Privacy Policy — Застілля (Zastillia)

App: «Застілля» (Zastillia) for iOS and Android Last updated / Effective: 2026-11-10

1. Who we are

«Застілля» ("Zastillia", "we", "us", the "App") is operated by San Byn Nhuien, a sole proprietor (ФОП) registered in Ukraine (the "operator" / data controller under Ukraine's Law "On Personal Data Protection" and, where applicable, the EU/UK GDPR).

Contact: support@zastillia.app.

This Policy explains what personal data the App processes, why, with whom it is shared, how long it is kept, and your rights. It applies to the iOS app and its extensions, to the Android app, and to our backend services. Where the two platforms differ — health data, payments, attestation and on-device storage do — the difference is stated rather than averaged away. It does not cover third-party services you choose to connect to (e.g. a grocery store's website you log into through the App) — those are governed by their own policies.

2. At a glance — what data is processed

We do not: ask for your name, email, or any other personal identifier to use the App; use your data for cross-app/cross-site tracking (no IDFA, no App Tracking Transparency prompt, no ad personalization); sell or rent personal data; share data with data brokers or advertising networks; use health data for advertising, marketing, or any purpose other than computing your in-app calorie/macro targets.

3. How you access the App — anonymous access

The App uses anonymous access. We do not require your name, email, or any personal identifier, and there is no "sign-in with [provider]" step. A name in your profile is optional; it reaches our backend only as part of a device's name, if you use «Мої пристрої» (§5A). When you first open the App an anonymous install identifier is created automatically on our backend and used to associate your imports and usage with your install. This identifier is not linked to your real-world identity. Legal basis: performance of our agreement with you (the Terms of Use).

4. Recipe content you import

You can build recipes by typing/pasting text, from a photo (the photo is sent to our backend — see below), from a video file (we extract text/audio on your device), or from a link to a video or post.

• For pasted text and video files: only the extracted text leaves your device. The video itself does not leave your device.
• Photos: when you import a recipe from photos, the photos you choose are sent to our backend and read by an AI provider listed in §12 to produce the recipe. We do not store them.
• For a video link, our backend downloads the linked video and processes it — i.e. for this path the video content is processed on our infrastructure.

In all cases the content is sent to our backend, which uses one or more of the AI providers listed in §12 to produce a structured recipe (title, ingredients, steps, per-serving calories/protein/fat/carbs). The result is cached on our backend and associated with your install.

Features that do not use AI — entering a recipe by hand, the plain grocery list, cooking mode, meal planning from recipes you already have — send nothing to any of these providers.

Legal basis: performance of our agreement / your request, for turning your input into a recipe.

We do not operate a public recipe feed. Recipes you create or import are visible only to you (and synced to your own iCloud) unless you choose to share one — see §5.

5. Recipes you choose to share publicly

The App can turn one of your recipes into a public web page at https://zastillia.app/r/<id>. This never happens automatically. You tap "Share", and the first time you ever share a recipe the App asks you to confirm explicitly that the page will be public. That confirmation is asked once, not once per recipe: afterwards "Share" publishes directly, and every link stays revocable at any time from the recipe's menu.

• What is published: the recipe's title, description, category, servings, times, ingredient list, cooking steps, per-serving calories/protein/fat/carbs, the source link if the recipe was imported from one, and the cover photo if it has one.
• What is not published: anything that identifies you. No name, no email, no account identifier, no device information. The page carries no author.
• Who can see it: anyone with the link. The page asks search engines not to index it, so it should not appear in search results — but that is a request we make, not a lock: the URL is public and needs no password, so treat a shared recipe as public information.
• Automatic screening: before a page is created, the recipe's text and cover photo are checked automatically by an AI provider, for unsafe content and for whether the submission is genuinely a recipe. If either check fails, no page is created and nothing is published. See §12 for the providers involved.
• Revoking: you can withdraw a shared recipe at any time from the recipe's menu in the App ("Revoke link"). The page then returns "gone", and the published cover photo is deleted from our systems. Copies already saved, screenshotted, or cached by search engines and messaging apps are outside our control.
• If you delete your account, every recipe you have shared is deleted along with it, and the pages stop working.
• Legal basis: your consent, which you give at the confirmation prompt and can withdraw by revoking the link.

Sharing a recipe does not change who owns it. You remain responsible for having the right to publish what you share — see the Terms of Use.

5A. «Мої пристрої» (My devices)

«Мої пристрої» ("My devices") is an optional feature for Premium users: one recipe book on several phones and tablets, an iPhone and an Android phone included. The devices you link form one group. The feature is off until you turn it on in the Profile screen.

• What is stored: when a Premium user turns it on, their recipe book, collections, the photos in them, weekly meal plan and queue of recipes to cook are stored on our servers (Google Firebase, EU) so that their linked devices can read them. This is in addition to the copies on your devices and, on iOS, in your iCloud (§11).
• Access: Only the devices you have linked can read it. A device is linked with a short one-time code, and only after you confirm its request on a device that is already linked. The data is not published anywhere.
• What else we keep about the group: each linked device's name (its model or the name from its settings and, if you entered one in your profile, your name), its platform (iOS or Android), when it was linked, and whether the group has Premium.
• Shopping lists: a linked device becomes a member of your own shopping list and of the shared lists and shared collections you are in.
• Stopping: you can unlink a device at any time (Profile → My devices). When you unlink every device, or delete your account, all of this is deleted from our servers.
• After Premium ends: if no device in the group has Premium any more, the stored data is kept for 12 months, so that it is still there if you subscribe again, and then deleted.
• Legal basis: your request: you turn the feature on and link each device yourself.

6. Health and fitness data (Apple Health / Health Connect)

If you connect Apple Health on iOS, or Health Connect on Android, the App reads your weight and height — and, from Apple Health only, your date of birth and biological sex — to calculate your daily calorie and macronutrient (КБЖВ) targets. This data is used only on your device to perform that calculation — it is not transmitted to our servers, not stored by us, and not shared with anyone. You can disconnect it at any time in the App’s Profile screen, in iOS Settings → Privacy & Security → Health, or in Android’s Health Connect settings. The Android app requests only what it uses — reading weight and height — and asks for no write, activity or history permission. We comply with Apple’s HealthKit requirements and with Google’s Health Connect policy: we do not use Health data for advertising, marketing, data mining, or any use other than your in-app health targets, and we do not sell it.

КБЖВ / nutrition values shown in the App are AI-generated estimates and are not medical or nutritional advice. See §5 of the Terms of Use.

7. Location and delivery address

To help you order groceries, the App can use your location ("while using the app") to find stores that deliver to your area, and you may enter a delivery address (with address autocomplete powered by Apple's mapping service). Your location and address are sent to Apple for autocomplete/geocoding and, only when you place an order, to the grocery store you select. They are not sent to our backend and are not stored by us. The App keeps a short list of your recently used addresses on your device only. You can decline or revoke the location permission in iOS or Android Settings (the grocery-ordering feature will then ask you to enter an address manually). Legal basis: your consent (location permission) and performance of your ordering request.

8. Grocery ordering and store sessions

The grocery-ordering feature (currently available to users in Ukraine) lets you add the items on your shopping list to your cart at Сільпо and stores on Zakaz.ua. To do this the App opens an in-app browser where you browse / log in to the store; it then reuses your own session with that store to add items to your cart. The relevant session data stays on your device.

Zastillia is an independent tool and is not affiliated with, endorsed by, or partnered with Сільпо, Zakaz.ua, or any retail chain. We do not receive your store login credentials, we do not process your payment, and we do not place or fulfil the order — you complete checkout and payment directly with the store on the store's site. Product prices and availability shown come from the stores' systems. The store's own terms and privacy policy apply to your relationship with it.

9. Purchases and subscriptions

Premium subscriptions are sold and billed by Apple via the App Store on iOS, and by Google via Google Play on Android. The store processes your payment; we do not receive your payment-card data. We use RevenueCat, Inc. to manage subscription status across both stores; it receives your purchase and entitlement records, not your payment details. We receive your subscription status (e.g. plan and renewal date) so the App can unlock Premium features, and we keep a record of your AI usage on our backend, associated with your install, to apply your AI limit (see §9A of the Terms of Use). See the Terms of Use for subscription details. Legal basis: performance of our agreement.

10. Analytics, diagnostics and integrity

• Firebase Analytics — feature-usage and screen-view events, plus basic app settings and status (e.g. install identifier, country, app language, subscription status). Some event parameters include the names of recipes and of ingredients/search terms you interact with. We deliberately do not log delivery addresses, geographic coordinates, grocery-store account details, or anything that identifies you personally. Firebase Analytics here runs without any advertising identifier and without ad personalization: on iOS there is no IDFA and therefore no App Tracking Transparency prompt, and on Android the Advertising ID permission is stripped from the shipped app so the identifier cannot be read. It does not track you across other companies’ apps or sites.
• Crashlytics / Firebase Performance — crash logs and performance/diagnostic data to find and fix bugs.
• App Check (Apple App Attest on iOS, Play Integrity on Android) — an attestation token so our backend can verify requests come from a genuine, untampered copy of the App.
• Remote Config — app configuration; does not collect personal data from you.

Legal basis: our legitimate interest in maintaining, securing and improving the App (and your consent where required by local law for analytics identifiers).

11. Data stored on your device and in your iCloud

The App stores on your device: settings, cached recipe images, your manual recipes, your weekly plan, your shopping list, recent delivery addresses, and the grocery-store session described in §8. On iOS, your recipe book is also synced to your own iCloud private database — that is your personal iCloud storage, governed by Apple’s iCloud terms and privacy policy; we cannot read it. On Android there is no such sync: the recipe book lives only on the device. Android’s own Auto Backup is enabled instead, so the app’s database and settings are copied to your personal Google account backup — again your storage, governed by Google’s terms, and encrypted with your device credential; we cannot read it either. Deleting the App removes the on-device data; iCloud data is managed in iOS Settings and Android backups in Google One. If you turn on «Мої пристрої» (§5A), your recipe book is also stored on our servers, on both platforms.

12. Third parties / sub-processors

We use the following service providers, who process data on our behalf or receive data because you chose to use a feature:

13. International transfers

Our backend providers (Google/Firebase, OpenAI, Anthropic, TypeSafe AI, Apple, RevenueCat) are based in or operate from the United States and other countries. When you use the App, personal data may therefore be transferred outside Ukraine/the EEA. Where required, such transfers rely on appropriate safeguards (e.g. the providers' Data Processing Agreements and Standard Contractual Clauses).

14. How long we keep data

• Anonymous install identifier and associated cached data: until you delete the App or request erasure.
• Publicly shared recipes: until you revoke the link or delete your account, whichever comes first.
• «Мої пристрої» (§5A): until you unlink every device or delete your account; 12 months after Premium ends on every linked device.
• Firebase Analytics: up to 14 months (default).
• Crash data: per Firebase's retention (typically up to 90 days).
• On-device data: until you delete it or remove the App.
• AI-provider handling: per each provider's own policy (see §12).

15. Your rights

Depending on where you live, you have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to certain processing; data portability; and to withdraw consent (e.g. location, Health) at any time. You also have the right to lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (Ombudsman) or your local supervisory authority.

Because the App uses anonymous access, your data on our backend is identified only by the install identifier created automatically on your device. To exercise your rights, contact support@zastillia.app from the email address you'd like us to reply to and describe which data you want to access or erase; we may ask you to confirm details that match a request that originated from your install (e.g. recent activity) so we can be sure we're acting on the right account.

In-app controls today: you can disconnect Apple Health or Health Connect and revoke the location permission in your device’s Settings; you can delete individual recipes; you can revoke any recipe you have shared publicly (§5); and the App's Profile screen offers a delete-account action that removes your install's link to our backend. Removing the App also clears the on-device data described in §11.

16. Children

The App is not directed to children. You must be at least 16 years old (or the minimum age set by the Terms of Use / required by your local law) to use the App. We do not knowingly collect personal data from children below that age; if you believe a child has provided us data, contact support@zastillia.app and we will delete it.

17. Security

We encrypt data in transit (TLS), restrict access to our backend, and keep service credentials out of the App. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

18. Changes

We may update this Policy. Material changes will be notified in the App and/or at https://zastillia.app/privacy. The "Last updated" date shows the current version.

19. Contact

Questions or requests: support@zastillia.app — San Byn Nhuien, sole proprietor (ФОП), Ukraine.