Terms of Service

Overview

Thank you for using Gratin. It is made by Reb Software, a New Zealand business run by Russell, and when these terms say "we", "us" or "our", that is who they mean. There is one of us, so we cannot know everyone who uses Gratin personally, and that is why a document like this exists: to say once, and plainly, what you can expect from us and what we ask of you in return.

When these terms say "Gratin", they mean the Gratin app for macOS, Windows, iOS and Android, the Gratin Recipe Clipper extension for Chrome, the optional Gratin account, and hosted sync, which is the one part of Gratin you can pay for. "You" means the person using Gratin or holding the account.

By installing the app, or by creating an account, you agree to these terms. We have tried to write them the way we would want to read them: short, plain and honest. Our privacy policy is a separate document that explains what little data Gratin handles, and it is worth the five minutes. These terms do contain a limitation of our liability; it is in the section of that name.

Gratin is local-first. Your recipes live on your own devices, and nothing in these terms changes that. Most of what follows is about the small part we run for you: the account, and the relay that carries an end-to-end encrypted copy between your devices.

The Gratin app

The Gratin app is free, on every platform, with no limit on how many recipes you keep. It is really free: we do not ask for a card, there is no trial that runs out, and, just as for the people who pay us for sync, we do not sell your data.

We grant you a personal, non-exclusive licence to install and use Gratin on any number of devices you control. You may use it for any kind of cooking, including commercial cooking: a cafe, a caterer or a test kitchen is as welcome as a home cook. The Chrome extension is part of the app and is covered by the same licence.

We plan to publish Gratin's source code under an open-source licence. Once we do, that licence governs the code, and it can only give you more freedom than this one, never less. The Gratin name and logo stay ours either way; ask before using them to promote something.

If you installed Gratin from the App Store or Google Play, the store's own terms also apply to the download, alongside these.

Account terms

1. You do not need an account to use Gratin. An account exists for one thing, hosted sync, and if you never take hosted sync you never need one.
2. An account is a username and a password. We do not ask for an email address and we never collect one. Your password never leaves your device: what our server holds is a set of salted verifiers, which let it check your password or recovery code without knowing either, and an encrypted escrow of your sync key that only your password or your one-time recovery code can open.
3. That design has one consequence you should know before you sign up: we cannot reset your password. If you forget it, the recovery code is the only way back in, so keep it somewhere safe. Your recipes are on your own devices either way.
4. You are responsible for keeping your password and recovery code to yourself, and for everything done through your account. We cannot be liable for loss that comes from them getting out. If you think someone else has got into your account, tell us at once.
5. Because we hold no email address or name for an account, we can only act on it (cancel a plan, delete it, look into a problem) for someone who proves they control it, usually by signing in. We cannot act on anyone else's say-so.
6. You must be a human. Accounts registered by bots or other automated means are not permitted.

Acceptable use

Hosted sync is for the data the Gratin app produces: your recipes, photos, tags, grocery lists, magazines, menus and meal plans. Please do not:

• use the relay to store or move anything other than what Gratin itself produces;
• try to break into, overload or otherwise interfere with the relay, or with anyone else's account or sync;
• work around the storage allowance;
• resell hosted sync, or bundle it into something you charge other people for; or
• use hosted sync for anything unlawful.

If an account is used in those ways we may suspend its hosted sync, and you can email us to talk about it. That is the whole of our power, and we mean it two ways. We will never delete the data on your devices; it is yours and it is not in our hands. And we do not delete accounts ourselves, because deleting an account also clears Gratin's data from the devices signed in to it (see Deleting your account), and that is never ours to do.

Hosted sync

Gratin syncs across your devices through an Evolu-compatible relay, and you can run that relay yourself for free. Hosted sync is our offer to run it for you: no server to manage, every device in step, everything end-to-end encrypted so that we cannot read it. There are two plans:

• Hosted sync, $12 a year. A subscription that renews each year until you cancel. You can cancel at any time.
• Buy once, $39. Paid one time, with no renewals. It includes hosted sync for the life of Gratin 1, and for at least five years from the day you buy it, whichever is longer.

Prices are in US dollars. Apple and Google set their own local prices and currencies, so the figure you see in the App Store or Google Play may differ a little from these.

Both plans include about 50 GB of hosted storage, room for roughly 100,000 recipes with a photo. The recipes on your own devices have no limit; the allowance is for the encrypted copy we host. If you reach it, new changes pause until you make room. We never delete anything already synced to make space.

"The life of Gratin 1" means for as long as Gratin 1 is supported. If a Gratin 2 ever comes, it will be a separate product, and buy-once customers will be offered a discounted upgrade to it. When we eventually retire Gratin 1 (never before your five years are up, and always with notice), your recipes are already on your devices and you can export them or self-host. You may lose the convenience, never the data.

Whichever way you buy, the plan belongs to your Gratin account, not to one device, so it covers every device you sign in to.

Payment, refunds and plan changes

There are three ways to buy hosted sync, and the same two plans are on offer in each. Which one you used decides who takes your money, who handles the tax on it, and who can give it back.

• On the website or in the desktop app, through Polar, our merchant of record. Your payment contract is with Polar, and Polar's buyer terms govern the payment itself. Polar issues your invoice, collects any sales tax or VAT that applies where you live, and holds the billing details it needs to take payment. We never see your card number.
• In the iOS app, through Apple In-App Purchase. Apple takes the payment under its own terms, bills you, and handles any tax. We receive only a purchase identifier, which we use to confirm your plan.
• In the Android app, through Google Play Billing. Google takes the payment under the Google Play terms, bills you, and handles any tax. As with Apple, we receive only a purchase identifier.

Any sales tax or VAT is handled by whoever takes your payment, so the total you pay may differ from the figures above. Where these terms and a store's terms say different things about a purchase made in that store, the store's terms win for that purchase.

Here is our refund policy in full. It differs by channel, because only the party that took a payment can give it back:

• Bought through Polar. Within 14 days of the first time you buy either plan, we refund it in full, no questions asked. Email [email protected] with the username the plan is on. After 14 days, the yearly plan can still be cancelled at any time; it runs to the end of the period you have paid for, then stops, and we do not refund the unused part. After 14 days, the buy-once plan is not refundable.
• Bought through Apple. Apple issues refunds under its own rules. Ask at reportaproblem.apple.com. We cannot issue a refund for an Apple purchase ourselves, however much we might like to; Apple holds the money.
• Bought through Google. Google can refund a purchase itself within 48 hours, from your order history in the Play Store. After that, email us with your username and we will refund through the Play Console, on the same 14-day rule as Polar.
• If we discontinue hosted sync inside the five years promised on the buy-once plan, we refund the unexpired part of either plan pro rata, through whichever channel you bought it, without you having to ask.

The 14-day window covers a first purchase, not a renewal, so if you would rather not be renewed, cancel before the renewal date. That said, the edges are always case by case. If something outside these rules has gone wrong with a Polar or Google purchase, for example a renewal you meant to cancel and have not synced since, email us; we would rather be fair than technical.

If you are on the yearly plan and want to buy once instead, email us and we will sort it out so you never pay twice for the same stretch of time.

Nothing here removes any right you have under the New Zealand Consumer Guarantees Act 1993 or the consumer law where you live. If the service is faulty, those laws apply on top of the above.

Cancellation and termination

We want satisfied customers, not hostages. Cancelling is done where you bought, and needs no phone call and no reason:

• Polar: open Gratin on your desktop and choose "Manage billing" in your account settings, which opens Polar's customer portal, or use the links in the emails Polar sent you when you bought. If you get stuck, email us and we will cancel it for you.
• Apple: on your iPhone or iPad, open Settings, tap your Apple Account, then Subscriptions. Only you can cancel an Apple subscription; we cannot do it from our side.
• Google: open the Play Store, go to Subscriptions, and cancel there.

The buy-once plan has nothing to cancel; it simply runs its term.

When a plan ends, here is what happens:

• Sync pauses. Your devices stop exchanging changes through our relay.
• Every recipe, photo, list, magazine, menu and meal plan stays on your own devices, exactly as it was. Nothing is held back.
• We keep the encrypted copy on our relay for 60 days in case you come back, then remove it.
• Your account stays until you delete it, so you can return later with the same username.
• You can export everything, or point Gratin at a relay you run yourself, at any time, before or after.

On our side, the only thing we ever end is hosted sync, and only for the reasons in Acceptable use. We do not close accounts and we cannot reach your devices.

Deleting your account

You can delete your account from inside the app: open Settings, choose the Sync tab, and in the Account panel choose "Delete account", then type your username to confirm. It takes effect immediately and cannot be undone.

Deleting an account erases everything, on our side and on yours:

• the account, its username, and your subscription record;
• every synced copy on our relay, including recipe books you shared with other people, who lose access to them;
• the replica held by any AI connector you authorised;
• Gratin's data on the device you delete from, which is wiped as part of the deletion; and
• Gratin's data on every other device signed in to the account, each of which wipes its copy the next time it opens.

So export first. If there is anything you want to keep, take a JSON-LD or SQLite export before you delete; there is no grace period and nothing to recover afterwards. If what you actually want is to stop paying, cancel the plan and keep the account, or simply turn sync off; your recipes stay put either way.

On money: deleting the account sets a yearly plan bought through Polar not to renew, and ends a buy-once plan. A subscription bought through Apple or Google is controlled by the store, so cancel it there too, or the store may renew it. Time left on a plan is not automatically refunded, but the refund rules above still apply, including the 14-day window on a first purchase. Polar, Apple and Google keep whatever payment records tax law requires them to keep; those never held your recipes or your password.

The step-by-step version, and what to do if you cannot open the app, is on the delete your account page.

Modifications to the service and prices

Gratin will keep changing. We add features, improve them, and sometimes remove ones that did not work out. We reserve the right to change or discontinue any part of Gratin, but with two promises attached. Because Gratin is local-first, no change we make to hosted sync can take your recipes away from you. And if we ever have to discontinue hosted sync, or retire Gratin 1, we will:

• give you at least 90 days' notice;
• keep export working the whole time, so you can take everything with you;
• honour the five-year floor on the buy-once plan: if the service ends before your five years are up, we refund the unexpired portion pro rata; and
• refund anyone on the yearly plan for the part of their paid period that falls after the end date.

Prices can change for new purchases. A change never touches a buy-once plan you already hold. A change to the yearly price applies to you only from a renewal, and only after we have given you at least 30 days' notice, in the app and through whoever bills you.

Whatever happens to us, the safety net is the architecture: your recipes live on your devices, they export to open formats, the relay can be run by anyone, and the code is on its way to being open source. If our own maths ever catches up with us, you lose nothing and point the app elsewhere.

Uptime, security and privacy

Hosted sync is provided as is and as available. We take its uptime seriously, but we offer no service-level agreement, and we cannot promise it will be there every minute of every day. Local-first means that matters less than it would elsewhere: when the relay is unreachable, Gratin keeps working on every device and catches up when it is back.

Everything that reaches our relay is encrypted on your device first, with a key only you hold, and travels over encrypted connections. The relay stores and carries ciphertext it cannot read, and there is no support mode, admin view or spare key that changes that. What we can see for an account is what the privacy policy lists: the username, the verifiers, the encrypted escrow, your plan, and how much storage the encrypted copy is using. We look at that only to help with a request you make, to fix something that has broken, or to keep the relay safe for everyone.

The one thing that can read your recipes besides your own devices is an AI connector you turn on yourself. If you link Gratin to an assistant through its MCP connector, the connector you authorise keeps a working replica of your recipes so that the assistant can read and edit them. It exists because you asked for it, you can turn it off, and deleting your account removes it.

We use Cloudflare to run the relay, Polar to take payments on the website and desktop, and Apple and Google to take payments in their stores. That is the whole list of companies involved in hosted sync, and none of them can read your recipes either.

If a New Zealand authority ever compels us by lawful order to hand over what we hold for an account, what we hold is the list above and the ciphertext. We have no key and cannot produce a readable recipe for anyone. We will not hand over anything without a binding order, and we will tell you if we are allowed to.

Our privacy policy describes all of this in more detail. You agree that we may handle your data as it describes, and for no other purpose.

Copyright and content ownership

Your recipes, photos, notes, tags, grocery lists, magazines, menus and meal plans are yours. We claim no rights over them, now or ever. Whether you typed a recipe in, clipped it from a website or imported it from another app, it is your content and you are responsible for it, including for having the right to keep it and to share it with the people you share a recipe book with.

You give us the one licence that hosting needs, and nothing more: to store the encrypted copy, pass it between your devices, and deliver it to anyone you choose to share a recipe book with. Because we cannot read what you store, we do not and cannot pre-screen it, and we cannot remove a single recipe from it. If you believe an account is using hosted sync to distribute something it has no right to, email us; the acceptable use section is how we respond.

You can export all of your content at any time, as open JSON-LD or as a full SQLite copy of your database, and take it anywhere you like. Nothing in Gratin is a format only Gratin can read.

Gratin's code, design, name and artwork are ours, or our licensors'. Using Gratin does not make you their owner. The app licence above says what you may do with the app, and the open-source licence will say more once the code is published. Evolu, the sync protocol Gratin is built on, belongs to its authors and comes under its own open-source licence.

Features and bugs

We design Gratin with care, based on our own cooking and on what the people who use it tell us. Even so, there is no such thing as software that pleases everyone, and we make no guarantee that Gratin will meet your particular requirements.

We test before we ship, and Gratin still has bugs, as all software does. We keep no analytics and receive no crash reports, so the only way we learn about one is from you: tell us, with a screenshot if something looks wrong. We work through what is reported, security and data-loss bugs first. Not every bug will be fixed, and we do not promise an error-free Gratin.

Keep your recovery code safe and take an export now and then. Local-first means your devices are the copy that matters, and an export is cheap insurance against a bug on any of them.

Liability

We mention liability in a few places above; here it is in one place.

Gratin, the account and hosted sync are provided as is. To the extent the law allows, our total liability to you for anything arising from Gratin, hosted sync or these terms, whether in contract, tort (including negligence) or otherwise, is limited to the amount you paid us in the 12 months before the claim, and we are not liable for indirect or consequential loss, or for loss of profit, business, goodwill or data. For the free app, that means our best efforts and no warranty.

Nothing in these terms excludes or limits any liability that cannot lawfully be excluded or limited. If you are a consumer in New Zealand, the Consumer Guarantees Act 1993 applies and nothing here takes away the guarantees it gives you. If the consumer law where you live gives you protections that cannot be taken away by contract, you keep them too.

If you use Gratin or hosted sync for the purposes of a business, you agree that you are acquiring them in trade and that the Consumer Guarantees Act 1993 does not apply, as that Act permits.

Relays you run yourself, or that someone other than us runs, are not ours. Gratin will happily talk to them, but we are not responsible for them.

In other words: choosing hosted sync is a bet on us. We do our best to be a safe bet, and Gratin is built so that the bet is a small one. If it does not work out, your recipes are still on your devices, and you point the app elsewhere. If you choose to bet on us anyway, thank you.

Governing law

These terms are governed by the law of New Zealand, and the courts of New Zealand have non-exclusive jurisdiction over any dispute about them. If the law where you live gives you protections that cannot be taken away by a choice of law, you keep them.

If something goes wrong, please email us first. We would much rather fix it than argue about it.

Changes to these terms

We may update these terms from time to time. If a change would reduce your rights, or cost you more, we will say so clearly and give you notice before it takes effect, not bury it. The current version always lives here, with its effective date. No change to these terms will shorten the five-year commitment on a buy-once plan you already hold.

If you keep using hosted sync after a change takes effect, that is your agreement to it. If you do not agree, cancel; nothing on your devices is affected. If at some point we do not enforce one of these terms, that does not mean we have given it up.

Contact

Gratin is made by Reb Software, New Zealand. If you have any questions about these terms, contact us at [email protected].

Adapted from the Basecamp open-source policies, CC BY 4.0.