Privacy Policy
Shaketail is a mobile app that shows which cocktails you can make from a photo of your home bar. This policy explains what personal data the app processes, why, and your rights, including under Turkey's Personal Data Protection Law No. 6698 (KVKK), the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws.
1. Who is responsible
The data controller is Teoman Karataş (individual developer). Contact: shaketailapp@gmail.com
2. What we process
Account
- As a guest, only a random user ID is created; no name or email.
- With email, your email address and password. The password is stored hashed by Google (Firebase Authentication); we can't see it.
- With Google, the name, email address and account ID of your Google account.
- With Apple (iPhone), the account ID and email address Apple provides, or Apple's relay address if you choose to hide your email. When you delete your account we also revoke Shaketail's access to your Apple sign-in.
What you save in the app
The ingredients in your cabinet (how and when each was added), favorite cocktails, shopping list and "always have" settings.
Scan photos
Photos you take or pick for a scan are sent to OpenAI's AI service (OpenAI API) to read the bottle labels. We don't store them on any server; only the recognized ingredients are added to your cabinet.
OpenAI does not use photos sent through its API to train its models, and we ask OpenAI not to store the requests. Still, please make sure your photos show only bottles, not people's faces, documents or other personal information.
Usage statistics
To improve the app, Google Analytics for Firebase collects usage events (for example which cocktails are viewed and how many scans are made), device model, operating system, app version, language and approximate location (country and city). Google Analytics does not store your IP address. Google Analytics does not collect the advertising ID.
Rewarded ads
After your free animations, you can choose to watch a short ad to unlock a recipe animation. These ads are served by Google AdMob, which processes your device's advertising ID, IP address (for approximate location), device and app information and your interactions with the ad, to show and measure ads and prevent fraud. In the EEA, UK and Switzerland you are asked for consent first. You can reset or delete the advertising ID in your phone's settings (Google → Ads on Android), after which ads are not personalized. On iPhone we don't ask for access to the advertising identifier, so ads there are shown without it. More: How Google uses information from sites or apps that use its services.
Shaketail Pro subscription
Pro is bought through Google Play on Android and the App Store on iPhone; your payment details stay with Google or Apple and we never see them. We use RevenueCat (RevenueCat, Inc.) to manage subscription status: RevenueCat receives your app user ID, the purchase record (product, date, price, trial and renewal status) and device information. You can manage or cancel the subscription in Google Play or the App Store.
Usage allowances
Your monthly scan count and the number of free animations you've used are stored with your account. Animations you unlock with an ad are remembered only on your device.
Crash reports
When the app crashes or hits an error, Firebase Crashlytics receives technical details of the error, the device model, OS version and an ID specific to the app installation.
App security
To prevent abuse, Firebase App Check with Google Play Integrity (Android) or Apple App Attest and DeviceCheck (iPhone) issues tokens confirming that requests come from the genuine Shaketail app on an unmodified device.
Kept only on your phone
Your age confirmation and your language, theme and unit preferences stay on your device.
3. Why, and on what legal basis
To provide the service you asked for (your account, cabinet, favorites, list and scanning): performance of a contract. To fix errors, keep the app secure and understand how it is used: our legitimate interest. To provide and verify the Pro subscription: performance of a contract. To show the rewarded ads you ask for: performance of a contract, and consent where the law requires it. To comply with the law: legal obligation.
4. Who we share it with
We don't sell your data. It is shared with our infrastructure provider Google LLC through the services listed above; when you watch an ad, the data described above is shared with the ad service Google AdMob, scan photos with OpenAI, L.L.C., subscription data with RevenueCat, Inc., and on iPhone what sign-in, purchases and device checks need with Apple Inc. We share with authorities where the law requires.
5. International transfers
Google's, OpenAI's and RevenueCat's servers are located outside Turkey (mainly in the United States), so your data is transferred abroad in order to provide the service. For transfers out of the EEA, UK and Switzerland these providers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
6. Retention
- Account and app data: until you delete your account, then deleted immediately.
- Usage statistics: user- and device-level data is kept for 2 months in Google Analytics; aggregated reports that can't be linked to anyone (such as daily user counts) may be kept longer.
- Crash reports: 90 days in Firebase Crashlytics.
- Scan photos: not stored by us; OpenAI may keep API requests for up to 30 days to monitor abuse, then deletes them.
Guest data isn't linked to an identity, so we recommend deleting your account from the Profile screen before uninstalling.
7. Security
All connections are encrypted (TLS), and database rules let each user access only their own data.
8. Age limit
Shaketail contains alcoholic drink recipes and is only for people who are of legal drinking age where they live, and never under 18 (21 in the United States). We don't knowingly process data of anyone below that age and delete it if we find out.
9. Your rights
You can ask whether your data is processed, get information about it, learn the purpose and who it is shared with, have it corrected or deleted, have those changes passed on, object to a result produced solely by automated processing, and claim compensation for unlawful processing. In the EEA, UK and Switzerland you can also ask for a copy of your data in a portable format, restrict or object to processing based on legitimate interest, withdraw ad consent at any time (Profile → Privacy choices, or your device's ad settings), and complain to your local data protection authority. US residents have the rights their state law gives them, such as to know, correct and delete their data; we don't sell or share personal data for cross-context behavioral advertising beyond the ads described above, and we don't discriminate against anyone for using these rights. Write to shaketailapp@gmail.com from the email address linked to your account; we reply within 30 days, free of charge.
10. Deleting your account and data
Delete your account in the app at any time: Profile → Delete my account and data. More details, including what to do if you can't open the app: Account deletion.
11. Changes
When we update this policy we change the effective date and announce significant changes in the app.