Privacy policy

Last updated October 27, 2026

Who we are

Gluten (the app and gluten.ai) is run by Winding.ai Inc, 1887 Whitney Mesa Drive #5338, Henderson, NV 89014, USA. Contact: support@winding.ai.

What we collect

Account: your email, name and the sign-in method you use (Apple, Google or an email code).
Your household: the people you add and what you tell us about them: first names or nicknames, birth year, conditions (for example celiac disease or Hashimoto’s), allergies, diets, life stage (for example pregnancy) and foods to avoid. This is health information. You choose what to enter, and we use it only to plan and check your recipes.
What you do in Gluten: plans, favourites, ratings, foods you check, cooking sessions and settings.
Purchases: your subscription status from Apple or Google, and for gifts bought on the web, the buyer’s email, the recipient’s name and optional email, the note and delivery date. Card details go to Stripe, Apple or Google, never to us.
Device and usage data: app version, device type, approximate location from your IP address, crash reports and how you use features.

How we use it

To plan meals and check recipes against everyone in your household, and to show swaps.
To run your account, subscription and gifts, and to send emails you asked for (sign-in codes, receipts, gift delivery).
To send push notifications you turned on, such as new recipes or cooking timers.
To find and fix bugs, keep Gluten secure, and understand which features help (in aggregate).

What we don’t do

We don’t sell or rent your personal information, and we don’t share it for cross-context behavioural advertising.
We don’t use your household’s health information for advertising, ever.
We don’t let AI providers train models on your data: every request we send them says so, and we send only what a request needs.

Who processes data for us

These companies process data on our behalf, under contracts that limit them to providing their service:

Cloudflare: Hosting, database, file storage and network security. Their policy.
Apple and Google: App distribution, Sign in with Apple / Google, in-app subscriptions and push notifications. Their policy.
Stripe: Payments on the web (gifts), fraud prevention and receipts. Their policy.
OpenRouter and the AI model providers it routes to: Writing and checking recipes. They receive the restrictions and ingredients needed for a request, never your name or email, and may not train on it. Their policy.
Resend: Sending email (sign-in codes, receipts, gift delivery). Their policy.
PostHog: Product analytics, sent through our own domain. Their policy.
Sentry: Crash and error reports. Their policy.
Expo: App updates and push notification delivery. Their policy.

We may also disclose information if the law requires it, or to a buyer if the company is sold (with this policy still applying).

Cookies and similar technology

The website uses a sign-in cookie when you use Gluten on the web, and first-party analytics to count visits. We don’t use advertising cookies on pages that show your household. On marketing pages we may measure ad campaigns (for example with Google Analytics or the Meta pixel); your browser’s Global Privacy Control signal turns that off.

How long we keep it

We keep your account and household while your account exists. Deleting your account deletes your household, profiles, plans and favourites within 30 days, including from backups. We keep purchase records as long as tax law requires (usually 7 years). Logs and crash reports are kept for up to 90 days.

Deleting your account

In the app: the Profile tab → Delete account (at the bottom, under Sign out). Or email support@winding.ai from your account email. Cancel any App Store or Google Play subscription separately in your store settings.

Your rights

Wherever you live, you can ask for a copy of your data, to correct it, to delete it, or to object to how we use it; email support@winding.ai. If you are in the EU, UK or California you have these rights by law, and you can complain to your data protection authority. We answer within 30 days. Our legal bases (EU/UK) are: the contract with you (running Gluten), your explicit consent (the health information you enter, which you can withdraw by deleting it), and our legitimate interests (security and improving Gluten).

Children

Gluten accounts are for adults (18+). Parents can add their children to their household, with a first name or nickname, birth year and food needs, so meals fit them; children don’t use Gluten themselves and we don’t knowingly collect information from children directly.

Security and where data is stored

Data is encrypted in transit and at rest, and stored with Cloudflare in the United States and other countries where our processors operate. Access is limited to the people who need it to run Gluten.

Changes

If we change this policy in a way that matters, we’ll tell you in the app or by email before it applies.