Who we are (operator and data controller)
Gemo is operated by App Studio LLC, a limited liability company registered in Georgia (registration ID 405844859, LEPL National Agency of Public Registry), directed by Nika Choladze, with its registered address at Saburtalo district, Z. Panaskertel-Tsitsishvili st., N11, apartment 124, Tbilisi, Georgia. App Studio LLC is the data controller responsible for the personal information described in this policy, and is the "developer" for the purposes of the Apple Licensed Application End User License Agreement. You can contact us about anything in this policy at [email protected]. This policy and our handling of your personal information are governed by the law of Georgia.
Who and what this policy covers
This policy applies when you use the mobile app, create or sign in to an account, browse and save recipes, publish recipes, upload photos, comment, rate recipes, follow other users, use Gemo Plus features, scan recipes, contact support, or otherwise interact with the service. It applies whether you sign in with an email and password, sign in with Apple, Google, or Facebook, or use the app as a guest.
Account and identity information
When you register, sign in, reset your password, or convert a guest session into an account, we collect your email address, your chosen display name, and account settings. Passwords are handled by our authentication provider (Supabase Auth) and are stored only in hashed form; we never receive or store your password in plain text. Your account is identified internally by a unique account ID (UUID), which is the only identifier that ties your data together; there is no public username or handle.
Signing in with Apple, Google, or Facebook
If you choose social sign-in, the provider returns an identity or access token together with your email address and name so we can create or match your account. Apple shares your name only on the first sign-in. If Facebook does not return an email address, we generate a synthetic placeholder address for your account. Your Facebook user ID may be stored in your account metadata to keep the link working; it is removed when you delete your account. We do not retain the sign-in tokens themselves after authentication.
Staying signed in (session tokens)
To keep you signed in, an access token (JWT) and a refresh token are stored using operating-system-protected secure storage on your device. On Android, authentication storage is excluded from cloud backup and device-to-device transfer. On iOS, it uses non-synchronizing Keychain storage that does not migrate to another device. These tokens are cleared when you sign out or delete your account, and the session is revoked on our server when you log out.
Profile information
Your profile may include an avatar (a reference to an image you upload) and your language preference. You can edit these at any time, and they are removed when you delete your account.
How your account ID is used
Your account ID is attached to the requests your app makes to our API and to in-app engagement events while you are signed in. On iOS and in Android versions with RevenueCat enabled, our subscription provider uses an SDK-generated customer identifier. When a purchase or Restore flow links your subscription to your Gemo account, we send RevenueCat your account ID so access can be recognized across your devices.
Photos and files you upload
Photos you add to the app (recipe images, your avatar, post and comment images, and cooking-result photos) are stored on Cloudflare R2 and served as public content-delivery objects at hard-to-guess random URLs. These image files are retained indefinitely unless they are deleted as described here. Please note an important limitation: our app and API do not currently delete these image files from storage when you remove the related content. When you delete your account in the app, we attempt to delete your avatar, your post and comment images, your cooking-result photos, and the media stored for your creator-video imports; images of recipes that remain published, and other images uploaded for recipes deleted with your account, may stay in storage. Do not upload images you would not be comfortable being publicly accessible.
AI recipe scanning
On iOS and Android, you can scan a recipe by photo. When you do, the photo is transmitted to a third-party AI service (Google Gemini, or OpenRouter if our server is configured to use it as a fallback) to read the text in the image. The image is held only in our server's memory for the duration of that request; it is not saved to our database or image storage. Each provider processes the image under its own privacy policy and may retain its own copy according to that policy.
- AI-derived data: the transcribed text and the structured draft (title, ingredients, steps, nutrition estimates, notes) are saved in our database tied to your account, along with the per-stage AI request and response payloads we use to process the scan and debug problems. These are deleted when you delete your account.
- Scan telemetry and quota: we store information about each scan run tied to your account (timestamps, status, the model and provider used, token counts, duration, estimated cost, and your lifetime free-scan count) to operate the feature, monitor cost, and enforce the free-scan limit. This is removed when you delete your account.
Creator-video recipe imports
If you use creator-video import, Gemo may fetch a video from the public source URL you provide or accept a video file you attach. The fetched or user-uploaded video may be written temporarily to Gemo server storage while the import runs. Gemo uploads the video to Google Gemini through the Gemini Files API to extract the recipe. During cleanup, Gemo attempts to delete the temporary server copy and to manually delete the Gemini Files API upload. Google states that Files API uploads are automatically deleted after 48 hours. Selected or extracted recipe frames may be retained in Cloudflare R2, and the resulting recipe data may be retained in our database as recipe content under the normal content and account controls and retention limitations described in this policy.
- Import record and purpose: we keep a durable record linked to your account. It includes the source platform, link and post details; creator-account and authorization details; import status, processing steps, attempts and timestamps; technical video and cleanup information; extracted recipe drafts, ingredient matches, and frame-selection or progress checkpoints; and AI request and response records, model/provider information, and usage information. We use this record to run, resume, monitor, and debug imports. It is deleted when you delete your account.
- Imported recipes after deletion: when you delete your account, the recipes you imported, published or not, are deleted, and we attempt to delete the selected frames and other media stored for those imports.
Subscriptions and payments
Gemo Plus subscriptions are processed by Apple on iOS and by Google Play on Android. RevenueCat helps us check subscription status and restore access. We process store and product identifiers, transaction identifiers, subscription status and plan, and start, expiry, renewal, cancellation and refund information when supplied by the purchase providers. We never receive or store your full payment-card number; payment methods are handled by the store used for the purchase. The free Android launch promotion has ended; accounts that were granted continued access under it keep complimentary Gemo Plus as described in our Subscription Terms. In Android versions with RevenueCat enabled, subscription-status checks and SDK customer/device processing can occur even if you never make a purchase, including when you use free features or complimentary access. These checks may process existing purchase and entitlement information without a new purchase. Purchase or Restore actions in enabled versions also process the corresponding purchase data.
- Complimentary access: an authorized administrator may add, edit, or revoke Gemo Plus access without changing your store billing. We keep an account-linked operational history of these actions, including the selected reason and an optional internal note visible only to administrators. This history is retained until you delete your account.
- RevenueCat identifiers and device information: where the SDK is enabled on iOS or Android, it processes its customer/device identifiers and basic device, app and operating-system information to provide and verify subscription access. These checks do not require a new purchase. We may link the SDK customer to your Gemo account ID during purchase or Restore; we do not set your email, name, or other custom subscriber attributes.
Notifications and reminders
If you grant notification permission and are signed in, we store a push token from Firebase Cloud Messaging (FCM), an app-generated installation ID (a random per-install UUID that is not a hardware or advertising identifier), and your platform and push environment, all tied to your account. These are removed when you sign out or delete your account, and invalid tokens are pruned automatically.
- Notification content: push messages may contain other users' display names and short snippets of user content (such as comment or post text, recipe titles, or ratings) and related identifiers in the data payload. Notifications are delivered via FCM (and Apple's APNs on iOS) and are also stored in your in-app inbox.
- Meal-plan reminders (premium): if you enable weekly reminders, we store your chosen day of the week, local time, and timezone (default Asia/Tbilisi) so we can schedule the reminder. Timezone information used only for purely on-device local notifications is not transmitted to us.
Crash reports and diagnostics
We use Sentry to detect and fix crashes and errors in both the app and our server. It automatically collects diagnostic data such as stack traces, exception messages, device model and operating system, app version, environment, and breadcrumbs (the screens you navigated and the API URLs your app called). When an error occurs it also captures a screenshot of the current screen and a snapshot of the on-screen layout (view hierarchy); on-screen text and images are automatically masked before they leave your device, so your personal content is not included. When you are signed in, your account ID is attached to these diagnostic reports. This is active only when diagnostics are configured, and there is no separate in-app opt-out. We also use performance tracing and profiling through Sentry to monitor app and server performance and to diagnose slow startups.
Usage and engagement analytics
To understand and improve how Gemo is used, we collect first-party usage analytics in our own database. This includes app sessions, app version and platform, screens viewed and foreground time, navigation choices, sections viewed, searches and result interactions, recipe and community actions such as impressions, clicks, saves, cooks and shares, notification permission and opens, and interactions with subscription offers and purchase flows. For subscriptions processed through RevenueCat on iOS or enabled Android versions, subscription events, product and store information, and the country or region associated with a purchase may be used for aggregated subscription and audience reporting. Analytics events use a random device-bound analytics installation identifier and a session identifier; while you are signed in, activity may also be linked temporarily to your account ID. The analytics installation identifier is separate from the push-notification installation identifier and is not a hardware or advertising identifier. Apart from measuring our own ad campaigns on Android as described in "Advertising measurement on Android", we do not use this analytics for advertising or tracking across other companies' apps or websites, and no third-party analytics SDK receives these events. Raw screen, section, and navigation events are kept for no more than 30 days. Other raw analytics, including search, product and community actions and temporary purchase-correlation data, are kept for no more than 90 days and may be deleted sooner after aggregation. Temporary account-linked analytics records are deleted when you delete your account and otherwise kept for no more than 90 days. Identifier-free aggregates may be kept for up to 24 months. Every non-empty normalized search query may enter an identifier-free weekly aggregate, including singleton, one-off, and rare queries. There is no separate in-app analytics opt-out.
Advertising measurement on Android
When advertising measurement is enabled in the Android app, we use the Meta (Facebook) software development kit (SDK) that is already included for Facebook sign-in to measure how well our Facebook and Instagram ads work. Advertising measurement is not enabled on devices in the European Economic Area, the United Kingdom or Switzerland: without using location permissions, the app checks the country of the device's SIM card, mobile network and time zone, and keeps measurement off if any of them points to one of these countries. The Android app sends Meta the following events: that the app was installed and opened for the first time, that a new account was created (with the sign-up method only, such as email or Google), and that cooking mode was started for the first time on the device. These events are sent with an identifier generated by Meta's SDK, your device's Google advertising ID where your device settings make it available, basic device and app information (such as device model, operating system and app version) and your IP address. Meta may use your IP address to estimate your approximate location for advertising and measurement. If the Facebook app is installed on your device, Meta's SDK also sends an identifier from the Facebook app that lets Meta match these events to your Facebook account. For installs that come from a Meta ad, the campaign information that Google Play passes to the app at installation is also sent to Meta. For Android subscriptions, RevenueCat sends Meta trial-start and subscription events with the same identifier. We do not send Meta your name, email address, recipes or other content. Meta may use this information under its own terms and privacy policy (https://www.facebook.com/privacy/policy/) for ad measurement, ad targeting and ad delivery. You can reset or delete your advertising ID, or opt out of ads personalization, in your device's Google settings, and you can manage your ad preferences in your Facebook or Instagram account. We also store, in our own analytics database, the campaign information that Google Play passes to the app at installation (the install referrer), together with the random analytics installation identifier, to see which of our campaigns bring people who keep using Gemo. We keep these campaign records in Gemo’s own database for no more than 90 days and use them only for our own reporting. This limit does not describe Meta’s retention of information it receives; Meta handles that information under its own terms and privacy policy. Changing your advertising ID settings does not necessarily stop measurement events sent using other identifiers, such as Meta’s SDK identifier. You can also turn advertising measurement off at any time in the app under Settings → "Ad measurement". When it is off, the Android app stops sending events to Meta, stops collecting your advertising ID for Meta and stops sending us the install referrer, and it removes the Meta identifier from the subscription record at RevenueCat that the app uses on this device, including after you later sign in or out, so that subscription events are no longer sent to Meta with it. You can turn it back on in the same place. Turning it off does not delete information that Meta or we received before; that information is handled as described above.
Public content and community features
Posts, comments, ratings, and your follower and following lists, together with their photos, are publicly readable in the app even by people without an account. They are always shown with your display name, avatar, and chef status; there is no private handle or username you can hide behind.
- Likes and follows: post and comment likes and your follow relationships are stored tied to your account and power counts and feeds. Liking or following someone may send that person a notification.
- Reports: when you report content, we capture the reason, any free-text details you provide, your identity as the reporter, and a reference to the reported content. Reports are visible to our administrators and are kept after they are resolved, and you cannot delete them yourself. Reports you filed are deleted when you delete your account. If a reported recipe, post or comment is deleted, the report is kept for our moderation records without a link to that content; it records only the type of content that was reported.
Private content and app activity
Some of your content is private to your account and is not shown to other users. This includes your favorites, your shopping-list items (free text), and your meal-plan entries, which can reveal dietary or shopping intentions. Private content is kept until you delete it or delete your account.
- Collections (premium): you can create named collections of saved recipes. Collections are private to your account, are a premium feature, and are kept until you delete them or delete your account.
- Cooking sessions and history (premium): for each recipe you cook, we store a cooking session tied to your account, including its status, your current-step progress, the completed time, and your cooking-result photo and thumbnail and any free-text notes. This powers your cooking history. Guest cooking sessions are stored only on your device and sync to your account when you sign in.
Information stored on your device
To make the app fast and usable offline, some information is cached on your device, including downloaded images, your premium flag, your dietary preferences, random analytics installation and session identifiers, guest cooking progress, your FCM push token, and your push-notification installation ID. This cache is cleared when you uninstall the app or clear its data; the premium cache is also cleared when you sign out.
How we use your information
We use the information above for the following purposes:
- To create and secure your account, keep you signed in, and provide the app's recipe, profile, social, notification, scanning, and Gemo Plus features.
- To store, display, recommend, organize, and rank recipes, photos, ratings, comments, saved items, collections, shopping lists, cooking history, and other content.
- To check and provide subscription access, verify purchases, restore access, and prevent payment or account abuse on iOS and enabled Android versions.
- To moderate content, review reports, enforce our rules, protect users, investigate abuse, and comply with legal obligations.
- To improve reliability, fix bugs, measure performance, understand feature usage, and provide customer support.
- On Android, to measure how well our ads on Facebook and Instagram work, as described in "Advertising measurement on Android".
Service providers and how information is shared
We do not sell your personal information. We share it only with the service providers that operate the app on our behalf, with Meta for the Android advertising measurement described in "Advertising measurement on Android", with other users when you publish public content, and with authorities when required by law, to protect rights and safety, to investigate fraud or abuse, or to enforce our terms. The companies we share it with (each processing data under its own privacy policy) are:
- Supabase - authentication and our Postgres database (account data, content, session tokens, device tokens and installation IDs, subscription records, scan runs, and analytics events).
- Cloudflare R2 - storage and content-delivery of the images you upload and frames retained from creator-video imports.
- Firebase Cloud Messaging and Apple Push Notification service (APNs) - delivering push notifications.
- Google Gemini (and conditionally OpenRouter) - AI text recognition for recipe-photo scanning; Google Gemini, through the Gemini Files API - temporary video upload and recipe extraction for creator-video imports.
- RevenueCat - subscription status, purchase verification and Restore on iOS and enabled Android versions, including SDK customer/device processing for users who have not made a purchase. Apple and Google Play - their respective store purchases and payments.
- Sentry - crash reporting, diagnostics, and performance monitoring.
- Apple and Google - social sign-in.
- Meta (Facebook) - social sign-in; on Android, also the advertising measurement described in "Advertising measurement on Android", for which Meta also uses the data under its own terms.
How long we keep information
We keep your account, content, and account-linked complimentary Gemo Plus operational history (including administrator-only reasons and internal notes) until you delete your account. Raw screen, section, and navigation analytics are kept for no more than 30 days. Other raw analytics, including search, product and community actions, temporary account links, and purchase-correlation data, are kept for no more than 90 days and may be deleted sooner after aggregation. Temporary account-linked analytics records and matching raw account analytics are deleted when you delete your account. Identifier-free analytics aggregates may be kept for up to 24 months. This includes weekly normalized search-query aggregates for singleton, one-off, and rare queries. Recipe-scan photos are not stored by Gemo; that statement applies only to the photo-scanning flow. Creator-video imports may use temporary Gemo server storage and the Google Gemini Files API as described above. During cleanup, Gemo attempts to delete the temporary server copy and to manually delete the Files API upload; Google states that Files API uploads are automatically deleted after 48 hours. The durable account-linked import record is deleted when you delete your account. Selected or extracted frames and resulting recipe data may remain as recipe content under the normal controls and limitations described here; when you delete your account, your imported recipes are deleted and we attempt to delete the media stored for them. After account deletion, other published recipes you wrote may remain with anonymized authorship. Purchase and transaction records we receive from RevenueCat are kept after account deletion without your account ID, so that we can recognize repeated store notifications, reconcile revenue, and keep payment records. Please note these retention limits: except for import-owned media covered by its specific cleanup controls and the account-deletion cleanup described above, our app and API do not currently delete image files from Cloudflare R2 when you remove content, and some related records may not be fully removed automatically. Copies of content that were distributed (for example, in notifications) or processed by a provider may also persist. For these reasons we cannot promise the complete erasure of every image or copy.
Deleting your account and your controls
You can delete your account at any time from Settings by selecting Delete account. Deletion removes your authentication user; cascade-deletes your subscription status records, scan runs, and durable account-linked creator-video import records; deletes the recipes you imported, published or not, and your unpublished recipes, including drafts and scanned drafts; deletes the reports you filed; and removes temporary account-linked analytics and matching raw account analytics. We remove your account ID from the purchase records we received from RevenueCat, and within about a day of the deletion we ask RevenueCat to delete its customer record for your account. Ingredient names you added that were not in our catalog stay in our ingredient review history without your account ID. Identifier-free analytics aggregates may remain. Other published recipes you wrote may remain with anonymized authorship. As noted above, some content, image files, and copies may not be fully erased. Deleting your account does not cancel a store subscription; cancel it in the store where you bought it. You also have day-to-day controls in the app:
- Edit your profile information in Edit Profile.
- Change your language, theme, and notification preferences in Settings.
- Change or reset your password.
- Manage your notifications and meal-plan reminders.
- Delete individual posts, comments, ratings, favorites, shopping-list items, and meal-plan entries.
- Contact support from Settings or by emailing [email protected] for help, privacy questions, or data access and deletion requests.
Your privacy rights
Under the Georgian Law on Personal Data Protection (and equivalent GDPR-style rights where they apply to you), you have the right to access your personal data, correct it, delete it, object to or restrict certain processing, receive a portable copy, and withdraw consent where processing is based on consent. To exercise these rights, email [email protected]; we may need to verify your identity. Because we rely on the service providers listed above, your data may be processed across borders. You also have the right to lodge a complaint with the competent supervisory authority, the Personal Data Protection Service of Georgia.
Children
Gemo is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 through any sign-in method, including email and password, social sign-in, or guest use. If your local law sets a higher age for consent to digital services, you must meet that age or use the app only with the permission of a parent or legal guardian. If we learn that we collected personal information from a child without appropriate consent, we will take steps to delete it.
Security
We use reasonable technical and organizational measures to protect your information. Passwords are hashed by our authentication provider and are never stored in plain text by us. Public reads are protected by row-level security using a restricted anon key, while writes go through our authenticated API using a privileged service-role key on the server. Data is encrypted in transit. No method of transmission or storage is completely secure, so please use a strong, unique password and keep your credentials private.
No GPS collection and no ads in the app
We do not request device location permissions or collect GPS coordinates, and we do not show ads in the app. When Android advertising measurement is enabled, Meta may estimate your approximate location from your IP address as described above. Except for the Android measurement described in "Advertising measurement on Android", we do not use advertising identifiers, we do not track you across other apps or websites, and we include no third-party advertising or third-party analytics SDKs. On iOS or enabled Android versions, a purchase provider may supply the country or region associated with a purchase; this is not GPS or precise device location. Any "where to buy" information shown for ingredients is editorial content we maintain, not based on your device location. Our servers may record IP addresses in their logs for security and diagnostic purposes, but we do not derive your precise location from this.
Differences between iOS and Android
Apple processes iOS subscription purchases; Google Play processes Android subscription purchases. RevenueCat supports subscription status and Restore on both platforms where enabled. Using Gemo without a purchase, including with complimentary access, does not prevent an enabled RevenueCat SDK from processing customer/device information or checking subscription status, and purchase or Restore activity in enabled versions produces purchase data. Prices, trials and feature limits are shown in the app. AI recipe scanning is available on iOS and Android, and scan photos are sent to Google Gemini or, if configured, OpenRouter on both platforms.
International processing
Your information may be processed and stored in countries other than where you live, including by the service providers listed above. Where required, we rely on appropriate safeguards for international transfers and process your information in accordance with applicable privacy laws.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the effective date and version, and for material changes we will provide notice in the app in both Georgian and English. Your continued use of the app after the changes take effect means you accept the updated policy.
Contact us
For any privacy question or request, contact App Studio LLC at [email protected], or write to us at Saburtalo district, Z. Panaskertel-Tsitsishvili st., N11, apartment 124, Tbilisi, Georgia. You can also reach us from Settings by selecting Contact Support.