SmartCart
Privacy Policy
This Privacy Policy explains how SmartCart ("we", "us", "the app") collects, uses, and shares information when you use the SmartCart application and website. SmartCart is a shopping-list app: you create lists, organise them by shop, optionally share them with your group, add items by voice, and import recipes.
1. Information we collect
Information you provide
- Account details — your email address and password when you create an account. (Passwords are handled by our authentication provider and stored only as secure hashes.)
- Your content — the shopping lists, items, quantities, prices, shops/aisles, shopping history, favourites, custom recipes, and preferences (language, currency, theme) you create in the app.
- Voice input — if you use "add by voice", a short audio recording is captured on your device and sent for transcription (see Section 4). We do not retain the audio after it is transcribed.
- Shared-list data — if you share a list or join a group, the members you share with can see that list's contents and who changed what. Names/initials of collaborators may be shown to other members of the same list.
- Payment information — if you subscribe on the website, payment is processed by Stripe. If you subscribe in the Android app, payment is processed by Google Play. We never receive or store your card details; we store only your plan, subscription status, renewal date and a purchase reference from Stripe or Google.
- Feedback — anything you send us through the in-app feedback form.
Information collected automatically
- Usage & device data — product analytics events, approximate/technical device information (browser, OS, screen size), and app version, via our analytics provider.
- Session recordings — we use session-replay analytics that may record your interactions within the app (taps, navigation, and on-screen content) to help us find bugs and improve usability. Sensitive fields are masked where supported.
- Local storage — the app stores data on your device (browser
localStorageand IndexedDB) to work offline and remember your preferences and session. - Android app permissions — the Android app asks for the microphone only when you use "add by voice", and uses the camera or photo picker only when you add a photo to an item. It does not access your location, contacts or other apps.
2. Local-first storage
SmartCart is "local-first": your private (solo) lists, shopping history, favourites, store layouts and custom recipes are stored primarily on your device (IndexedDB) and are available offline. Data leaves your device to our servers mainly when you use features that require it — creating an account, sharing a list, syncing a group, subscribing, voice input, or recipe import.
3. How we use your information
- To provide and operate the app (create and sync lists, share with your group, save your preferences).
- To authenticate you and keep your account secure.
- To process voice input and recipe imports into shopping-list items.
- To process subscriptions and payments.
- To understand usage, diagnose bugs, and improve the app (analytics and session replay).
- To respond to your feedback and support requests.
- To comply with legal obligations.
4. Third-party services (sub-processors)
We share limited data with the following providers so the app can function. Each processes data under its own privacy policy, and some are located outside your country (including the United States), which may involve international data transfers.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Authentication, database, backend functions | Account, shared lists, profile, preferences |
| Vercel | Website/app hosting & delivery | Technical request data (e.g. IP, user agent) |
| PostHog | Product analytics & session replay | Usage events, device data, session recordings |
| Google (Gemini API) | Voice transcription & recipe/AI processing | Voice audio and recipe text you submit, processed transiently |
| TheMealDB | Recipe catalogue data | Recipe queries (no personal data) |
| Stripe | Payments & subscriptions on the website | Payment and billing details (handled by Stripe) |
| Google Play Billing | Payments & subscriptions in the Android app | Payment and billing details (handled by Google under its own terms) |
| RevenueCat | Confirms Google Play purchases and renewals and links them to your account | Your SmartCart account ID (a random identifier, not your name or email), the product bought and purchase/renewal events |
| Pexels | Photos for the recipe catalogue | None (searches by recipe name only) |
| Google Fonts | Web fonts in the app UI | Technical request data (e.g. IP) |
We do not sell your personal information.
5. Legal bases (EEA/UK users)
Where the GDPR/UK GDPR applies, we process your data on these bases: performance of a contract (to provide the app you signed up for), legitimate interests (to secure, maintain and improve the app), consent (e.g. optional analytics/session replay, where required), and legal obligation.
6. Data retention
We keep your account and content for as long as your account is active. Voice audio is processed transiently and not stored by us. Analytics and session-replay data are retained for a limited period per our analytics provider's settings. When you delete your account, we delete your server-side data (see Section 7); data stored locally on your device is removed when you clear the app's storage or uninstall it.
7. Your rights & choices
- Access & export — you can export your data from within the app (Settings → export).
- Deletion — you can delete your account and its server-side data from within the app (Settings → Data → Delete account). A subscription bought on the website (Stripe) is cancelled with it. A subscription bought in the Android app is billed by Google: cancel it in the Play Store (Payments & subscriptions), as deleting your SmartCart account cannot stop Google's billing.
- Correction — you can edit your content and preferences directly in the app.
- Objection/restriction & withdrawal of consent — you may object to certain processing or withdraw consent where applicable.
- Complaint — EEA/UK users may lodge a complaint with their local data protection authority.
To exercise any right, use the in-app controls or email contact@vortexunit.de.
8. Children
SmartCart is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal information.
9. Security
We use industry-standard measures (encryption in transit, access controls, and reputable infrastructure providers) to protect your data. No method of transmission or storage is 100% secure, but we work to protect your information and limit access to it.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, for material changes, provide a more prominent notice.
11. Contact
Questions about this policy or your data: contact@vortexunit.de.