Privacy Policy

Effective Date: July 3, 2026 | Developed by MonaruTech

Important Store Compliance Notice: This privacy policy explicitly governs the **GutOk** mobile application and its website, developed by MonaruTech. It complies with the Google Play Developer Distribution Agreement and Apple App Store Review Guidelines.

1. Introduction

Welcome to GutOk. GutOk ("we," "us," or "our") is developed and operated by MonaruTech. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and our website (hosted at gutok.monarutech.com).

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access or use the application.

2. Information We Collect

We collect personal information that you voluntarily provide to us when you register on the application, complete your onboarding profile, use the food scanner, generate recipes, or contact us.

A. Account and Registration Data

  • Identity Data: Full name and email address.
  • Authentication Credentials: Google or Microsoft OAuth identifiers and Firebase Authentication tokens.
  • Referral Program Data: Unique referral codes (prefixed with "GK-") generated for your account, record of who referred you (referral claim data entered during onboarding), and count of your successful referrals for reward calculation and anti-abuse verification.

B. Health, Diet, and Nutritional Preferences

  • Dietary Profiles: User-inputted preferences (e.g., organic preferences, food allergens, custom keywords, dietary restrictions).
  • Macro Logs: Daily macro counts (calories, proteins, fats, carbs) and meal logging transactions.
  • Trainer Links: If you use the B2B Trainer Pro features, we link your client profile to your designated fitness trainer.

C. Device Permissions and Media Uploads

  • Camera & Storage Access: In order to use our core Ingredient Scanner, GutOk requests explicit permission to access your device's camera and media storage. This access is strictly limited to capturing or uploading photographs of food ingredient labels for optical character recognition (OCR) parsing.
  • Image Retention: Uploaded label photographs are transmitted securely to our backend server for analysis and may be cached temporarily in Firebase Cloud Storage to generate your scan history log. Images are not shared with third parties except as required for AI processing.

D. Usage and Scan Logs

  • Scan History: Detailed lists of ingredients read from packaging, dates, and corresponding AI cleanliness scores (0-5 stars).
  • Content Inputs: Pantry lists, custom search queries, and custom recipes requested.

E. Analytics and Tracking Data

  • Google Analytics 4 (GA4): We utilize GA4 to track site visits, store badge clicks, and deletion form submissions. GA4 uses cookies and client identifiers to analyze user engagement dynamically.

F. Advertising and Device Identifiers

  • Google AdMob SDK: We integrate Google AdMob to serve ads. AdMob collects device identifiers (such as Google Advertising ID or iOS IDFA), IP addresses, cookie data, and device capabilities to handle ad rendering, enforce frequency caps, prevent spam/abuse, and facilitate fraud detection.

3. How We Process and Protect Your Data

Your privacy and data security are our highest priorities. We protect your data using the following safeguards:

  • Encryption: All data is encrypted in transit using SSL/TLS (HTTPS) and at rest using standard Google Cloud Firestore and Cloud Storage encryption models.
  • Access Gating: Endpoint requests to our scanner and recipe servers are protected using JSON Web Tokens (JWT) verified via Firebase Admin SDK. Only authenticated owners can access their data.
  • Financial Privacy: All payment transactions (for paid credit reload packages) are processed through Razorpay. We do not store or process credit card details on our servers.

4. Google Gemini AI Disclosures & AI Governance Standards

AI Transparency, Safety & Google AI Studio Standards:GutOk utilizes multimodal large language models (specifically Google Gemini Flash models via Google AI Studio Tier 1 Paid Services) to process food label photos, parse ingredient text, calculate Gut-Clean Scores (0–10.0), flag watchlist additives (seed oils, color dyes, preservatives), and generate custom recipes.

A. No Model Training Guarantee (Google AI Studio Tier 1): Under Google AI Studio Paid Tier Terms, all photos, OCR texts, and prompt inputs transmitted to Google Gemini API endpoints are processed securely for your request. Your user data, label photos, and search queries are NOT used to train, retrain, or improve Google AI foundation models.

B. API Request Storage & Non-Retention Defaults: GutOk configures `GenerateContent` API request storage to toggled OFF in our Google AI Studio project settings, ensuring standard label scans and photos are processed transiently in memory without being stored in API request logs. Where stateful feature requests (Interactions API) are enabled, logs are managed under a strict rolling deletion schedule or storage cap, with per-request opt-out safeguards (`store: false`).

C. PII Scrubbing Safeguards: Personal Identifiable Information (such as full names, email addresses, device tokens, or precise GPS coordinates) is automatically scrubbed by our API proxy layer before prompt payloads are submitted to Gemini AI models.

D. Derivative Output Disclaimer: All cleanliness ratings, additive flags, non-food detections (`noFoodDetected`), and recipe instructions are derivative recommendations and AI suggestions. They do NOT constitute medical facts, professional nutritional certifications, or medical advice. AI models may occasionally hallucinate or misread small packaging text (OCR errors). Users must independently verify packaging labels and consult qualified physicians or dietitians before making medical dietary decisions.

5. Global Regulatory Compliance

A. General Data Protection Regulation (GDPR) - Europe

If you are in the European Economic Area (EEA), you have rights under GDPR, including the right to access, correct, or erase your data, and the right to restrict processing. You can manage these rights directly in the app or via our Data Deletion Portal.

B. California Consumer Privacy Act (CCPA) - United States

We do not sell your personal data. California residents have the right to know what personal details we collect, request deletion, and opt-out of data tracking.

C. Digital Personal Data Protection Act (DPDPA) - India

We process personal data based on your explicit consent, which you grant during onboarding and scanner activation. You can withdraw consent at any time, leading to the deletion of your account and personal preferences.

D. Children's Online Privacy Protection Act (COPPA)

GutOk is not intended for children under 13. We do not knowingly collect personal details from children. If we discover a child under 13 has provided data, we purge it immediately.

6. Third-Party Sharing

We only share data with service providers necessary to operate the application:

  • Google AI Studio / Gemini API (Tier 1 Paid Plan): Image pixels or OCR-extracted text (scrubbed of PII) are transmitted securely to Google AI Studio API endpoints under paid non-training terms and rolling API request storage settings.
  • Firebase (Google Cloud): For authentication, firestore hosting, and database logic.
  • Razorpay: For credit package purchase transactions.
  • Google Analytics: For site visit engagement analysis.
  • Google AdMob: For advertisement delivery and frequency tracking.
    Non-Personalized Ad Enforcement: We explicitly configure all ad requests to request non-personalized ads only (`requestNonPersonalizedAdsOnly: true`). This prevents Google from utilizing behavioral or history-based tracking profiles to target ads to you inside the application.

7. Data Deletion and Account Removal

You have the right to request deletion of your account and all associated personal information. You can do so by submitting a request through our dedicated Web Form at gutok.monarutech.com/delete-data. Once requested, all your authentication tokens, scan history, custom diet profiles, daily meal logs, and payment link logs will be permanently deleted from our active Firestore database within 30 days.

8. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: