Privacy Policy

Effective date: 2 October 2026

This policy explains what the Muddle app (the "app") does with information about you: what it collects, where it goes, how long it is kept, and how to have it deleted. It describes the app as it is built, including the services it relies on.

Who we are

The app is provided by Vadym Dzerniuk, Sumy, 40004, Ukraine ("we", "us"). We are the controller of the personal data described in this policy.

Contact for anything in this policy: vdzerniuk@gmail.com.

The short version

• You sign in with Google or Apple. We store your shelf, the recipes you save and what you do with them (made it, ratings, favourites), all keyed to a random user id.
• To invent a recipe, or to read a photo of your bottles, our server sends the bottle names (or the photo) to Google's Gemini API. It does not send your name, email or user id. We use the paid tier of the Gemini API, under which Google does not use prompts or responses to improve its products.
• We do not sell your data, and the app shows no ads.
• Usage and crash reporting is on by default. You can turn it off under Profile → Data & privacy → "Share usage and crash data".
• You can delete your account at any time under Profile → Account → "Delete account", or by emailing vdzerniuk@gmail.com. See Deleting your account for what that covers and what it does not.

Signing in

You need an account to use the app. You can sign in with Google or with Apple. We never see your Google or Apple password.

The app uses Firebase Authentication, a Google service, to manage accounts. Signing in creates an account record containing:

• a random user id that Firebase generates (we use it to find your data);
• your email address as Google or Apple gives it to us. If you use Sign in with Apple and choose to hide your email, this is a private relay address that Apple creates, not your real address;
• for Google sign-in, the name and profile picture address from your Google account;
• which provider you used, and when the account was created and last used.

The app asks Apple for your name as part of the Sign in with Apple request, but it does not pass your name to Firebase and does not store it anywhere.

According to Google, Firebase Authentication also logs IP addresses and user agents during sign-in to protect against abuse, keeps those logs for a few weeks, and runs only from data centres in the United States.

We do not ask for your phone number, postal address or date of birth.

What we store about you

Your data is kept in Cloud Firestore, a Google database, in the European Union (Google's eur3 multi-region, in Belgium and the Netherlands). Every document below is tied to your user id. Our database security rules only let a signed-in user read and change their own documents, and nobody can write to the plan document from the app.

Nothing else in our database identifies you.

Anything you type into a bottle name or a recipe is stored as you wrote it. Please do not put personal information about yourself or anyone else into those fields.

Shared data that is not about you

Our server also keeps two shared stores that every user benefits from. Neither contains a user id or anything you typed:

• A copy of TheCocktailDB answers. Responses from TheCocktailDB (lists of drinks, recipes, ingredient lists) are kept for between six hours and 30 days so the same question is not asked twice. The questions are built from our own ingredient catalog and TheCocktailDB's own lists.
• Recipe translations. When a TheCocktailDB recipe is translated into another language (see below), the translated name and steps are stored once per drink and language, with no expiry, so the next reader gets them without another translation. They are recipe text only.

These stores are not deleted when you delete your account, because they contain nothing about you.

Recipe generation with Google Gemini

When you ask the app for a recipe from your shelf, the request goes to our server (a Cloud Function). The request contains:

• the names of the bottles you selected, as you wrote them on your shelf, and the catalog ingredients they matched;
• a short list of cocktails from our own recipe catalog that nearly match your shelf;
• the switches you set: whether the drink may use bottles you do not own, and whether it must be alcohol-free;
• your app language;
• our ingredient catalog, so the server can match ingredient names.

Our server first looks for a real cocktail in TheCocktailDB that your shelf can make. If it finds one, you get that recipe and nothing is sent to Gemini.

Only if no real cocktail fits does our server ask Google's Gemini API to invent one. It sends Google a prompt containing the bottle names you selected, the near-matching cocktail names from our catalog, your switches and your language. It does not send your user id, name, email or any other account information. An invention counts against your monthly allowance; a real cocktail from TheCocktailDB does not.

Translations. If you read a TheCocktailDB recipe in a language TheCocktailDB does not provide, our server may send that recipe's English name and steps to Gemini for translation. Nothing about you is sent.

What Google does with it. We use the paid tier of the Gemini API. Under Google's current Gemini API terms for paid services:

• Google does not use prompts (including images) or responses to improve its products;
• Google processes them under its data processing terms, as our processor;
• Google logs prompts and responses for a limited period, solely to detect and prevent violations of its Prohibited Use Policy and for any required legal or regulatory disclosures. Google's abuse monitoring documentation says this data is kept for 55 days and can be accessed for review by authorised Google employees;
• the data may be stored briefly or cached in any country where Google or its agents have facilities.

Bottle-photo scanning

Bottle-photo scanning is a Pro feature. You choose to take a photo with the camera or pick one from your photo library. The app asks your device's permission for the camera or the library first, and you can refuse. Photos taken for a scan are not saved to your photo library.

The photo (up to 4 MB) is sent over an encrypted connection to our server (the "scanShelfPhoto" Cloud Function), together with our ingredient catalog. The server checks that you are on Pro, sends the photo and the catalog to Google's Gemini API, and returns a list of the bottles it thinks it recognised. You then choose which of them to add. Nothing is added to your shelf without your confirmation.

How long the photo is kept.

• By us: not at all. Our server does not save the photo to our database or to any file storage, and our code does not log it. It exists only in memory while the request is handled.
• By Google: under the paid-tier Gemini API terms described above, Google does not use the photo to improve its products and keeps it only in its abuse-monitoring logs (55 days, according to Google's documentation).

A photo can show more than bottles. Take the picture of your shelf only, and avoid including people, documents or anything else you would not want sent. A photo file can also carry hidden details, such as when it was taken or, if your camera records it, where. We do not read or store those details, but we cannot promise they are removed from the copy sent to Google.

TheCocktailDB

Recipes and pictures of real cocktails come from TheCocktailDB, an independent online cocktail database.

• Through our server. Lists of drinks, recipe details and the search behind recipe generation go through our Cloud Functions, which call TheCocktailDB with our own key. TheCocktailDB sees those requests coming from Google's servers, not from your device, and receives no information about you.
• Directly from your device. Pictures of drinks and ingredients are loaded straight from TheCocktailDB's image server (www.thecocktaildb.com). As with any web request, this reveals your device's IP address, basic information about the app and device (the user agent), and which pictures were requested (which can reflect bottles on your shelf) to TheCocktailDB and its hosting provider. TheCocktailDB's privacy policy says it uses Cloudflare. The app adds no account information to these requests.

TheCocktailDB handles that information under its own privacy policy: https://www.thecocktaildb.com/privacy_policy.php.

Purchases and RevenueCat

Pro is sold through the App Store or Google Play. Apple or Google takes the payment; we never see your card or bank details.

The app uses RevenueCat, a subscription service, to check what you have bought. When you are signed in, the app identifies you to RevenueCat by your Firebase user id. RevenueCat then receives your purchase history for this app from the store, along with details such as your store's country or currency. We do not send RevenueCat your name or email, and we do not turn on its optional collection of device identifiers. When you delete your account, our server asks RevenueCat to delete this record.

When your subscription starts, renews, is cancelled, expires or is refunded, RevenueCat notifies our server. Our server records only the result in your plan document (see the table above). It also writes a log line with the type of event, RevenueCat's event id, your user id and the resulting plan.

RevenueCat stores its data in the United States and acts as our processor.

Usage and crash reporting

The app uses two Google services to understand how it is used and what breaks: Google Analytics for Firebase and Firebase Crashlytics. Neither is given your user id, name, email, the names of your bottles or the text of any recipe.

Analytics records:

• events that Google collects automatically, such as the first time the app is opened, sessions, screen views, app updates and in-app purchases;
• nineteen events of our own, each carrying counts and codes only: adding a bottle, viewing "What can I make", scanning a shelf photo, building or sharing a party menu, starting, finishing or failing a recipe generation, saving a recipe, marking a recipe as made, rating a recipe, tweaking a recipe, sharing a recipe card, the app asking for a rating, viewing the subscription screen, starting, completing or failing a purchase, and changing the app icon. When the recipe is from our own catalog, the made-it and rating events include its catalog id; for your own recipes they do not. These events never include a recipe's name or text, the names of your bottles, what a shelf scan read, or anything you share.

Google Analytics identifies an installation of the app with a random app-instance id. It also records device details such as the model, operating system, app version and language, and the approximate region, which Google derives itself. Google states that Google Analytics does not log or store IP addresses. On iPhone, the app does not ask for permission to track you and does not collect the advertising identifier (IDFA); Google Analytics does read the vendor identifier (IDFV). On Android, the app switches off Google Analytics' collection of the advertising ID and removes the permission to read it. The app shows no ads.

Crashlytics records a report when the app crashes or when our error screen catches a problem: the error and where in the app's code it happened (including the names of the app's screens and components involved), the device model, operating system, free memory and disk space, whether the device is jailbroken or rooted, and a random installation id.

Turning it off. Go to Profile → Data & privacy → "Share usage and crash data". The switch is on by default. Turning it off stops both Analytics and Crashlytics from collecting anything further on that device. Your choice is stored on the device, so it resets to on if you reinstall the app. Turning it off does not delete what has already been sent. The two services start when the app launches, so on a new installation some first-launch events may be sent before you have a chance to change the setting.

Stored on your device

The app keeps a few things on your phone, in an encrypted store whose key is held in your device's secure keychain:

• your sign-in token and user id;
• your language, if you chose one in the app;
• light or dark theme;
• whether you have finished or skipped the starter-shelf setup, and when;
• your answer to the age question on first launch, and when you gave it;
• your "Share usage and crash data" choice.

Firebase also keeps a local copy of your shelf and recipes on the device so the app keeps working when you are offline.

These stay on the device until you uninstall the app. Deleting your account does not remove your language, theme, age answer or reporting choice from the device.

Server logs

Our Cloud Functions write operational logs to Google Cloud Logging. A few of them include your user id: a failure to return an AI invention to your allowance, reaching the monthly limit on such returns, each subscription change received from RevenueCat, and a step of an account deletion that did not work (for example, RevenueCat not answering). Cloud Logging keeps these logs for 30 days by default. Google states that Cloud Functions keeps IP addresses only temporarily, to provide the service.

Why we use your data (legal bases)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases:

Who receives your data

We use these providers to run the app. They process data on our behalf, under their data processing terms:

Apple and Google also receive information as the app stores and as sign-in providers, under their own terms and privacy policies. TheCocktailDB receives picture requests from your device, as described above.

We do not sell your personal data, we do not share it for advertising, and we do not use it to make automated decisions that have legal or similarly significant effects on you. We may disclose data if the law requires it.

International transfers

Google and RevenueCat are based in the United States:

• Firebase Authentication runs only from data centres in the United States.
• Our Cloud Functions run in Google's europe-west1 region, in Belgium.
• Our Cloud Firestore database is in the European Union (Google's eur3 multi-region, in Belgium and the Netherlands).
• Gemini API data may be stored briefly or cached in any country where Google or its agents have facilities.
• RevenueCat stores its data in Amazon Web Services data centres in the United States.

If you are outside the United States, your data is therefore transferred there. Google states that it complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks. RevenueCat states that it relies on contractual safeguards with the parties it transfers data to.

How long we keep data

Deleting your account

You can delete your Muddle account and its data in two ways.

In the app. Go to Profile → Account → "Delete account" and confirm. Our server then:

1. notes how many AI inventions and photo scans you have used this month (see below);
2. deletes every bottle on your shelf, every saved recipe, all your recipe activity (made-it history, ratings and favourites) and your plan document;
3. asks RevenueCat to delete your customer record there, which holds your purchase history for this app;
4. then deletes your Firebase Authentication account.

The data goes first and the login last, so if something fails part-way you can still sign in and try again. Trying again is safe. If RevenueCat cannot be reached at that moment, the rest of the deletion still goes ahead and we delete the RevenueCat record afterwards. If you signed in with Apple, the app also revokes the sign-in token Apple issued to the app.

A note we keep until the end of the month. The free plan gives a few AI inventions and one photo scan a month. So that deleting your account and signing up again does not reset them, we keep a short note until the month is over: a one-way hash of your Google or Apple sign-in identifier, and how many AI inventions, returned inventions and photo scans you used that month. The hash cannot be turned back into the identifier, and the note contains no user id, name or email. If you sign in again with the same Google or Apple account in the same month, your new account starts with those numbers instead of a fresh allowance; otherwise it starts new and empty. The note is deleted automatically in the first days of the next month.

Without the app. Email vdzerniuk@gmail.com with the subject "Delete my account" and the email address you signed in with (for Sign in with Apple with a hidden email, the relay address). You do not need to reinstall the app. We may ask you to confirm the request from that address. We will delete the same data, including your RevenueCat customer record, tell you when it is done, and aim to finish within one month.

What deleting your account does not do:

• It does not cancel a subscription. Pro is billed by Apple or Google, and billing continues until you cancel it in your App Store or Google Play account settings. Deleting the app or your account does not cancel it and does not give a refund. Cancel first.
• A still-active subscription can leave a small record behind. If a subscription is still active when you delete your account, later renewal or expiry notices from RevenueCat can re-create a plan document under your former user id. It holds only the plan status, and nobody can sign in to it. We delete such records on request.
• It does not remove data that is not linked to your account. Usage and crash reports are not tied to your user id, so we cannot find them from your account. They expire on the schedule above.
• It does not remove logs and backups straight away. Server logs that contain your user id expire after 30 days. Google removes a deleted Firebase account from its backups within 180 days. Gemini abuse-monitoring logs expire after 55 days.
• It does not affect Apple or Google. Your purchase records at Apple or Google, and your Google or Apple account itself, are kept under their policies. You can also remove the app's access in your Google or Apple account settings.
• It does not clear your device. Your language, theme, age answer and reporting choice stay on the device until you uninstall the app.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct it (you can edit your shelf and recipes in the app);
• delete it (see above);
• restrict how we use it;
• receive it in a machine-readable format and have it sent to another service (portability) — on request we send your shelf, recipes, activity and plan as a JSON file;
• object to our use of it based on legitimate interests, including usage and crash reporting (the in-app switch does this);
• complain to a data protection authority, in particular in the country where you live or work.

To use any of these rights, email vdzerniuk@gmail.com. We may need to confirm that the request comes from you. We will answer within one month.

Age and children

The app is for adults only: you must be at least 18 and of legal drinking age where you live. It shows and suggests alcoholic drinks, carries an adults-only age rating in the app stores, and asks you to confirm your age the first time you open it. That confirmation is your own statement; we do not verify it and we do not collect your date of birth. The answer is stored only on your device.

The app is not directed at anyone under 18 or under the legal drinking age. If we learn that an account belongs to someone under that age, we will delete it. If you think this has happened, contact vdzerniuk@gmail.com.

Security

Data travels between the app, our server and our providers over encrypted connections. Our database rules keep each user's documents readable only by that user, and only our server can change your plan. Our provider keys stay on our server and are never included in the app. On your device, the app's own settings are kept in an encrypted store. No system is perfectly secure, and we cannot guarantee that your data will never be accessed without permission.

Changes to this policy

When we change this policy, we update the effective date at the top. If a change materially affects how we use your data, we will tell you in the app before it takes effect.

Contact

Vadym Dzerniuk
Sumy, 40004, Ukraine
Email: vdzerniuk@gmail.com

Sources

Statements above about third-party services were checked against these pages on 2026-09-25:

• Gemini API Additional Terms of Service (paid and unpaid services, logging, data location): https://ai.google.dev/gemini-api/terms
• Gemini API abuse monitoring (55-day retention, human review): https://ai.google.dev/gemini-api/docs/usage-policies
• Privacy and Security in Firebase (Authentication, Crashlytics, Cloud Functions data and retention; Data Privacy Framework): https://firebase.google.com/support/privacy
• Firebase Help, data collection by Google Analytics for Firebase: https://support.google.com/firebase/answer/6318039
• Configure Analytics data collection on Apple platforms (IDFA, IDFV, persistence of the collection setting): https://firebase.google.com/docs/analytics/configure-data-collection?platform=ios
• Configure Analytics data collection on Android (advertising ID): https://firebase.google.com/docs/analytics/android/configure-data-collection
• Google Analytics data retention: https://support.google.com/analytics/answer/7667196
• Google Analytics privacy controls (IP addresses not logged or stored): https://support.google.com/analytics/answer/9019185
• Authenticate using Apple on Apple platforms (display name, private relay email): https://firebase.google.com/docs/auth/ios/apple
• Cloud Logging quotas and limits (30-day default retention): https://docs.cloud.google.com/logging/quotas
• RevenueCat, Apple App Privacy: https://www.revenuecat.com/docs/platform-resources/apple-platform-resources/apple-app-privacy
• RevenueCat, Google Play Data Safety: https://www.revenuecat.com/docs/google-plays-data-safety
• RevenueCat Privacy Policy (United States storage, processor role): https://www.revenuecat.com/privacy
• TheCocktailDB Privacy Policy (Cloudflare): https://www.thecocktaildb.com/privacy_policy.php
• Apple, Offering account deletion in your app (Sign in with Apple token revocation, subscriptions): https://developer.apple.com/support/offering-account-deletion-in-your-app/
• Google Play, account deletion requirements (web deletion request, disclosure of retained data): https://support.google.com/googleplay/android-developer/answer/13327111