Privacy

Grub keeps what your household tells it so it can pick dinner for you. That's all it's for. No ads, no tracking in the app, and we never sell or share your information for marketing.

This policy covers the Grub app for iPhone and Grub on the web at grub.ing. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth), and for families in New Zealand, the Information Privacy Principles in the Privacy Act 2020.

What Grub keeps

Your account

• Email sign-in: your email address. We send it a six-digit code each time you sign in, so there's no password.
• Sign in with Apple: the private identifier Apple gives Grub, the email Apple shares (which can be an Apple relay address if you choose Hide My Email) and, the first time only, the name you let Apple share. We also keep a token Apple gives us, only so we can tell Apple to disconnect Grub when you delete your account.
• Your sign-in on each device: a random token your phone keeps. We store only a scrambled (hashed) copy of it, and of each sign-in code.
• The people in your house can see the name and email of each account in it.

A few households open Grub with a shared household word instead of accounts. For those we keep only a scrambled copy of the word.

Your household

This is what you and the others in your house put into Grub:

• The house's name, and the first names (or nicknames) of the people at the table, with a colour for each.
• What each person likes, would rather not have, never eats, and is sick of for now.
• Your plans for the week, the dinners you've had, everyone's ratings of them, and who cooked.
• Cooking turns: who's in, the nights they cook or are home in time, and whether they want a reminder.
• The shopping list, what's in the pantry, where you shop, your dinner time, how many you cook for and what you cook on.
• Your suburb, if you give one. You pick it from a list in setup or in You, then Where you shop, and Grub puts your own state's or region's supermarkets first. We keep the suburb and its state with a point rounded to about 10 km, never a street or address. We also count houses by area on a page only we can see, and only name a suburb there once three houses share it. Take it off any time in Where you shop.
• Meals you add yourselves, including a recipe link if you gave one, and the diet ticks you set on them.
• Photos you take of your dinners, and the plate pictures Grub makes for meals you add.
• Each person's look in the app (tile colours and appearance).
• Invite codes you make to bring someone into the house. They run out after 14 days.

When you use the iPhone app

• If you turn notifications on, your phone's push token (a code from Apple that lets us send it a notification) and which person in the house uses that phone. Signing out or leaving the house removes it.
• The Tonight widget is fed from a small copy of tonight's dinner kept on your phone. It doesn't leave your phone.

When you visit grub.ing

We count visits to this website without cookies, so we can see which pages are useful. Each day we count which page was opened, where visitors came from (a search engine, a social site or another website, by its name only), whether it was on a phone or a computer, and taps on the App Store button. We don't keep your IP address or anything that tells one visitor from another. Using Grub itself, in the app or at grub.ing/app, isn't counted this way.

We use Google Analytics to understand visits to this website (not the app). On these pages it sets its own cookies and receives the page you opened, where you came from, your kind of device and roughly where you are, so we can see how people find Grub. It never runs in the app, at grub.ing/app, or in a browser that's signed in to Grub. Google Analytics is run from the United States.

To keep Grub working

• Error reports. When something goes wrong, the app sends us the error, the screen you were on and the app's version, along with your account and house numbers so we can find the problem. The server keeps its own errors the same way.
• Report a problem. If you send one from the app, we keep your message, the app version, the screen and the app's recent errors. If you tick "attach my household's details", a copy of your household's data goes with it. We get an email telling us a report came in, with your message and your name or email.
• Limits. To stop abuse, we count sign-in attempts and some requests by email address and by IP address. These counters are thrown away within a day.
• AI use. We count how often each house uses Ask Grub, add a meal and make one up, and what it cost, so we can keep it free and fair.

What Grub doesn't do

• No advertising, no ad networks and no tracking across other apps or websites.
• No analytics services in the app. The app's fonts and pictures come from grub.ing itself.
• We never use your phone's location, or work out where you are from your connection. We don't ask for your contacts, microphone or health information. The camera and photos are only used when you choose to take or pick a photo.
• We don't sell your information, or share it with anyone for their own marketing.

Kids at the table

Grub is for the whole house, so most households have kids in them. Kids don't need an account: a grown-up adds them by first name or a nickname, and says what they eat. That's kept with the rest of your household, seen only by the people in your house, and used only to pick dinners everyone can eat.

We never use it for advertising or profiling, and when Grub's AI makes up a meal for your table, it gets what people never eat or would rather not have, never anyone's name. A notification like "You and Theo are cooking tomorrow" does carry first names, so it can show on the phone's lock screen.

Diet labels are a guide

Grub marks meals vegetarian, gluten free or dairy free from their ingredients, and "Never" keeps a food off someone's plate as best Grub can. It's a guide, not a guarantee: recipes and brands vary and Grub can't see what you buy or your kitchen, so check the packet if someone has an allergy. Grub doesn't collect health or medical information, and the "Never" list isn't a medical record.

Who helps us run Grub

We use a small number of companies to run Grub. They handle your information only to do that job for us.

When you add a meal from a link, Grub's server opens that web page to read the recipe, so the site you linked to sees a visit from Grub (not from you).

Our AI and image providers don't train their models on what Grub sends them. They keep requests for up to 30 days to check for misuse, then delete them.

We'd only ever share your information beyond this if the law required it.

Where it's kept

Grub's database, photos and backups are stored in the Oceania region. Our hosting provider's network spans many countries, so your information may also be handled outside Australia and New Zealand on its way. Our AI and image providers and our email provider are in the United States, so what goes to them for the jobs above leaves Australia. We only use companies we trust to protect it, and we send each one only what its job needs.

Everything travels encrypted (HTTPS). Sign-in tokens and codes are stored hashed. Photos sit behind long random addresses only your house's app knows.

How long we keep it

• Your household: for as long as the house is on Grub. Whatever you change or delete in the app is changed or deleted straight away.
• Backups: a copy of the database is made every night and kept for 30 days, and the database can be rolled back over the last 30 days. Anything you delete is gone from those within 30 days.
• Error reports: 30 days.
• Problem reports: until you delete your account or your house, or ask us to remove them. The email we got about a report stays in our support inbox until we delete it, and Grub's own note of each alert it sent us (with a report's first line) is deleted after 90 days.
• Sign-in codes work for 15 minutes and are removed within a day. Sign-ins on a device last a year from when you last used Grub on it.
• Request logs: our hosting provider keeps a log of requests to Grub, which we use to find and fix problems, for up to 7 days.

Deleting your account or your house

You can do both in the app, any time, with no need to ask us:

• You, then Delete my account. This deletes your account, signs you out everywhere, stops notifications to your phones, removes your problem reports and error reports, and disconnects Sign in with Apple. If anyone else is in your house, the house stays with them. If you were the last one in it, the house and its photos are deleted too.
• You, then Delete (your house's name), for a house's owner. This deletes the whole house for everyone in it: the people, what they eat, the plans, the history, the list and the photos.

Either way it's gone at once, and out of the backups within 30 days. If you can't get into the app, email support@grub.ing from the address you sign in with and we'll do it for you.

Seeing and fixing your information

Most of it you can see and change in the app yourself. If you'd like a copy of everything Grub holds about you or your house, or something corrected, email support@grub.ing. We may need to check it's really you first, and we'll answer within 30 days.

Questions and complaints

Email support@grub.ing and we'll look into it and get back to you. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or in New Zealand, the Privacy Commissioner at privacy.org.nz.

Changes

If we change how Grub handles your information, we'll update this page, and for anything big we'll tell you in the app first.

Last updated: 31 October 2026

The list of suburbs and postcodes comes from the Australian Bureau of Statistics (Australian Statistical Geography Standard, Edition 3) and Toitū Te Whenua Land Information New Zealand (NZ Suburbs and Localities), both under CC BY 4.0. Grub keeps each suburb as a point rounded to about 10 km.