Legal
Privacy Policy
Version 0.1 · Last updated
Draft — pending counsel review
Gastroque plans meals for real people, so you trust us with real details — including allergies, diets and the first names of the people you cook for. This policy explains what we collect, why, who helps us process it and how to take it back. The short version: we use your details to plan your meals, we never sell them, and we never use them for advertising.
1. Who we are
Gastroque runs Gastroque and is the controller of your personal data. Contact us at privacy@gastroque.com. If we actively offer Gastroque in the EEA or UK, we'll name our EU and UK representatives here.
2. What we collect
- Account: email address, sign-in identities (Google or Apple), display name, avatar and locale.
- Household: name, timezone, country, units, planning preferences, the equipment you own, budget, store and prep style.
- Diners: a first name or nickname, an age group (adult, teen, child or toddler), appetite, spice tolerance and soft likes and dislikes. For children we collect only a first name or nickname and an age group — never birthdates, photos, schools or contact details.
- Health and diet details: diets, allergies, intolerances, religious and medical diet codes, macro targets and diner notes. We ask for your explicit consent before we save any of these.
- What you do in Gastroque: plans, recipes, grocery lists, pantry, prep plans, ratings, favorites and safety reports.
- Usage and device: pages and features used, approximate location from your IP address, browser and device type, error reports.
- Payments: handled by Stripe. We receive your plan, billing status and a Stripe customer id — never your full card number.
3. How we use it, and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Planning meals, writing recipes, lists and prep plans | Contract |
| Checking every plate against allergies and diets, and labelling allergens | Explicit consent and contract |
| Learning your household's tastes from ratings (Taste Profile) | Contract — no decisions with legal effect |
| Billing and preventing repeat free trials | Contract; legitimate interests; legal obligation (tax) |
| Security, fraud and abuse prevention | Legitimate interests; legal obligation |
| Product improvement with analytics | Consent in the EEA, UK and Switzerland; legitimate interests elsewhere, with opt-out |
| Product news and offers by email | Consent (double opt-in in the EU and UK) |
4. How our AI processing works
Menus and recipes are written by an AI model provided by Anthropic, acting as our processor. Before anything is sent, we build a pseudonymous “Chef Brief”: your diners appear as D1, D2 and so on, restrictions as codes, and free text is scrubbed of names, emails and phone numbers. Anthropic doesn't train its models on this data by default and keeps it for up to 30 days. Our own copies of AI job data are kept for 30 days after a successful job (90 after a failure), longer only for an open safety report or a legal hold.
5. Sharing and subprocessors
We don't sell or share your personal information, and we never use health or diet details for advertising. We use the service providers below, under contract, only to run Gastroque. Customer.io, which sends our email, receives your email address, first name, a small set of allow-listed traits and events — never diets, allergies, intolerances, medical or religious codes, diner names or ages.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, sign-in, storage | All app data | US |
| Vercel | Hosting, logs, cookieless web analytics | Requests, IP addresses, logs | US |
| Stripe | Payments and tax | Email, billing details, cards (Stripe only) | US / global |
| Anthropic | AI recipe writing | Pseudonymous Chef Brief | US |
| Customer.io | Email: account, reminders, newsletter | Email, first name, allow-listed traits | US |
| PostHog | Product analytics and feature flags | Pseudonymous ids and events, no restriction data | US |
| Sentry | Error monitoring | Scrubbed error reports | US |
| Cloudflare | Bot protection (Turnstile) | IP address, browser signals | Global |
| Google, Apple | Sign-in (independent controllers) | Identity tokens | Global |
We announce new subprocessors 30 days before they start, by email to household owners.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, household, diners, plans and ratings | The life of your account |
| Health and diet details | The life of your account, or until you withdraw consent |
| Pantry history | 365 days |
| AI job data | 30 days after success, 90 after failure |
| Notification log | 90 days |
| Security and audit records | 400 days |
| Waitlist sign-ups | Until the feature launches + 90 days, or until you unsubscribe |
| Product analytics | 24 months |
| Backups | Until they roll off (about 7 days after deletion) |
8. Your rights
- Export everything as one file, anytime, in Settings → Privacy.
- Delete your account and household data in Settings → Privacy.
- Correct anything directly in the app.
- Withdraw consent for health and diet details in Settings → Privacy — we delete those details for your whole table.
- Object to analytics or opt out of marketing at any time.
- Appeal a decision on your request by writing to privacy@gastroque.com within 45 days.
- Complain to your local data protection authority.
For anything you can't do in the app — including requests about a diner who isn't a user — email privacy@gastroque.com. We aim to answer within 7 days and always within the legal deadline (one month under GDPR, 45 days under California law).
9. Children
Gastroque is for adults who cook. Children can be diners, entered by a parent or guardian with a first name or nickname and an age group only; they never have accounts. If we learn an account holder is under 18, we close the account and delete its data.
10. International transfers
Gastroque is hosted in the United States. If you're in the EEA, UK or Switzerland, your data is transferred under the EU-US Data Privacy Framework where our provider is certified, and otherwise under the European Commission's Standard Contractual Clauses (with the UK Addendum), with encryption and pseudonymization as extra safeguards.
11. Security
Household data is separated by row-level security, encrypted in transit (TLS 1.2+) and at rest, and accessible to our team only when needed, with multi-factor authentication. See our security and vulnerability disclosure policy.
12. The public Gastroque Library
We may publish anonymized copies of recipes to the public Library. Copies carry no names, ratings, comments or dates, and variant labels are generic (“Vegetarian”, never “Sam's plate”). You can opt your household out in Settings → Privacy.
13. Hashed card fingerprints
To stop repeat free trials, we keep a one-way hash of the card fingerprint Stripe gives us. We keep this hash even after you delete your account; it can't be turned back into a card number.
14. Changes to this policy
When we change this policy we update the version and date at the top of this page, and we tell you in advance by email or in the app if the change matters to how we use your data. Our separate Consumer Health Data Privacy Policy covers Washington's My Health My Data Act.