1. Controller

The controller for this processing is Giner Aaron, reachable at contact@gineraaron.com.

2. What is stored

The application stores only what it needs in order to work:

• Account: your account is not held here. It belongs to Ginius Hub at hub.gineraaron.com, which is where you sign in and where your password is stored, under the same controller named above. Gustus keeps only the account number the Hub gave you, a copy of your name, the time of day you want your reminder, and the last day a reminder was considered for you. Gustus never sees your password. The Hub's own privacy policy covers what it stores.
• Your recipes: for each one, its title, notes, servings and preparation time, the categories you put it in, its ingredients with the quantities and prices you entered, and its method.
• Photographs: the pictures you add to a recipe, stored as files on this server exactly as your browser sent them, after it had scaled them down. The database holds only the file names. A photograph taken with a phone can carry details of its own; scaling it in the browser redraws the picture and does not carry the camera's metadata — location included — across.
• Your categories: the names you gave them.
• Your cooking history: each time you accepted or started a recipe, a copy of its title, ingredients, prices and method as they were that day, which items you ticked off or marked not needed, which steps you finished, and when you started and finished.
• Your meal calendar: which recipe is planned for which day, whether it repeats weekly or monthly and until when, and any single days taken out of a series.
• Devices you turned reminders on for: for each one, the address your browser's push service gave us, the two public keys that browser generated so we can encrypt to it, the browser's self-reported name, and when it was added and last sent to. See section 5.

Nothing is collected automatically: no location, no device sensors, no contacts, no analytics or tracking services, no advertising networks, no profiling. The "pick something" button is a weighted draw over your own recipes, made on this server from nothing but when you last cooked each one.

3. Access logs and IP addresses

Every request is logged on the server. Those logs contain the IP address of the device making the request, along with the time, the address requested, the HTTP method and the response status. They exist for running the service, for finding faults and for fending off abuse. The legal basis is the legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR). The logs are not joined with your account and expire with the usual system rotation.

4. Cookies and local storage

Gustus sets exactly one cookie: the session cookie that keeps you signed in here. It is cryptographically signed, sent over HTTPS only, and expires after a year or when you log out. Signing in also sets cookies on hub.gineraaron.com, described in the Hub's own privacy policy; those are set by the Hub on its own address and are never sent to this one. Signing out — here or in any other Ginius Hub app — ends the session here as well: the Hub tells this app over the server's own internal network, passing nothing but your account number, and the cookie stops being accepted from that moment, on this device and on every other one. Your device additionally remembers, locally, the tab you last had open and the category you last picked from. Those values never leave your device. So that the installed app works offline, the browser also keeps a local cache of the program files and of the photographs it has shown — not of your recipes.

5. Morning reminders

You can ask Gustus to remind you, on a phone or computer and even when the app is closed, on the mornings of days you have planned a meal for. It is off until you turn it on, per device, in the settings menu — turning it on here does not turn it on anywhere else, and your browser asks your permission before anything is stored.

When you turn it on, your browser creates a subscription at its own maker's push service — Google's for Chrome, Mozilla's for Firefox, Apple's for Safari — and gives us the address of it. Sending you a reminder means handing that message to that service, which delivers it to your device. This is something this server sends to a third party on your behalf, and those services are operated outside the EU.

The content is encrypted before it leaves this server, to keys only your browser holds, so the push service carries the reminder without being able to read the meal, the price or your name. What it necessarily does learn is that this server sent a message to that device, and when. That is inherent to how the delivery works and cannot be avoided while the feature is on.

The legal basis is your consent (Art. 6(1)(a) GDPR), given by the browser's permission prompt and by the switch itself. You can withdraw it at any time by turning the switch off, which deletes that device's subscription here immediately; revoking the permission in your browser's own settings has the same effect, and the subscription is dropped the first time the push service says it is gone.

6. No third-party content in the page

The page itself loads nothing from outside servers. The typefaces and the photographs are served from here rather than fetched from Google Fonts or anyone else, so opening the page creates no connection to a third party and your IP address is passed to no one. The one transfer that can happen is the reminder in section 5, and only if you switch it on.

7. Purposes and legal bases

Your recipes, photographs, categories, history and calendar, and the account number they hang from, are processed for one purpose only: to keep the recipe collection you signed up to keep, which is performance of that arrangement (Art. 6(1)(b) GDPR). Reminders rest on your consent as set out in section 5, and log data on the legitimate interest in section 3.

8. Retention and deletion

Your data is kept for as long as your account exists. Deleting a recipe removes it, its photographs and its place in the calendar straight away; your cooking history keeps its own copy of what was cooked, which you can delete entry by entry. You can delete the whole account yourself at any time: the entry in the settings menu takes you to Ginius Hub, which is where the account lives. Deleting it there irreversibly removes the account and instructs Gustus to remove every recipe, photograph, category, history entry, calendar entry and device subscription it holds for you, along with everything any other Ginius Hub app holds; there is no recovery. If Gustus cannot be reached at that moment, nothing is deleted anywhere and you are asked to try again, so your recipes can never be left behind with no account attached to them. Access logs are not covered by this, as they are not tied to an account.

9. Sharing with third parties

Your recipes are shared with no one. They sit on a self-operated server in Austria; there are no processors, nothing is sold, and nothing is transferred anywhere except the encrypted reminders described in section 5, if you turn them on.

10. Security

The connection is encrypted with HTTPS throughout. Your password is never sent to Gustus: you type it at Ginius Hub, which protects it with scrypt, and Gustus is handed only a single-use code that it redeems once over a connection that never leaves the server. Each account sees only its own recipes, photographs and plans; that separation is enforced on every single query, and photographs are only served to a signed-in browser.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection under Arts. 15–21 GDPR. A message to the contact address above is enough. You also have the right to lodge a complaint with your competent data protection supervisory authority — in Austria, the Datenschutzbehörde.