Privacy

GRILL ME asks you questions about a decision. What you say while it does is the most private thing about the app, so it is built not to keep it in the first place.

Controller

Oliver Strebel-Mark
Emmericher Weg 76a
47574 Goch, Germany
hello@grillofficer.app

No account

There is no sign-up, no login, no email address. The app never asks you for anything that identifies you.

Your voice does not leave the device

When you speak, what you said is turned into text on your iPhone. The recording is never transmitted and never stored.

What is sent, and not stored

Your topic and your answers are sent to our server as text so the next question, and finally the verdict, can be produced. Our server does not store any of that text. The conversation itself lives on your device and travels with each question.

What the server does keep is a count, never a content. So that the free allowance and a subscription can work at all, it records against your device identifier: which Grills have been started, how many you have used in the current period, and whether a subscription is active, each with the time it was written. Your topic, your answers and the verdict are not part of any of it.

One exception, and it is a failure case. If the model sends back a reply the server cannot read, the server writes a few hundred characters of that reply into its own operational log at Cloudflare, so the fault can be found and fixed. That reply is the Officer's text, which can restate what you said. It is not passed to our analytics provider.

For processing, not for storage by us, that text reaches:

• Anthropic (via the Vercel AI Gateway): produces the questions and the verdict.
• ElevenLabs: produces the spoken voice, if you leave it switched on. Only the sentence the Officer says is sent, never your answer.
• Cloudflare: runs the server both of these pass through.

What stays on your device

When a Grill ends, it is written to your device: the topic, your answers as the Officer recorded them, the claims and their outcome, and the verdict. It is stored only there. It is not sent to us and it is not in your iCloud or device backup. Nobody else can read it unless you send it: the app can turn a verdict into a share card, and what you share that way leaves your device because you chose to send it.

You can erase all of it at any time under Settings → On this device → Delete all Grills. Deleting the app erases it too. Since we never receive it, that is the only place it exists, and the only place it has to be deleted.

What we measure

We count how the app is used: that a Grill started or finished, how long a question took, whether the voice worked. These events are built not to carry free text. A value can be a number, a true/false value, or a short piece of text of at most forty characters, which is deliberately too small to hold a topic, a question or an answer. Your topic, your answers and the Officer's questions are not put in them. That is a rule the app keeps and a size the server enforces, rather than a mathematical impossibility, and we would rather say so than promise you one.

The events carry a device identifier, Apple's identifierForVendor. It is not your name and it holds nothing you have told us. But it is the same identifier throughout: the usage counting, the free allowance, the subscription and the analytics all key on it, so those records belong together and to one device. Apple applies it only to apps from us, and Apple resets it once every app from us has been removed from that device, which means deleting GRILL ME on its own does not always change it. The events are analysed via our server at PostHog, whose data centre for us is in the EU. PostHog Inc. is a US company and also processes this data outside the EU, which the section below covers.

There is no advertising identifier and no tracking across other apps or websites, and therefore no Apple tracking prompt.

When something goes wrong

When the app catches an error, it reports it so the fault can be fixed: the kind of error, the message the app wrote about itself, which screen it happened on, Apple's own error domain and number, and up to forty lines of the app's internal call stack. This goes to PostHog, under the same device identifier as the usage events.

That message is written by the app about itself and never by you. It holds things like a status code or a decoding failure, and it is limited to three hundred characters. It is not a place your topic or your answers are put.

This website

The website counts page views too: which page, in which language, and which site you came from. It is analysed by PostHog in the EU, through our own address z.grillofficer.app, so the request does not go to a third party.

Nothing is stored on your device: no cookies, no local storage. That is why no banner asks for your consent here, and why every visit is a first visit, because there is nothing that recognises you. Your IP address is processed to deliver the request and to derive the country.

No clicks are recorded and no sessions are replayed.

Purchases

A subscription runs through Apple. We manage the entitlement with RevenueCat, using the same device identifier. We never see payment details; those stay with Apple.

How long it is kept

On your device: a finished Grill stays until you delete it, and deleting the app deletes it too. Nothing expires on its own, because nothing there is ours to expire.

On our server: the record that a particular Grill was started is deleted after seven days. The counters behind it, how many free Grills this device has used and whether a subscription is active, are kept without a time limit. We would rather say that plainly than invent a period: the free allowance is per device for as long as that device identifier exists, and we never learn that you deleted the app, so there is no event that could trigger a deletion. Two rows, no content, and you can have them erased by writing to the address above.

At our processors:

• PostHog, usage events and error reports: at most seven years, set by our plan. PostHog applies that limit project by project and it does not apply to ours yet, so today nothing is removed automatically. Our agreement has the data deleted or returned when it ends.
• Cloudflare, the operational log that can hold a few hundred characters of an unreadable reply: at most seven days.
• RevenueCat, the subscription state: destroyed or returned within thirty days of our agreement ending.
• ElevenLabs, which only ever receives the sentence the Officer says: removed after one hundred and eighty days without use.
• Vercel, which carries the request to the model: deleted when our agreement ends.

Where it goes outside the EU

Your topic and your answers are processed outside the EU, and so are the usage events. Every company below is in the United States, and each transfer rests on a contract we have signed with them.

• Vercel Inc. carries the request to the model, and Anthropic produces the questions and the verdict as Vercel's subprocessor. We have no separate contract with Anthropic; the app never reaches it directly. Standard Contractual Clauses of the European Commission, Implementing Decision (EU) 2021/914, module two, under Irish law.
• ElevenLabs Inc. produces the spoken voice. Standard Contractual Clauses and the EU-US Data Privacy Framework, under Irish law.
• PostHog Inc. analyses the usage events. Its data centre for us is in the EU, but it processes outside the EU as well. Data Privacy Framework and, in addition, Standard Contractual Clauses, module two, under Irish law.
• RevenueCat Inc. manages the subscription. Standard Contractual Clauses, module two, with the UK addendum, under Irish law.
• Cloudflare Inc. runs the server everything passes through. Standard Contractual Clauses, module two, and the Data Privacy Framework.

Each of these companies publishes the list of its own subprocessors, and each contract obliges it to pass these duties down to them.

Legal bases

Sending your input is the service itself (Art. 6(1)(b) GDPR). The anonymous usage measurement rests on our legitimate interest in an app that works (Art. 6(1)(f)).

Your rights

You may request access, rectification, erasure, restriction, portability, and object: write to the address above. Since we store no content, this concerns the usage events in practice; please tell us the rough period so we can find them. Your Grills are not covered by any of this, because they never reach us: they are on your device, and you erase them there. You may also complain to a data protection supervisory authority.

The fastest route needs nothing from us: deleting the app removes the device identifier. After that nothing can be attributed to you.