Who we are (operator and data controller)
Gemo is operated by App Studio LLC, a limited liability company registered in Georgia (registration ID 405844859, LEPL National Agency of Public Registry), directed by Nika Choladze, with its registered address at Saburtalo district, Z. Panaskertel-Tsitsishvili st., N11, apartment 124, Tbilisi, Georgia. App Studio LLC is the data controller responsible for the personal information described in this policy, and is the "developer" for the purposes of the Apple Licensed Application End User License Agreement. You can contact us about anything in this policy at [email protected]. This policy and our handling of your personal information are governed by the law of Georgia.
Who and what this policy covers
This policy applies when you use the mobile app, create or sign in to an account, browse and save recipes, publish recipes, upload photos, comment, rate recipes, follow other users, use Gemo Plus features, scan recipes, contact support, or otherwise interact with the service. It applies whether you sign in with an email and password, sign in with Apple, Google, or Facebook, or use the app as a guest.
Account and identity information
When you register, sign in, reset your password, or convert a guest session into an account, we collect your email address, your chosen display name, and account settings. Passwords are handled by our authentication provider (Supabase Auth) and are stored only in hashed form; we never receive or store your password in plain text. Your account is identified internally by a unique account ID (UUID), which is the only identifier that ties your data together; there is no public username or handle.
Signing in with Apple, Google, or Facebook
If you choose social sign-in, the provider returns an identity or access token together with your email address and name so we can create or match your account. Apple shares your name only on the first sign-in. If Facebook does not return an email address, we generate a synthetic placeholder address for your account. Your Facebook user ID may be stored in your account metadata to keep the link working; it is removed when you delete your account. We do not retain the sign-in tokens themselves after authentication.
Staying signed in (session tokens)
To keep you signed in, an access token (JWT) and a refresh token are stored using operating-system-protected secure storage on your device. On Android, authentication storage is excluded from cloud backup and device-to-device transfer. On iOS, it uses non-synchronizing Keychain storage that does not migrate to another device. These tokens are cleared when you sign out or delete your account, and the session is revoked on our server when you log out.
Profile information
Your profile may include an avatar (a reference to an image you upload) and your language preference. You can edit these at any time, and they are removed when you delete your account.
How your account ID is used
Your account ID is attached to the requests your app makes to our API. On iOS it is also sent to our subscription provider (RevenueCat) so your subscription can be recognized across your devices, and it is attached to in-app engagement events while you are signed in.
Photos and files you upload
Photos you add to the app (recipe images, your avatar, post and comment images, and cooking-result photos) are stored on Cloudflare R2 and served as public content-delivery objects at hard-to-guess random URLs. These image files are retained indefinitely. Please note an important limitation: our app and API do not currently delete these image files from storage even after you remove the related content or delete your account. Do not upload images you would not be comfortable being publicly accessible.
AI recipe scanning
On iOS and Android, you can scan a recipe by photo. When you do, the photo is transmitted to a third-party AI service (Google Gemini, or OpenRouter if our server is configured to use it as a fallback) to read the text in the image. The image is held only in our server's memory for the duration of that request; it is not saved to our database or image storage. Each provider processes the image under its own privacy policy and may retain its own copy according to that policy.
- AI-derived data: the transcribed text and the structured draft (title, ingredients, steps, nutrition estimates, notes) are saved in our database tied to your account, along with the per-stage AI request and response payloads we use to process the scan and debug problems. These are deleted when you delete your account.
- Scan telemetry and quota: we store information about each scan run tied to your account (timestamps, status, the model and provider used, token counts, duration, estimated cost, and your lifetime free-scan count) to operate the feature, monitor cost, and enforce the free-scan limit. This is removed when you delete your account.
Subscriptions and payments
On iOS, Gemo Plus is a paid auto-renewable subscription (product gemo_premium_monthly, currently $2.99 USD per month, with a one-week free introductory trial for eligible new subscribers). The purchase is processed by Apple and managed through RevenueCat. We store a subscription entitlement record (status, product ID, plan, and start, expiry, and cancellation dates). We never receive or store your payment-card number or any billing details; all payment information is handled directly by Apple. On Android, all Gemo Plus features are free during our launch period. A subscription will be introduced later; until then there are no in-app purchases and no purchase or payment data is collected on Android.
- Complimentary access: an authorized administrator may add, edit, or revoke Gemo Plus access without changing your store billing. We keep an account-linked operational history of these actions, including the selected reason and an optional internal note visible only to administrators. This history is retained until you delete your account.
- RevenueCat device identifiers (iOS): by its own defaults, the RevenueCat SDK collects device identifiers and basic device and operating-system information to attribute purchases. We send RevenueCat only your account ID; we do not set your email, name, or other custom attributes.
Notifications and reminders
If you grant notification permission and are signed in, we store a push token from Firebase Cloud Messaging (FCM), an app-generated installation ID (a random per-install UUID that is not a hardware or advertising identifier), and your platform and push environment, all tied to your account. These are removed when you sign out or delete your account, and invalid tokens are pruned automatically.
- Notification content: push messages may contain other users' display names and short snippets of user content (such as comment or post text, recipe titles, or ratings) and related identifiers in the data payload. Notifications are delivered via FCM (and Apple's APNs on iOS) and are also stored in your in-app inbox.
- Meal-plan reminders (premium): if you enable weekly reminders, we store your chosen day of the week, local time, and timezone (default Asia/Tbilisi) so we can schedule the reminder. Timezone information used only for purely on-device local notifications is not transmitted to us.
Crash reports and diagnostics
We use Sentry to detect and fix crashes and errors in both the app and our server. It automatically collects diagnostic data such as stack traces, exception messages, device model and operating system, app version, environment, and breadcrumbs (the screens you navigated and the API URLs your app called). When an error occurs it also captures a screenshot of the current screen and a snapshot of the on-screen layout (view hierarchy); on-screen text and images are automatically masked before they leave your device, so your personal content is not included. When you are signed in, your account ID is attached to these diagnostic reports. This is active only when diagnostics are configured, and there is no separate in-app opt-out. We also use performance tracing and profiling through Sentry to monitor app and server performance and to diagnose slow startups.
Usage and engagement analytics
To understand and improve how Gemo is used, we collect first-party usage analytics in our own database. This includes app sessions, app version and platform, screens viewed and foreground time, navigation choices, sections viewed, searches and result interactions, recipe and community actions such as impressions, clicks, saves, cooks and shares, notification permission and opens, and interactions with subscription offers and purchase flows. On iOS, RevenueCat subscription events, product and store information, and the country or region associated with a purchase may be used for aggregated subscription and audience reporting; Android currently has no purchases. Analytics events use a random device-bound analytics installation identifier and a session identifier; while you are signed in, activity may also be linked temporarily to your account ID. The analytics installation identifier is separate from the push-notification installation identifier and is not a hardware or advertising identifier. We do not use this analytics for advertising or tracking across other companies' apps or websites, and no third-party analytics SDK receives these events. Raw screen, section, and navigation events are kept for no more than 30 days. Other raw analytics, including search, product and community actions and temporary purchase-correlation data, are kept for no more than 90 days and may be deleted sooner after aggregation. Temporary account-linked analytics records are deleted when you delete your account and otherwise kept for no more than 90 days. Identifier-free aggregates may be kept for up to 24 months. Every non-empty normalized search query may enter an identifier-free weekly aggregate, including singleton, one-off, and rare queries. There is no separate in-app analytics opt-out.
Public content and community features
Posts, comments, ratings, and your follower and following lists, together with their photos, are publicly readable in the app even by people without an account. They are always shown with your display name, avatar, and chef status; there is no private handle or username you can hide behind.
- Likes and follows: post and comment likes and your follow relationships are stored tied to your account and power counts and feeds. Liking or following someone may send that person a notification.
- Reports: when you report content, we capture the reason, any free-text details you provide, your identity as the reporter, and a reference to the reported content. Reports are visible to our administrators and are retained (marked resolved rather than deleted), and you cannot delete them yourself.
Private content and app activity
Some of your content is private to your account and is not shown to other users. This includes your favorites, your shopping-list items (free text), and your meal-plan entries, which can reveal dietary or shopping intentions. Private content is kept until you delete it or delete your account.
- Collections (premium): you can create named collections of saved recipes. Collections are private to your account, are a premium feature, and are kept until you delete them or delete your account.
- Cooking sessions and history (premium): for each recipe you cook, we store a cooking session tied to your account, including its status, your current-step progress, the completed time, and your cooking-result photo and thumbnail and any free-text notes. This powers your cooking history. Guest cooking sessions are stored only on your device and sync to your account when you sign in.
Information stored on your device
To make the app fast and usable offline, some information is cached on your device, including downloaded images, your premium flag, your dietary preferences, random analytics installation and session identifiers, guest cooking progress, your FCM push token, and your push-notification installation ID. This cache is cleared when you uninstall the app or clear its data; the premium cache is also cleared when you sign out.
How we use your information
We use the information above for the following purposes:
- To create and secure your account, keep you signed in, and provide the app's recipe, profile, social, notification, scanning, and Gemo Plus features.
- To store, display, recommend, organize, and rank recipes, photos, ratings, comments, saved items, collections, shopping lists, cooking history, and other content.
- To process and verify subscriptions, restore purchases, and prevent payment or account abuse (iOS).
- To moderate content, review reports, enforce our rules, protect users, investigate abuse, and comply with legal obligations.
- To improve reliability, fix bugs, measure performance, understand feature usage, and provide customer support.
Service providers and how information is shared
We do not sell your personal information. We share it only with the service providers that operate the app on our behalf, with other users when you publish public content, and with authorities when required by law, to protect rights and safety, to investigate fraud or abuse, or to enforce our terms. Our service providers (each processing data under its own privacy policy) are:
- Supabase - authentication and our Postgres database (account data, content, session tokens, device tokens and installation IDs, subscription records, scan runs, and analytics events).
- Cloudflare R2 - storage and content-delivery of the images you upload.
- Firebase Cloud Messaging and Apple Push Notification service (APNs) - delivering push notifications.
- Google Gemini (and conditionally OpenRouter) - AI text recognition for recipe scanning.
- RevenueCat and Apple - processing and managing subscriptions and payments (iOS only).
- Sentry - crash reporting, diagnostics, and performance monitoring.
- Apple, Google, and Meta (Facebook) - social sign-in.
How long we keep information
We keep your account, content, and account-linked complimentary Gemo Plus operational history (including administrator-only reasons and internal notes) until you delete your account. Raw screen, section, and navigation analytics are kept for no more than 30 days. Other raw analytics, including search, product and community actions, temporary account links, and purchase-correlation data, are kept for no more than 90 days and may be deleted sooner after aggregation. Temporary account-linked analytics records and matching raw account analytics are deleted when you delete your account. Identifier-free analytics aggregates may be kept for up to 24 months. This includes weekly normalized search-query aggregates for singleton, one-off, and rare queries. Recipe-scan images are not stored by us, though the AI provider may keep its own copy under its policy. Please note these retention limits: our app and API do not currently delete image files from Cloudflare R2 when you remove content or delete your account, and some related records may not be fully removed automatically. Copies of content that were distributed (for example, in notifications) or processed by a provider may also persist. For these reasons we cannot promise the complete erasure of every image or copy.
Deleting your account and your controls
You can delete your account at any time from Settings by selecting Delete account. Deletion removes your authentication user, cascade-deletes your subscription records and scan runs, removes temporary account-linked analytics and matching raw account analytics, and makes a best-effort attempt to clear your alias at RevenueCat. Identifier-free analytics aggregates may remain. As noted above, some content, image files, and copies may not be fully erased. You also have day-to-day controls in the app:
- Edit your profile information in Edit Profile.
- Change your language, theme, and notification preferences in Settings.
- Change or reset your password.
- Manage your notifications and meal-plan reminders.
- Delete individual posts, comments, ratings, favorites, shopping-list items, and meal-plan entries.
- Contact support from Settings or by emailing [email protected] for help, privacy questions, or data access and deletion requests.
Your privacy rights
Under the Georgian Law on Personal Data Protection (and equivalent GDPR-style rights where they apply to you), you have the right to access your personal data, correct it, delete it, object to or restrict certain processing, receive a portable copy, and withdraw consent where processing is based on consent. To exercise these rights, email [email protected]; we may need to verify your identity. Because we rely on the service providers listed above, your data may be processed across borders. You also have the right to lodge a complaint with the competent supervisory authority, the Personal Data Protection Service of Georgia.
Children
Gemo is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 through any sign-in method, including email and password, social sign-in, or guest use. If your local law sets a higher age for consent to digital services, you must meet that age or use the app only with the permission of a parent or legal guardian. If we learn that we collected personal information from a child without appropriate consent, we will take steps to delete it.
Security
We use reasonable technical and organizational measures to protect your information. Passwords are hashed by our authentication provider and are never stored in plain text by us. Public reads are protected by row-level security using a restricted anon key, while writes go through our authenticated API using a privileged service-role key on the server. Data is encrypted in transit. No method of transmission or storage is completely secure, so please use a strong, unique password and keep your credentials private.
No location tracking and no advertising
We do not collect your device location or GPS, we do not use advertising identifiers, we do not track you across other apps or websites, and we include no third-party advertising or third-party analytics SDKs. On iOS, a purchase provider may supply the country or region associated with a purchase; this is not GPS or precise device location. Any "where to buy" information shown for ingredients is editorial content we maintain, not based on your device location. Our servers may record IP addresses in their logs for security and diagnostic purposes, but we do not derive your precise location from this.
Differences between iOS and Android
Some data practices differ by platform. Subscriptions and payment processing currently apply only on iOS through Apple and RevenueCat, and iOS analytics may include subscription outcomes and the country or region associated with a purchase. On Android, all Gemo Plus features are free during our launch period and a subscription will be introduced later, so no purchase data is collected on Android until purchases exist there. AI recipe scanning is available on iOS and Android, and scan photos are sent to Google Gemini or, if configured, OpenRouter on both platforms.
International processing
Your information may be processed and stored in countries other than where you live, including by the service providers listed above. Where required, we rely on appropriate safeguards for international transfers and process your information in accordance with applicable privacy laws.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the effective date and version, and for material changes we will provide notice in the app in both Georgian and English. Your continued use of the app after the changes take effect means you accept the updated policy.
Contact us
For any privacy question or request, contact App Studio LLC at [email protected], or write to us at Saburtalo district, Z. Panaskertel-Tsitsishvili st., N11, apartment 124, Tbilisi, Georgia. You can also reach us from Settings by selecting Contact Support.