Privacy Policy

Version of 1 October 2026. Effective 15 October 2026

This policy is written from what the app actually does: every item below corresponds to a specific request or store in the code. When the app changes, the policy changes with it.

1. Who processes the data

Gustable is developed and maintained by Asuras Inc. — the name under which an individual developer in the Republic of Belarus releases apps; it is not a registered company. The full name and address are shown on the developer page in Google Play.

Contact: egorkabercuk@gmail.com

2. What data we collect

2.1. Account data

You can use Gustable without signing in — then everything is stored only on your phone. If you sign in with a Google account, Google gives us your email address, your name and your Google account identifier. Your Google password is not passed to us and is not available to us.

This data exists so that you have the same profile on different devices. If you are in a family, its members see the name from your Google account (section 2.13); we do not show your email address to other users.

2.2. Profile data

During onboarding and in settings you may specify:

a display name (nickname)
gender and year of birth
dietary preferences and foods you do not eat
allergies and intolerances
religion — only to hide dishes that do not fit it, for example ones with pork
favourite cuisines and how much time you are willing to spend cooking

Allergies are health information and religion is information about religious beliefs. We use them for exactly one thing: not offering you dishes you must not eat or that do not suit you. We do not pass them to outsiders, do not analyse them for other purposes and do not use them for advertising. If you are in a family, its members receive your allergies and food restrictions so that the family is not offered dishes someone at the table must not eat (section 2.13); your religion as such is not shown to them.

All these fields are optional. The app works without them — it matches dishes worse, but it works.

2.3. Profile photo

If you choose a photo for your avatar, it is stored on our server. Members of your families see it — next to your name, in the family menu and in the chat — and so do people who open an invite link to your family (section 2.13). If you are not in any family, your avatar is not shown to other users.

2.4. What is saved to your account

If you are signed in, our server keeps one snapshot of your state in the app so that everything is restored on a new phone. It contains:

the profile data from section 2.2
the weekly menu and the dishes you picked
the shopping list: what you added and how much to buy
what you have at home — products and their quantities
which dishes you cooked and when, XP and level
progress through recipe steps and serving sizes per dish
shopping days, reminder times and whether reminders are on
markers of which onboarding steps you have completed
kids mode: whether it is on, the age band and the exit code (see section 7)
your dish ratings

Family data — its members, the family menu, the chat and kids' profiles — is not kept in this snapshot but separately, with the family (sections 2.13–2.16).

2.5. Dish ratings

After cooking you can rate a dish from 1 to 5 stars. The rating is stored on the server under your account. The dish card shows only the average rating and the number of ratings — no names.

When you take a dish in the deck, the server records a vote for that dish. There are no dislike votes.

2.6. Subscription, purchases and promo codes

Our server keeps, under your account, the date PRO granted by a promo code is active until, and records of redeemed promo codes.

Gustable PRO subscriptions — personal and family — are paid through Google Play. Google processes the payment; card details are not passed to us and are not available to us. A free trial, if offered, is part of the Google Play subscription: Google Play provides and tracks it, and the app has no separate trial.

If you are signed in, the app passes the Google Play purchase token to our server, and the server checks it with Google itself through the Google Play Developer API. What Google answers is stored under your account: the purchase token, which plan was bought, the subscription state (active, cancelled, on hold and so on), the date it is paid until, a link to the previous purchase when you change plans and, for a family subscription, the family it pays for. This is how PRO works on all your devices and family PRO works for the family's members.

When you buy, the app gives Google Play a pseudonymous account identifier — a hash of your internal Gustable account number, not your email address or name — so that the purchase is tied to your account. Our server receives subscription status notifications from Google (Real-time developer notifications via Google Cloud Pub/Sub) and re-checks subscriptions and refunds once a day through the Google Play Developer API, so that PRO starts on time after payment and renewal and ends after a cancellation or a refund.

Family PRO is paid for by one family member and covers up to six adult members: the payer and those who joined the family earliest. Kids' profiles (section 2.15) do not take up places. Family members see who paid for family PRO, the date it runs until and which members it covers — in the family and on the subscription screen.

2.7. Microphone

Audio recording permission is requested only when you enter voice cooking mode, and only to recognise the commands next, back and repeat.

Recognition is done by the Android system service (normally the Google service). We do not record audio, do not store it and do not send it to our server. Voice mode is optional: every screen works with buttons, and denying the permission breaks nothing.

2.8. Dish photo

Recognising a dish from a photo is available after you sign in. The picture goes to our server, is reduced in size there and is passed to the Google Gemini service, which names the dish. The feature cannot work without this transfer.

We do not store these pictures: the photo is passed on at the moment of the request and is not kept in our database. What happens to it on Google's side is governed by Google's terms, not ours.

Plainly and importantly: we use the free Gemini tier, and for it Google states that request content may be used to improve its products. In other words, the photos you send may end up training Google's models. If that does not suit you, simply do not use this feature — it affects nothing else in the app.

The feature is optional and starts only when you tap it. Your allergies are not sent to Google: they are applied on our side, after the dish has been named.

2.9. Weather and approximate location

To show the weather on the home screen and in the weekly menu, the app asks for access to your approximate location (it never asks for your precise location). If you allow it, the app rounds the coordinates to about 10 km (0.1°) on the phone itself and only then sends them to our server, together with the phone's time zone. Precise coordinates never leave the phone. The location is used only for the weather forecast. The app keeps the rounded location and the latest forecast on the phone so that the weather is still shown when you are offline.

Our server does not store the rounded area, either in its database or under your account. It passes the area to the MET Norway weather service (the Norwegian Meteorological Institute, api.met.no) to get the forecast. MET Norway does not receive your account or your phone's IP address — the request to it is made by our server. The server keeps forecasts per area only in memory, with no link to you or your account, so that neighbours in the same area get the same forecast and the weather service receives one request per area rather than one per person. If the weather service does not respond, the rounded area may appear in the server's technical log — without an account or an IP address.

Weather data is provided by MET Norway under the CC BY 4.0 licence, which is why the app names the source next to the weather.

Without location access the app works as usual, just without the weather. You can revoke the permission at any time in Android settings.

2.10. What stays on your phone

Not sent to our server:

the cache of recipes and their photos (so the app works offline)
appearance and language settings
cooking timers

Android may itself copy the app's data into your Google account backup on Google Drive. That is Google's service, not ours; you turn it on and off in Android settings.

2.11. What we do not collect

We do not collect precise location, contacts, call history, SMS or advertising identifiers. The approximate location used for the weather is rounded to about 10 km on the phone and is not stored on our server (section 2.9). Gustable has no ads and no third-party analytics: we collect crash reports and usage statistics ourselves, on our own server, and do not pass them to anyone (see section 2.12).

Our server sees the IP address a request comes from and keeps it only in memory to limit overly frequent requests. We do not store it.

2.12. Crash reports and usage statistics

To find and fix bugs, and to understand whether people make it all the way to a finished dish, the app sends technical reports to our server:

crash reports — what broke and where in the code (error type, stack trace)
diagnostics — errors talking to the server (the request path without parameters and the response code), store errors during payment, failed sign-ins, photos that failed to load
in-app actions — opened the app, opened a screen or a dish card, put a dish in the menu, added missing items to the shopping list, ticked off a purchase, started cooking, moved to the next step, finished cooking. An action carries the number of the dish or product in our catalogue and a few technical values — for example, the step number or how long the cooking took

Each report also carries the time and the screen where it happened, a random installation number (created on first launch, not included in backups, and replaced when the app is reinstalled), the app version, the store it was installed from, the Android version, the phone model and the system language.

If you are signed in, the reports are linked to your account: the server attaches your account identifier to them so that we can look into things if you write to us about a problem. If you use the app without signing in, the reports are linked only to the random installation number.

Reports never include your email address, name, passwords or sign-in tokens, the text you type (family chat messages, your own products, searches), your location or your IP address. The app and the server additionally strip anything that looks like an email address, a token or a phone number from error texts. In kids mode, in-app actions are not sent — only crash and error reports.

Reports are kept in a separate database on our server and are not passed to anyone. How long they are kept is described in section 5.

You can turn reporting off in the app settings with the Send diagnostics switch (on by default). While it is off, the app sends no crash reports, no diagnostics and no in-app actions.

2.13. Family

A family in Gustable is several people with their own accounts who decide together what to cook. Families work only after you sign in. Creating or joining a family is optional: without one the app works as usual.

Our server keeps the following about a family:

the family's name, description, sticker and photo — any adult member sets and changes them
who is in the family, who owns it and when each person joined
the family menu: votes for dishes, who is cooking, the dish and time the cook announced, the result of a dice roll, a separate dish for the kids
the event feed: who joined, left or was removed from the family, who changed its name or photo, added a kid's profile, announced a dish, rolled the dice, bought family PRO
family invites (below), kids' profiles (section 2.15) and chat messages (section 2.14)

Family members see about each other:

the name from their Google account and their avatar, if there is one
who the owner is and when each person joined
who votes for which dish, who is cooking and what they announced
allergies and food restrictions from the profile on the server: the app hides dishes someone at the table must not eat and shows in the family menu who a dish does not suit
who is covered by family PRO (section 2.6)

Family members do not see your email address, gender, year of birth, your religion as such, your personal weekly menu, shopping list, what you have at home, dish ratings, XP or level — those stay under your account (section 2.4). So that the family opens offline too, each member's app keeps a copy of the family's data on their phone and refreshes it when it reaches the server.

Invites. Any adult member can invite someone to the family in three ways:

with a link or a code: the link is valid for 14 days and can be revoked
by email address: the invite is valid for 30 days, and only someone who signs in to Gustable with that address will see it
by shaking phones next to each other: only the person who is let in gets the invite, for 10 minutes

For an email invite, the server stores the address the inviter typed. We do not send emails: the person learns about the invite in the app or from you. The app does not ask for access to your phone's contacts.

When phones are shaken, the server matches two phones by timing alone — without location, Bluetooth or contacts — and keeps the shake in memory for a few seconds. Whoever shakes their phone at the same moment as you sees the family's name, sticker and photo and the inviter's name; the inviter sees that person's name and decides whether to let them in.

Anyone who opens an invite link — even without signing in — sees the family's name, description, sticker and photo, the inviter's name, and members' names and avatars. Allergies, food restrictions, kids' profiles and family PRO details are not shown in an invite. If you send the link in a messenger, its preview may include the family's name and the inviter's name.

2.14. Family chat and reports

Families with active family PRO have a chat. You can send text (up to 1,000 characters) and a dish from the catalogue; photos and files cannot be sent. A sent message cannot be edited.

Messages are stored on our server. Everyone in the family sees them, including people who join later: the whole chat history is open to new members. The author's name and avatar are shown next to each message. The server also stores how far each member has read the chat, to show the number of unread messages. The app fetches new messages from our server itself; no third-party notification services (such as Firebase) are used.

Messages are not end-to-end encrypted: they are stored on the server like the rest of the data (section 4). We do not read families' conversations and do not use them for anything other than running the chat. The exception is messages that have been reported.

A message can be deleted by its author and by the family owner. On deletion the text and the dish are erased from the server, and a Message deleted marker stays in its place.

You can report someone else's message and choose a reason. Reports are reviewed by a moderator — currently the developer. In the moderation panel the moderator sees only the reported messages as they are now (if a message has already been deleted, only the deletion marker), the family's name, the author's name, the reporter's name, the reason and the time. The rest of the family's conversation is not visible in the panel. A message that breaks the Terms of Use is deleted by the moderator in the same way an author deletes it. The author is not told who reported them.

The rules for the chat are in the Terms of Use.

2.15. Kids' profiles in a family

A child does not create a Gustable account and does not sign in to the app. An adult family member can create a kid's profile in the family so that dishes are picked for the child too. The profile holds a name (a nickname will do), a year of birth (the app asks for the age) and the child's allergies; the server can also store food restrictions if they are given. We do not ask for a photo, an email address or anything else about the child.

A child's allergies are information about their health. We use them for exactly one thing: not offering the family dishes the child must not eat.

All family members see a kid's profile: name, age and allergies. Kids' profiles are not shown in family invites. Any adult family member can create, change and delete kids' profiles. When a profile is added, an entry with the child's name appears in the family feed; if the profile is deleted, the name disappears from the feed as well.

A kid's profile belongs to the family: if the adult who created it leaves the family or deletes their account, the profile stays in the family. It is deleted when an adult member deletes it or when the family itself is deleted.

By creating a kid's profile, the adult confirms that they are the child's parent or legal guardian or are acting with their consent (see the Terms of Use).

2.16. Family: retention, leaving and deletion

Family data is kept for as long as the family exists. Chat messages have no separate retention period: a message is kept until its author, the family owner or a moderator deletes it, or until the family is deleted.

There is no separate delete family button: a family is deleted when its last member leaves. Its name, description and photo, its members, invites together with email addresses, kids' profiles, the menu, the event feed, the whole chat and reports about its messages are then removed from the server immediately. If the family had family PRO, the purchase stays with the payer, who can move PRO to another of their families.

When you leave a family or its owner removes you:

you stop seeing the family, and it stops seeing your allergies and food restrictions
your votes in the family menu and your chat read marker are deleted, and if you were cooking, the cook's place is freed
your chat messages stay in the family's history with your name and avatar, and so do entries in the event feed and the family menu (Anna rolled the dice). If you do not want your messages to stay, delete them before leaving; if you have already left, write to us from your account's address and we will delete your messages in that family
if the owner leaves, the person who has been in the family longest becomes the owner

When you delete your account:

you leave all your families as described above; if you were the last member, the family is deleted entirely
your messages in family chats stay, but without your name and avatar — like messages from a deleted user. Delete them beforehand if you do not want them to stay
your reports and the records of your Google Play purchases on our server are deleted; family PRO you paid for ends for the family immediately, and the Google Play subscription must be cancelled separately
kids' profiles you created and invites you sent stay with the family: they were created and issued by the family, not by you personally

3. Who the data is shared with

We do not sell data and do not pass it to advertisers. Only those without whom the app does not work, and the people you choose to share it with in a family, receive data:

Google — account sign-in (Google Sign-In), speech recognition and synthesis in voice mode, subscription payment through Google Play, and dish recognition from a photo (Gemini) if you use it. Payment terms and the processing of payment data are determined by Google. The Google Play services libraries that sign-in and payment run on may send diagnostic data to Google under Google's privacy policy.
Google Play Developer API and Google Cloud Pub/Sub — our server uses them to check purchases and subscriptions: it passes the purchase token to Google and receives its state and expiry, subscription status notifications and refund information (section 2.6). When you buy, Google Play receives a hash of your internal Gustable account number — not your email address or name.
MET Norway (the Norwegian Meteorological Institute, api.met.no) — receives from our server an area rounded to about 10 km in order to return a weather forecast (section 2.9). It does not receive your account or your phone's IP address.
Members of your family — see what is described in sections 2.13–2.15: your name, avatar, allergies and food restrictions, votes in the family menu, chat messages and kids' profiles. Anyone who opens an invite link to your family sees the family's name and photo and members' names and avatars.
Our server — a rented server running Gustable Service. Only the developer has access to it. Crash reports and usage statistics (section 2.12) are also kept there, in a separate database; they are not passed to third-party analytics services. Chat messages that have been reported are seen by a moderator — currently the developer (section 2.14).

We may disclose data where the law requires it.

4. How the data is protected

All requests between the app and the server go over a secure connection (HTTPS). Access to your data on the server is possible only with your token, issued when you sign in, and access to a family's data only with its members' tokens. The exceptions are what an invite link shows, and images: family photos and avatars open by link without signing in, but such a link contains a random identifier known only to those the app has shown the image to.

Nobody guarantees complete protection and we will not promise it. We promise something else: to collect the minimum and store nothing beyond it.

5. How long we keep data

Data is kept for as long as your account exists. When you delete the account, it and the data under it are removed from the server immediately. The exception is what remains with your families: chat messages (without your name), kids' profiles you created and invites you issued (section 2.16). Server backups are overwritten on a rotation, so the data disappears from them within 30 days.

Family data is kept for as long as the family exists and is deleted with it. Chat messages are kept until their author, the family owner or a moderator deletes them. Email addresses in invites are kept for as long as the family exists — including after an invite has expired, been declined or been revoked. A report is kept for as long as both the message and the reporter's account exist. Google Play purchase records are kept for as long as the payer's account exists. A phone shake lives in the server's memory for a few seconds and is never written anywhere. Deleted data disappears from backups within the same 30 days.

Crash reports and usage statistics (section 2.12) are deleted automatically: in-app actions after 30 days, crash and error reports after 90 days. When you delete your account, the account identifier is removed from these reports within a day; the remaining records are linked only to the random installation number and are deleted on the same schedule.

6. Your rights

At any time you can:

view and change your data — in profile settings in the app
delete the account and the data under it — in the app: Profile → Delete account (what stays with families is described in section 2.16)
delete the account without installing the app — through https://gustables.xyz/en/account-deletion
delete your messages in a family chat and leave a family — in the app, in the family section; a family owner can delete any message and remove a member, and an adult member can change or delete a kid's profile
report a message in a family chat — with the Report button on the message
withdraw permissions (microphone, location, notifications) — in Android settings
turn off crash reports and usage statistics (section 2.12) — in the app settings, with the Send diagnostics switch
write to us at egorkabercuk@gmail.com about anything concerning your data

Account deletion is irreversible: the menu, shopping list, picked dishes, ratings and accumulated XP cannot be restored.

A Google Play subscription is not cancelled automatically — it must be cancelled separately in Google Play subscription settings. This applies to a family subscription too: the family loses family PRO as soon as the payer's account is deleted, while Google Play keeps charging until the subscription is cancelled.

7. Children

Gustable is meant for users aged 13 and over and is not intended for children under 13.

The app has a kids mode. An adult turns it on on their own phone so that a child can cook under their supervision, and sets a four-digit exit code. In kids mode the child does not create an account and the mode collects no information about them: the adult's account stores only the mode's settings — whether it is on, the age band the adult chose and the exit code. While kids mode is on, the app does not send in-app actions or screen views (section 2.12) — only technical crash and error reports.

In a family, an adult can create a kid's profile (section 2.15). It is not an account: the child does not sign in to the app, does not write in the chat and tells us nothing about themselves. The child's name, year of birth and allergies are entered by an adult; family members see them, and we use them only to pick dishes.

If you believe a child under 13 has given us their data, or you want a profile of your child that someone else created to be deleted, write to egorkabercuk@gmail.com and we will delete it.

8. Changes

If the policy changes, we will publish a new version on this page, show at the top the version date and the date it takes effect, and announce the change in the app before it takes effect.