. Most of what you put into Gruby stays on your phone. This policy explains what we collect, when it leaves your phone, who sees it, and the choices you have. It covers the Gruby app for iPhone and the website at gruby.app.

2. What stays on your phone

Until you sign in, everything below is stored only on your device. Delete the app and it is gone.

• Your table: the people you add, their names and pictures, and the food rules you enter for them. Those rules can include allergies, celiac disease, alpha-gal, a low-FODMAP plan, a diet, dislikes and appetite. That is health-related information, and you choose what to enter.

• Your kitchen, shopping list, cooked meals and ratings, saved and imported recipes, cook timers, the rescued-food ledger, and your notification preferences.

• Photos you take or choose for things in your kitchen. They stay on your phone and are never uploaded, even when you sign in. The one exception is a photo you add to a recipe you share with everyone, which is uploaded as described below.

3. When you sign in

Signing in is optional. It backs up your table and lets you share it with your household.

• Your account is handled by Clerk, our sign-in provider. We keep your email address and, if you give it, your name. With Sign in with Apple, Apple may give us a private relay address instead of your email. We never see or store a password: sign-in uses a code sent to your email or your Apple ID.

• Once signed in, the data in the section above is synced to our servers so it is backed up and shared. People you invite into your household see its kitchen, list, people (including their food rules), meals and recipes. Invite codes work once and expire after seven days.

• Our servers run on Vercel and Prisma Postgres in the United States.

4. Deciding dinner together

Dinner plans share only what is described here, and only when you use them.

• Dinner plans are for cooking together at someone’s home. When your household joins a plan, its people and their food rules (names, pictures, allergies, diets and appetite) are shared with the other households in that plan, so the host can check the dinner for everyone. Gruby says so on screen before you join. The other households see those profiles, but not your account or email. Everyone in the plan sees its time and dish, and who is coming.

• Leaving a plan ends that sharing: the other households no longer see your household’s people or food rules, and your answers are removed. Plan invite codes work for one household and expire after seven days or when the dinner starts.

5. Recipes you share with everyone

Sharing a recipe is optional, and Gruby shows you what becomes public before you agree.

• What is public: the first name and face you choose when you share, and the recipe: its title, country, story, time, servings, ingredients, steps and photo. Anyone using Gruby can see it, signed in or not. For a recipe you sell, the amounts and steps are shown only to you and to households that bought it, and its price is public. Your email, last name, account and household are never shown. Each cook is known by an id that cannot be traced back to their account.

• Photos of shared dishes are stored with Vercel Blob, Vercel’s file storage in the United States, and anyone with the link can see them while the recipe is shared.

• Before a recipe is shared, we remove links and email addresses from it and check its words against a list of slurs and sexual terms. If the check finds one, the recipe stays private and only you can see it.

• When you report a recipe, we keep the reason, any note you add and that you sent it, so we can review it. The cook is not told who reported it. When you block a cook, we keep that so their recipes stay out of what you see.

• Stop sharing a recipe and it disappears at once, and its photo is deleted. Deleting your account deletes every recipe you shared, their photos, your reports and your blocks.

6. Gruby Plus and recipes you buy

Apple handles payment for Gruby Plus and for recipes you buy. We never see your card or bank details. Apple sends us the product you bought, its price and currency, your App Store country, when it was bought and when it expires, transaction identifiers, whether it will renew, and an account token we create so the purchase can be tied to your account and your household. Apple keeps sending us updates such as renewals and refunds so Plus and your recipes stay accurate. For a recipe, we record which recipe the purchase unlocked and for which household, so everyone in it can cook it. The cook never learns who bought it.

7. Selling recipes and getting paid

If you sell recipes, payouts are handled by Stripe, through a Stripe Connect Express account in your name.

• You give your legal name, date of birth, address, tax details such as your Social Security number, and bank account directly to Stripe on Stripe’s own pages. We never see or store them. Stripe uses them to verify who you are, pay you, meet its legal duties and send you tax forms such as a 1099, under Stripe’s privacy policy.

• We send Stripe your Gruby account id when we create your Stripe account, and the amount of each payout. Stripe tells us your Stripe account id, whether your details are complete and whether payouts are switched on.

• For each sale we keep an earnings record: the recipe, its price, when it was sold, the shares kept by Apple, by Gruby and paid to you, and whether it was refunded. For each payout we keep the amount, the date and Stripe’s transfer id. You see these under Earnings in the app.

• Earnings and payout records are financial records. We keep them for seven years, or longer when the law requires it, even after you stop selling or delete your account.

8. Sending a list to a store

Nothing goes to a store until you tap to send. When you do, the names and amounts of the items on your list go to Instacart or Kroger to build a cart; for a dish, Instacart gets its name, steps, photo link and the ingredients you’re missing. Signing in to Kroger happens with Kroger; we hold the token they give us so we can act on your behalf, and you can disconnect at any time. Each store’s own privacy policy applies to what happens there.

9. Product photos

When you search for something to add to your kitchen or list, the words you type go to gruby.app, which asks Kroger for matching products and their photos. The search is not tied to you or your account. To stop abuse we count searches per network address for an hour at a time; the counts are never linked to you and are cleared out regularly. If you pick a product, its name and photo are kept with that item on your phone.

10. Camera and photos

Gruby asks for the camera only when you tap Take photo or Scan a barcode. Choose photo uses Apple’s photo picker, which gives Gruby only the photo you pick and no access to the rest of your library. Scanning sends only the barcode number to Open Food Facts, a public product database, and, when it has no photo, the product’s name to gruby.app to find a store photo. Scan a receipt reads the photo with Apple’s on-device text recognition: the photo and its text never leave your phone, and the receipt is kept only on your phone.

11. Importing a recipe

When you paste a link, your phone fetches that page directly, so the website sees your device’s address the same way it would if you opened the page in a browser. Gruby keeps what the page publishes about the recipe (its title, ingredients, steps and a link to its image) in your recipes.

12. Notifications

The dinner nudge, cook timers and the reminder before a free trial ends are all scheduled on your phone. We do not send push notifications and do not hold a push token for you.

13. Diagnostics and updates

Two things leave your phone in the background.

• Crash and error reports go to Sentry: the device model, iOS version, app version, which screen you were on and what went wrong. They never include your name, email, or anything about your table or kitchen. Sentry receives your device’s address in order to deliver the report and keeps reports for up to 90 days.

• The app checks Expo’s update service for newer versions of its own code. Those requests carry the app version, platform and your device’s address.

14. The website

gruby.app does not use advertising trackers. The waitlist form sends your email to us through Brevo, and uses Cloudflare Turnstile to keep bots out, which means Cloudflare sees your address and browser. Sign-in pages set Clerk session cookies. Vercel, our host, keeps standard access logs (address, browser, time) for security.

15. What we do not do

We do not show ads, sell your data, share it for advertising, or use data brokers. We do not profile you for marketing. The dinner Gruby suggests is worked out from your kitchen and your table’s rules; it is never steered by a store or a brand.

16. Children

Gruby is not directed at children under 13 and we do not knowingly collect their data. Adults add children to their table and enter their food rules.

17. Keeping and deleting your data

You can take your data with you or remove it at any time.

• Export: Settings › Account › Export your data (or Settings › Your data) gives you one file with everything on your phone and, when you’re signed in, everything our server holds for you and your household. Photos stay out.

• Sign out: your data stays on the phone and stops syncing.

• Delete your account: Settings › Account removes you from your household and deletes your sign-in and your Plus record. Recipes you shared with everyone are deleted with it. If you were the last person in the household, its data is deleted with it; otherwise the shared data stays with the people still in it. Copies in routine backups are removed as those backups expire.

• Purchase records are kept for as long as we need them to support your subscription and your household’s recipes, and as Apple requires. Earnings and payout records of cooks who sold recipes are kept for seven years, as described above, and stay with Stripe under Stripe’s policies.

18. Security

Data travels over encrypted connections. Purchases are verified against Apple’s own signatures before Plus is granted or a recipe is unlocked. Access to our servers is limited to what is needed to run Gruby.

19. Your rights

Wherever you live, you can see, correct, export or delete your data, and object to how we use it. Most of this you can do yourself in the app. For anything else, or to appeal a decision, email privacy@gruby.app.

• If you are in the European Economic Area or the United Kingdom, we process your data to provide the service you asked for (contract), to keep it working and secure (legitimate interests), and, for the food rules you enter about health, with your consent, which you give by entering them and can withdraw by deleting them. You may also complain to your local supervisory authority.

• If you are in California or another US state with a privacy law, you have the right to know, delete and correct, and we do not sell or share personal information as those laws define it.

20. Changes

When this policy changes in a way that matters, the app tells you and the date at the top moves. Older versions are available on request.

21. Contact

Questions about privacy: privacy@gruby.app. Anything else: support@gruby.app.