Privacy Policy

This Privacy Policy covers the Gurt AI app on Android and on iPhone, and this website. Where the two apps work differently, it says so. It replaces the version of July 10, 2026.

1. Who we are and how to reach us

Gurt Inc., a Delaware corporation ("Gurt", "we", "us"), runs the Gurt AI app and this website, and decides how your information is used (in European terms, we are the "controller").

Privacy questions, requests and complaints: [email protected]. Write "Privacy" in the subject.

2. The short version

• We collect what Gurt needs to work: your account, the food preferences you choose (including allergies and diets, which are health information), photos you take for the AI, recipes, and basic records of app use.
• We use your allergies and diets only to make and check your recipes. Nobody else using Gurt can see them. We never sell them and never use them for advertising.
• To make recipes and read photos we send what is needed to Anthropic, our AI provider in the United States, without your name, email or account. Anthropic does not train its AI on it and normally deletes it within 30 days (longer only if it is flagged under Anthropic's usage rules; see 7.3).
• In the Android app, recipes you write yourself are public on the free plan; with Pro you choose. In the iPhone app you choose whether to share each recipe you write (section 8.1).
• Some things are kept only on your phone (your fridge, shopping lists, calorie record). We cannot see them.
• We do not sell your personal information, and we do not share it for advertising.
• You can see, correct, get a copy of and delete your information. Deleting your account in the app removes it from our servers straight away (a deleted photo can still be reached for up to about an hour while copies cached for speed expire); section 12 lists the few things that stay and why.

3. What we collect

3.1 Information you give us

• Account (required): your email address; your password (stored only in scrambled, "hashed" form); or your Apple or Google sign-in, which gives us your email and an account identifier. We use it to create and secure your account.
• Profile: display name, username, profile photo (optional), the year you joined, and whether your profile is private. We use it to show you to people you choose to connect with. Name and username are required.
• Age: the Android app asks your year of birth when you sign up, to check you are 18 or over. We keep only that you are 18 or over, never the year. The iPhone app does not ask your age yet. In the iPhone app, the optional "age range" answer, if you gave one, is kept with your food preferences.
• Food preferences (optional): allergies; diets (for example vegetarian, halal, gluten-free); foods you dislike; cuisines you like; cooking skill; how long you like to cook; how many people you cook for; activity level; health goal (for example "eat more protein"); and, in the iPhone app, an optional age range. We use them to make recipes that suit you, and to check them against your allergies and diets. Without allergies and diets we cannot check recipes for them.
• Recipes you write (optional): title, ingredients, steps, photo, and whether it is public. We use them to save and show your recipe (section 8).
• Ratings, likes, follows, blocks (optional): who and what you rated, liked, followed or blocked, and follow requests. We use them to run the social features.
• Reports (optional): what you reported and why, and a copy of what was reported. We use them to keep Gurt safe.
• Requests you type (optional): words you add to a recipe request or an Ask Gurt question. We use them to answer you.
• Support messages (optional): what you write to us by email, and your email address. We use them to help you.

3.2 Photos

• Fridge or pantry photo: sent to our AI provider to list the food in it, then discarded by us. We do not keep it.
• Meal photo for a calorie estimate: sent to our AI provider for an estimate, then discarded by us.
• Ask Gurt photo: sent to our AI provider with your question, then discarded by us.
• Receipt photo: read on your phone only. It never leaves your phone.
• Recipe photo and profile photo: stored on our servers so the app can show them. Anyone who has a photo's web address can open it, whether or not they use Gurt. In the Android app, when you choose a new profile photo, the previous one is deleted. In the iPhone app, earlier profile photos stay stored until you delete your account.

Photos can show more than food (a face, a letter on the fridge, a child). Please frame photos to show only food. If your camera saves your location inside photos, turn that off before adding recipe photos.

3.3 Information collected automatically

• App events: when you install or open the app, scan, sign up or subscribe, with the time, your account (if signed in), your IP address, and the device and app details your phone sends with each request. We use them to understand how Gurt is used and to fix problems.
• Device identifier: a random identifier the app creates on your phone, linked to your account. We use it to stop the free scan and referral rewards being claimed many times.
• AI allowance counts: how many AI requests your account made each day or week. We use them to apply the allowances.
• Purchases (iPhone app): Apple's transaction number, which plan, when it ends, and whether it was a test purchase. We use them to give you Pro. We do not receive your card or bank details. The Android app has nothing to buy.
• Referrals: your invite code, who invited you, how many people joined with your code, and your free-week end date. We use them to run referral rewards.
• Your answers to our questions (Android app): when the app asks you to agree to something (for example the Terms, using your allergies and diet, or AI features), we record which text you were shown and its version, your answer, where it was asked, the platform and app version, and the time. We use it to show what you agreed to.

3.4 Visits to www.gurtai.app

The website stores a random visitor identifier, and any creator or campaign code in the link you arrived from, in your browser's storage. Each page view, how far you scroll, and clicks on the app store buttons are sent to our database with that identifier, your IP address, your browser details and the page you came from. Some pages also load fonts from Google Fonts and Fontshare, which receive your IP address. See section 16.

4. What stays only on your phone

Some of what you keep in Gurt is stored only on your phone and never on our servers: your fridge list, shopping lists, calorie record and goals, meal plan, cook history (in the Android app, including the list of days you cooked), star ratings you have not shared, receipt text, and recipes kept on the phone. Your streak number itself is stored on our servers with your profile (section 8 says who can see it).

In the Android app, if someone else signs in to Gurt on the same phone, your phone-only information is set aside and cannot be seen in the app until you sign in again. In the iPhone app, if someone else signs in to Gurt on the same phone, your fridge, shopping lists and similar phone-only information are removed from that phone, and the rest (such as your calorie record) is kept apart under your account.

In the Android app, your phone-only information is removed from the phone when you delete your account in the app on that phone. In either app, it is removed when you uninstall the app (or, on Android, clear the app's data). Deleting your account any other way (in the iPhone app, on another phone, or by writing to us) does not reach it: to remove it there, uninstall the app or clear its data on that phone. Your phone's own backup (for example iCloud or Google backup) may copy it under your phone's settings.

5. Your health information

Your allergies, diets, health goal and other food answers can say something about your health. The law in Australia, Europe, the UK and several US states treats this as sensitive or health information and gives it extra protection. Here is exactly what we do with it.

5.1 We ask first. In the Android app, before you enter allergies or diets, the app explains what happens to them and asks for your permission. You can say no; Gurt then cannot check recipes for allergies or diets, and the app says so. The iPhone app does not ask this yet: in it, adding allergies or diets is how you choose to have recipes checked for them, and you can remove them at any time (5.5).

5.2 What we use it for, and nothing else:

• telling our AI provider to leave those foods out of your recipes and answers;
• checking each AI recipe ourselves and removing any that names one of your allergens; and
• in the Android app, showing on each recipe what it was checked for, and what it was not.

5.3 Who sees it. You. Our AI provider receives it with each recipe request, without your name, email or account (section 7). People who work on Gurt can see it only when needed to run, fix or secure Gurt. Other people using Gurt cannot see it.

5.4 What we never do with it: sell it; share it for advertising or marketing; use it to decide what you are charged; or include it in any data programme (section 10), even with your permission.

5.5 Withdrawing permission. Remove your allergies and diets in the app at any time (in Settings: "Your food preferences" in the Android app, "Change dietary preferences" in the iPhone app) and we delete them from our servers. In the Android app you can also turn off "Use my allergies and diet" in Settings, which deletes them in one step. Recipes made after that are not checked for them.

5.6 Calorie information you log stays on your phone (section 4). Meal photos go to our AI provider only for the estimate.

6. How we use information, and our legal reasons

• Run your account and Gurt's features, including AI recipes, scans, Ask Gurt and social features. Information: account, profile, recipes, photos, food preferences other than health information, social activity. Legal reason: performing our contract with you (our Terms of Service).
• Check recipes against your allergies and diets. Information: allergies, diets, health goal. Legal reason: your explicit consent.
• Give you Pro and apply allowances and referral rewards. Information: purchases, allowance counts, referrals. Legal reason: contract.
• Prevent fraud and abuse (repeat free scans, fake referrals, spam) and keep Gurt secure. Information: device identifier, IP address, account, reports. Legal reason: our legitimate interest in a safe, fair service.
• Moderate content and handle reports. Information: reports, the reported content, account. Legal reason: legitimate interest; legal obligations (for example removal notices).
• Understand use and improve Gurt. Information: app events, website visits. Legal reason: legitimate interest (app); your consent where the law requires it (website, section 16).
• Answer you. Information: support messages. Legal reason: contract or legitimate interest.
• Comply with the law, enforce our Terms, and defend legal claims. Information: what is relevant. Legal reason: legal obligation; legitimate interest.

Where we rely on legitimate interests, you can object (section 14).

7. AI processing

7.1 Who. Our AI provider is Anthropic, PBC (United States). We use it to read photos, list ingredients, write recipes, estimate calories and answer Ask Gurt questions.

7.2 What we send. For each request, only what the request needs: the photo, or the ingredients or fridge list, any words you typed, and your food preferences (allergies, diets, health goal, dislikes, cuisines, skill, cooking time, household size, activity level and, in the iPhone app, age range). We do not send your name, email address or account identifier. A photo or the words you type can still contain personal information, so please keep them to food.

7.3 What Anthropic does with it. Anthropic acts on our instructions. Under its commercial terms it may not train its AI models on what we send. It deletes what we send and what it returns within 30 days, except that it may keep material flagged for breaking its usage policy for up to 2 years (and safety scores about it for up to 7 years), or longer where the law requires.

7.4 We ask first. In the Android app, before your first AI request, the app tells you this and asks for your permission. Without it, the AI features do not work; the rest of Gurt does. You can change your answer in Settings ("AI features"). The iPhone app does not ask yet.

7.5 Automated decisions. Gurt's computer systems decide which recipes to show you and remove recipes that name one of your allergens. These decisions are about recipes, not about you; they do not decide anything with legal or similarly significant effects on you, such as a price, a service you are refused, or your account. Accounts are only suspended for breaking the rules after a person has looked.

7.6 The shared recipe library. Recipes that Gurt's AI writes for you may be kept, with nothing that identifies you, and shown to other people who use Gurt. We keep only recipes made from requests whose ingredients were plain food names (such as "chicken" or "rice"); we do not keep recipes from requests that contained anything else you typed, or any allergy or diet you wrote in your own words. The library holds no account, fridge, allergy or request information.

8. What other people using Gurt can see

• Your display name, username, profile photo, follower and following counts, and number of recipes: anyone signed in to Gurt.
• Your public recipes (with your name and photo), and their like counts and ratings, if your profile is public: anyone, even without a Gurt account. A recipe's photo can be opened by anyone with its address.
• In the Android app, on the free plan, every recipe you write yourself is public: anyone, even without a Gurt account (section 8.1).
• Your private recipes: only you.
• Your recipes and streak, if your profile is private: only people you have approved to follow you.
• Your allergies, diets, health goal, other food answers and age: nobody else.
• Your email address: nobody else.
• Who you follow and who follows you: only you and the other person in each follow. Others see only the counts.

8.1 Recipes you write. In the Android app, recipes you write yourself are public on the free plan, and the app tells you so before you publish each one. With Pro you choose for each recipe, and if you leave Pro, private recipes stay private. In the iPhone app, when you write a recipe you choose whether to share it to the gallery; it is private unless you do.

8.2 Blocking hides you and your content from the person you block, and them from you.

9. Who we share information with

We share information only as described here.

9.1 Service providers who work for us under contract and may use it only to provide their service to us:

• Supabase (Supabase Pte. Ltd.), on Amazon Web Services: database, sign-in, photo storage and server functions. Receives everything on our servers. Where: United States (Oregon).
• Anthropic, PBC: AI (section 7). Receives what each AI request needs, without your identity. Where: United States.
• Apple: iPhone app distribution, payments, and Sign in with Apple. Receives purchases and sign-in. Where: worldwide.
• Google: Android app distribution; Google sign-in (both apps); website fonts. Receives sign-in, and your IP address when the website loads fonts. Where: worldwide.
• Cloudflare: hosts the website and forwards emails sent to our addresses. Receives website requests and support emails in transit. Where: worldwide.
• Microsoft (Outlook.com): our support mailbox. Receives support emails. Where: wherever Microsoft stores Outlook.com mail.
• Pexels: finds a photo for a recipe. Receives the recipe title only. Where: Germany.
• Fontshare (Indian Type Foundry): website fonts. Receives your IP address when the website loads. Where: India.

9.2 Other people using Gurt, as section 8 describes.

9.3 The law and safety. When the law requires it (for example a court order or a regulator's notice), or when we reasonably believe it is needed to prevent serious harm, to stop fraud, or to protect our rights.

9.4 A new owner. If Gurt is sold or merged, the new owner may receive the information, and must keep this policy's promises for information collected under it.

9.5 Never to advertisers, data brokers or for anyone else's marketing.

10. We do not sell your personal information

10.1 We do not sell your personal information. We do not share it for targeted advertising. We have never done either.

10.2 Statistics. We may publish or share statistics about groups of Gurt users, such as "the ten foods most often found in a fridge", only where each figure covers enough people that no one can be identified from it, and never statistics about allergies, diets, health goals or calories of identifiable groups smaller than 50 people.

10.3 If we ever offer a data programme (for example letting people contribute fridge photos to help build food recognition software), it will:

• be off unless you turn it on, and separate from agreeing to the Terms;
• cover only what you contribute after you turn it on, never anything from before;
• never include your name, email, username, profile photo, account or device identifiers, allergies, diets, health goal, calorie records, receipts, the words you type, or photos showing a person or a document;
• be open only to adults;
• be explained in a new version of this policy, published before it starts; and
• let you switch it off at any time, after which we stop collecting and leave you out of anything we share later.

Nothing like this exists today.

11. Information sent to other countries

The people who run Gurt are based in Australia. Our servers are in the United States, and our providers are in the United States and other countries (section 9). So your information is sent to and stored in countries whose privacy laws may be different from yours.

• From Australia: we take reasonable steps, including contracts, so that our providers handle your information consistently with the Australian Privacy Principles, and we stay responsible for how they handle it.
• From the EU, EEA, UK and Switzerland: we rely on the European Commission's standard contractual clauses (and the UK and Swiss equivalents) in our providers' data processing agreements. You can ask us for a copy.
• From other countries: we use contracts and safeguards that meet your country's rules where we serve it.

12. How long we keep information, and what deleting your account does

12.1 Deleting your account. In the app: Me, then Settings, then Delete account. If you cannot sign in, www.gurtai.app/delete-account explains how to ask us by email. When your account is deleted, we remove from our servers straight away (photos within about an hour, as cached copies expire): your profile and food preferences (including allergies), your recipes and their photos, your profile photos, your likes, follows, follow requests, notifications, blocks, reports you made, your AI allowance counts, your purchase records, and the app events linked to your account. You can no longer sign in. If any step fails, the app tells you and your account is kept so you can try again. Deleting your account does not cancel a subscription bought through the App Store: cancel it in your iPhone's App Store settings first.

12.2 What we keep after you delete your account, and why:

• The random device identifier, no longer linked to your account: so the free scan and referral rewards cannot be claimed again on the same phone. Kept until we delete it; we do not yet delete these on a schedule.
• A record that a referral was credited, without your account: so a referral is not counted twice. Kept until we delete it; we do not yet delete these on a schedule.
• Website visit records: they are not linked to your account. See 12.3.
• Support emails: to answer follow-ups and keep a record of requests. Kept until we delete them; ask and we will.
• The record of what you agreed to (which text, which version, yes or no, where it was asked, and the platform), with your account and the app version removed and the time cut to the day: to show what was agreed, if we are ever asked. Kept until we delete it.
• Copies in our database backups: backups are kept for recovery and expire on their own. A copy of your information in a backup is removed when that backup expires. Photos are not in our database backups.
• What our AI provider received: Anthropic's own deletion schedule (section 7.3): up to 30 days, longer if flagged.
• AI-written recipes in the shared library: nothing in them identifies you (section 7.6). Kept while Gurt runs.
• Reports other people made about you, and the content they reported: to keep Gurt safe and deal with appeals. Kept until we delete them.
• What we must keep by law, or for a legal claim: as long as the law or the claim requires.
• What is stored on your phone: we cannot reach it. It stays until it is removed on the phone (section 4).

12.3 How long we keep other information while you have an account:

• Account, profile, preferences, recipes, social activity: until you delete them or your account.
• App events and website visit records: until we delete them. We do not yet delete them on a schedule.
• AI allowance counts: until your account is deleted. We do not yet delete older counts on a schedule.
• Purchase records: while you have an account. They are deleted with it.

13. Keeping information safe

We use encrypted connections, store passwords only in hashed form, limit what each signed-in person can read and change in our database, keep server keys out of the apps, and limit who on our team can reach the database. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the regulators the law requires, as soon as we can.

14. Your rights and choices

Wherever you live, you can ask us to:

• see the information we hold about you, and get a copy in a common format;
• correct it (most of it you can edit in the app);
• delete it (in the app, or by writing to us);
• stop or limit a use you object to, including any use based on our legitimate interests;
• withdraw consent at any time, in the app (Settings, in the Android app) or by writing to us. This does not affect what we did before.

How. Use the app where you can, or write to [email protected]. We may ask you to confirm the request from your account's email address, so that no one else can get your information. We answer within 30 days (sooner where the law requires). We do not charge, unless a request is plainly excessive and the law allows a fee. We will not treat you differently for using your rights.

Australia. You can ask to access and correct your information under Australian Privacy Principles 12 and 13.

European Union, EEA, United Kingdom and Switzerland. You also have the right to data portability and to restrict processing, and to complain to your data protection authority (section 19).

United States. Depending on your state, you may have the right to know, delete, correct, and opt out of the sale or sharing of personal information and of profiling. We do not sell or share personal information, or profile people in a way that produces legal or similarly significant effects. If we deny a request, you can appeal by replying to our answer; we will reply within 45 days. Washington, Nevada and Connecticut residents: see Appendix A, our Consumer Health Data Privacy Policy.

Other countries. You have the rights your local law gives you. Write to us.

15. Children

Gurt is not for anyone under 18. The Android app asks your year of birth when you sign up, does not let anyone younger create an account, and keeps only that you are 18 or over, never the year. If we learn that someone under 18 has an account, we will delete it and its information. If you think a child has given us information, write to [email protected].

16. Browser storage and analytics on our website

Our website sets no cookies of its own and uses no advertising trackers.

• Visitor statistics. The website stores a random visitor identifier in your browser's storage and sends it, with each page view, how far you scroll and clicks on the app store buttons, to our database, together with your IP address, your browser details and the page you came from. You can remove it at any time by clearing this website's data in your browser.
• Creator links. If you arrive through a creator's link, the website remembers the creator's code in your browser so we can credit them if you download the app.
• Fonts. Some pages load fonts from Google Fonts and Fontshare, which receive your IP address.

17. Messages from us

We send messages needed to run your account (for example a password reset or a notice about these terms). We do not send marketing emails. If we start, we will ask first, and every marketing email will have an unsubscribe link. App notifications can be turned off in your phone's settings.

18. Changes to this policy

When we change this policy we publish the new version here with a new date, and you can ask us for an earlier version. If a change matters to you (a new use of your information, a new kind of company receiving it, or less protection), we will tell you in the app before it takes effect, and where the law requires your consent we will ask for it. A change never allows a new use of information collected before it, unless you agree.

19. Complaints

Please write to us first at [email protected]. We will reply within 30 days.

If you are not satisfied:

• Australia: the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, phone 1300 363 992. The OAIC generally expects you to have complained to us first and given us 30 days.
• New Zealand: the Office of the Privacy Commissioner, www.privacy.org.nz.
• European Union and EEA: the data protection authority where you live or work.
• United Kingdom: the Information Commissioner's Office, ico.org.uk.
• Switzerland: the Federal Data Protection and Information Commissioner, www.edoeb.admin.ch.
• Elsewhere: your local data protection or consumer authority.

20. Extra information for some countries

This section adds what particular laws require. Everything above applies everywhere.

20.1 European Union, EEA, United Kingdom and Switzerland. Controller: section 1. Legal reasons: section 6; health information is used only with your explicit consent (GDPR art 9(2)(a)). Transfers: section 11 (standard contractual clauses). You may complain to any EU or EEA authority, the UK ICO or the Swiss FDPIC (section 19). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (section 7.5).

20.2 United States (state privacy notice). In the last 12 months we collected these categories of personal information (as named in California law): identifiers (email, account id, device id, IP address); customer records (name); commercial information (Apple purchase records); internet or other electronic activity (app events, website visits); audio, electronic or visual information (photos); inferences (food preferences); and sensitive personal information (health information: allergies, diets, health goal; account sign-in). Sources, purposes, recipients and how long we keep each are in sections 3, 6, 9 and 12. We do not sell or share personal information (as those words are defined in California law) and have not done so in the last 12 months; we do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only to provide the service you asked for, so we do not offer a "limit" link. Your rights and how to appeal: section 14. You may use an authorised agent. We will not discriminate against you for using your rights. Washington, Nevada and Connecticut: Appendix A.

20.3 Canada and Quebec. Our person in charge of the protection of personal information can be reached at [email protected]. Before information about Quebec residents is sent outside Quebec, we assess whether it will be adequately protected. You may complain to the Commission d'acces a l'information du Quebec or the Office of the Privacy Commissioner of Canada.

20.4 Brazil. The controller is named in section 1. Our data protection officer ("encarregado") can be reached at [email protected]. Legal bases (LGPD arts 7 and 11): contract performance, legitimate interest, compliance with law and, for health information, your specific and highlighted consent. You have the rights in LGPD art 18, including confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and withdrawal of consent, and you may complain to the Autoridade Nacional de Protecao de Dados (ANPD). International transfers rely on the standard contractual clauses approved by the ANPD.

20.5 Mexico and other Latin American countries. You may exercise your rights of access, rectification, cancellation and opposition (ARCO) and revoke consent as section 14 describes. Health information is sensitive and is used only with your express consent. You may complain to your country's data protection authority.

20.6 New Zealand. You may access and correct your information under the Privacy Act 2020 and complain to the Privacy Commissioner. When we send your information overseas we do so under IPP 12 using contracts that require comparable safeguards.

20.7 Japan. Your information is provided to service providers in the United States (sections 9 and 11). The United States has no single federal privacy law equivalent to Japan's Act on the Protection of Personal Information; our providers are bound by contracts that require equivalent protective measures.

20.8 South Korea. Information transferred overseas: the recipients are Supabase, Anthropic, Apple, Google, Cloudflare and Microsoft (section 9, which says where each is). Your information is sent to them over the internet when you use the feature that needs it, for the purposes in section 9, and only the items listed there. How long each keeps it is in section 12. You can refuse by not using the feature, or by deleting your account.

20.9 India. Our grievance officer can be reached at [email protected]. We respond to grievances within the periods the law sets. Gurt is not offered to anyone under 18.

20.10 South Africa. Our information officer can be reached at [email protected]. You may complain to the Information Regulator.

Appendix A. Consumer Health Data Privacy Policy (Washington, Nevada and similar laws)

What consumer health data we collect. Allergies, diets, health goal, foods you avoid, activity level, and calorie estimates from meal photos (the estimate itself is kept only on your phone). We may also infer that you avoid a food for health reasons from your preferences.

Why. Only to make recipes that leave out foods you avoid and to check them against your allergies and diets, and to show you an estimate you asked for.

Where it comes from. From you, in the app.

Who receives it. Our AI provider, Anthropic, PBC, which processes it for us without your name or account; our hosting provider, Supabase, on Amazon Web Services. No one else. Other Gurt users cannot see it.

We do not sell consumer health data and do not share it with anyone for their own purposes.

Your rights. You can confirm whether we hold your consumer health data, see it and the list of everyone it was shared with, withdraw your consent, and have it deleted, by using the app or writing to [email protected]. We answer within 45 days. If we refuse, you can appeal by replying; if the appeal is refused, you can contact the Washington State Attorney General at www.atg.wa.gov/file-complaint or the Nevada Attorney General.