Privacy Policy

This policy explains what personal data the Lusk mobile application ("Lusk", "the App") processes, why, on what legal basis, who receives it, how long it is kept and what rights you have. It applies to the App and to the websites lusk-app.cz and lusk-app.com.

1. Who is responsible (controller)

The controller of your personal data is Daniel Suske, Czech Republic. Contact for all privacy matters: dansuske@gmail.com. We have not appointed a data protection officer, as the law does not require one for an operation of our size.

2. What we process

• Account: email address, display name, profile photo and sign-in identifiers (email and password, Sign in with Apple or Google Sign-In). With Sign in with Apple you may choose to hide your real email address.
• Your content: recipes, collections, meal plans, shopping lists, pantry items, household and family memberships, and the photos you add.
• Community: profile bio and links, follows, ratings, reviews, comments, feed posts, reports you make and users you block.
• What you give the AI features: links, page text, pasted text, photos of recipes or receipts, and requests for new recipes (see section 4).
• Food preferences: allergens, diet and disliked ingredients, if you enter them. Allergens and diets can reveal information about your health; we use them only to filter and adapt recipes for you and never show them to other users.
• Purchases: subscription status, product and renewal dates, linked to an anonymous purchase ID. Payment itself is handled by Apple or Google; we never see your card details.
• Technical data: crash and error reports, performance measurements, device model, operating system and app version, a push-notification token and an app-integrity token.
• Import record: which link you imported a recipe from and when, with your account identifier and email address. It is not visible to anyone in the App.

We do not use your data for advertising, we do not sell it, and the App contains no advertising or tracking SDKs.

3. Why we process it and on what legal basis

• Providing the App you signed up for — your account, storing and syncing your content, imports and AI features you start, households, community features and subscriptions: performance of our contract with you (Art. 6(1)(b) GDPR).
• Keeping the App working and safe — crash reports, performance data, abuse prevention, automated checks of uploaded photos and text, and handling reports: our legitimate interest in a reliable and safe service (Art. 6(1)(f) GDPR). You can object at any time (section 9).
• Allergens and diets you enter: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw by removing them in the App's settings. Push notifications: your consent given in the system dialog (Art. 6(1)(a) GDPR), withdrawn in your device settings.
• Legal obligations — answering lawful requests from authorities and keeping records of content decisions under the EU Digital Services Act (Art. 6(1)(c) GDPR).
• Import record — establishing, exercising or defending legal claims concerning imported content, such as a copyright complaint about a recipe you imported: our legitimate interest (Art. 6(1)(f) GDPR). You may object (section 9).

4. Artificial intelligence

Lusk uses Google's Gemini models (Google LLC / Google Cloud) to: read a recipe from a link, text or photo; create recipes and recipe ideas you ask for; read shopping receipts; match ingredients and units; and check uploaded photos for content that may not be shown. For these features we send Google only what the feature needs — the link and page text, your text, your photos or your request, and your app language and food preferences where relevant. Your name and email are not included. Google acts as our processor and, under its terms for paid API use, does not use this data to train its models. Before you use an AI feature for the first time, the App tells you this and asks you to agree.

AI output can be wrong. Always check amounts, allergens and cooking times. Recipes without a photo may show an illustration that Lusk created with AI (marked with the Lusk sign); it is not a photo of the actual dish. No decision with legal or similarly significant effect on you is made solely by automated means.

5. Who receives your data

We use these service providers, each bound to process data only on our instructions:

• Google (Firebase and Google Cloud): sign-in, database, file storage, server functions, Crashlytics crash reports, Performance Monitoring, Cloud Messaging (push), Remote Config, App Check, and Gemini (section 4).
• RevenueCat: manages and verifies subscriptions using an anonymous purchase ID.
• Pinecone: powers ingredient search. It receives ingredient names only, never personal data.
• Apify: retrieves the public content of a social-media post (e.g. Instagram, TikTok) when you import from such a link. It receives the link only.
• Apple and Google as app stores, for purchases and, if you use them, Sign in with Apple and Google Sign-In.

Websites you import from. When you import from a link, and when the App shows that recipe's original photo, your device loads the page or picture directly from that website, which therefore sees your IP address, as it would in a browser. We do not copy those photos onto our servers. A photo from a social-network post (Instagram, TikTok, Facebook) is stored with the recipe, because links to such posts expire, and is shown only to you as the person who imported it — not to people who saved the recipe, and never in Discover.

Other users see what you make public: your display name, profile photo, bio and links, recipes you publish (including AI-generated ones), your ratings, reviews, comments, review photos and feed posts. Recipes you import from a link become shared community records without your name (see the Terms). Your email, food preferences, lists, pantry and private recipes are never shown to other users, except to members of a household you choose to share with.

6. Transfers outside the EU

Google, RevenueCat, Pinecone and Apify may process data in the United States or other countries outside the European Economic Area. Where a provider is certified under the EU–US Data Privacy Framework we rely on the European Commission's adequacy decision; otherwise on the Commission's Standard Contractual Clauses in the provider's data processing terms. Our server functions run in the EU (europe-west1).

7. How long we keep it

• Account and content: while your account exists. When you delete your account, your profile, content, reviews, comments, feed posts and uploaded photos — including photos stored with your imports — are deleted straight away (see section 10). Shared records of recipes imported from a link that other users have saved, rated or reviewed are not deleted, because they rely on them; every link to your account is removed from them, and they contain no personal data about you. Shared records nobody else uses are deleted.
• Import record: while your account exists and for 3 years after you delete it — the general limitation period for claims — after which it is deleted automatically.
• Crash reports: 90 days (Firebase Crashlytics). Performance data: aggregated, without your identity.
• Reports and moderation decisions: up to 12 months after the case is closed, longer only if needed for a legal claim.
• Purchase records: as long as Apple, Google and RevenueCat must keep them for tax and accounting law.

8. Children

Lusk is not intended for children under 15. We do not knowingly process data of children under that age; if you believe a child has created an account, contact us and we will delete it.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting earlier processing. Most of this you can do directly in the App; for anything else write to dansuske@gmail.com and we will answer within one month. You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz), or the authority where you live or work.

10. Deleting your account

In the App: Settings → Account → Delete Account. Without the App: follow the steps on our account deletion page. Deletion is permanent and removes the data listed in section 7. Deleting the account does not cancel a store subscription — cancel it in your App Store or Google Play settings.

11. Subscriptions

Lusk Premium is an auto-renewing subscription sold through the Apple App Store and Google Play. Prices are shown in the App before purchase. Payment is charged to your Apple ID or Google account, and the subscription renews unless you turn off auto-renewal at least 24 hours before the end of the period. For full terms, see our Terms of Use.

12. Changes and contact

We will announce material changes to this policy in the App. Questions: dansuske@gmail.com or our Support page.