Privacy policy

Who we are

CartFriend is a shared family shopping list app for Android and iOS. It is developed and run by , based in Vilnius, Lithuania, who is the data controller for the personal data described here. Contact: .

The short version

• We keep only what the app needs to work: your account, your family and your shopping lists.
• No ads, no analytics or tracking tools, and we never sell your data.
• Your data is stored in the EU (Google Cloud, Finland).
• You can delete your account and data at any time, right in the app.

What we collect

• Account: username, email address, display name and your password (stored only as a secure hash, never in plain text). If you sign in with Google, we receive your email address and name from Google.
• Family: which family you belong to, your role (admin or member) and invitation codes you create.
• Shopping lists: list names, items, item descriptions, priorities, statuses and who is buying each item.
• Sign-in sessions: the app keeps sign-in tokens in your device's secure storage. Our server keeps a hashed refresh token so you stay signed in, for up to 30 days.
• Technical logs: when the app talks to our server, our hosting provider records standard request information such as IP address, time and the address requested. We use it to keep the service secure (for example, to limit repeated login attempts) and to fix errors.

We do not access your contacts, location, camera, photos or files.

How we use it

• To provide the app: sign you in, share lists within your family and show who is buying what (necessary to provide the service you asked for).
• To keep the service secure and working, prevent abuse and fix errors (our legitimate interest).

Who can see your data

• Your family members see your display name, the family's lists and items, and which items you are buying. Family admins also see members who are no longer active.
• Service providers: Google Cloud hosts our server, database and logs in the EU (region europe-north1, Finland). If you use Google sign-in, Google processes that sign-in under its own privacy policy.
• We share data with authorities only if the law requires it.

How long we keep it

• Your data is kept while you have an account.
• When you delete your account, it is removed from our live database immediately. Encrypted backups are kept for up to 30 days and are then overwritten.
• Technical logs are kept for up to 30 days.

Deleting your account

In the app open Menu → Update Account → Delete account. See Delete your account for details and how to ask us if you no longer have the app.

Your rights

Under the GDPR you can ask to access, correct, delete or receive a copy of your data, and object to or restrict how we use it. You can change your display name and delete your account in the app yourself; for anything else contact . You can also complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).

Children

CartFriend is not intended for children under 14, and we do not knowingly collect their data.

Changes

If this policy changes, we will update this page and the date above. Significant changes will also be announced in the app.