Privacy policy

1. Controller

The controller for processing personal data within the meaning of Art. 4(7) GDPR is:

Name

Pratyush Suhas Deshpande

Address

Hauzenberger Str. 4
80687 München
Germany

Email

hallo@basketiers.de

No data protection officer has been appointed, because the statutory conditions for one (Art. 37 GDPR, § 38 BDSG) are not met. All data protection enquiries go to the email address above.

2. What stays on your device

By default, everything you enter into Basketiers stays on your device. That is:

• your shopping lists, with the items, quantities, units, prices and the “done” tick
• the shops you assign to a list
• your preferences: reduced motion, haptic feedback, and whether you have seen the welcome screen

This data lives in the app's private storage area (AsyncStorage) and is not transmitted to us. We cannot see it. If you sign in, the session token that keeps you signed in is additionally stored in your device's secure keychain.

Legal basis: storing this data is strictly necessary to provide the function you asked for and is therefore permitted without consent under § 25(2) no. 2 TDDDG. To the extent personal data is involved at all, the basis is Art. 6(1)(b) GDPR (providing the app's functions).

Deleting it: uninstall the app or clear its data in your device settings. That removes everything. Because we never receive this data, there is nothing for us to delete on our side.

3. Account and sign-in (Clerk)

You do not need an account to use Basketiers. You only need one if you want to share a list. Sign-in runs through Clerk (Clerk, Inc., USA) in a browser window on Clerk's own pages.

This processes:

• your email address — entered by you, stored by Clerk, and passed to Basketiers as part of your session
• an account identifier (Clerk user id) — a string that identifies your account; it is the key for every list you own or were invited to
• technical session data — the session token and its claims (identifier, email address, role), which your device sends with every request to the database

We never see or store your password. Sign-in happens on Clerk's pages; Basketiers only receives the result. Signing in transfers no list contents.

Legal basis: Art. 6(1)(b) GDPR — processing is necessary to perform the contract you enter into by signing in (providing the account and shared lists).

4. Shared lists (Supabase)

When you share a list, exactly that list is uploaded to a database at Supabase so that the people you invited can see and edit it. A list you do not share does not leave your device.

Roles: there are only owner and editor. Anyone on a list can read it and tick items off — there is no read-only role, because ticking things off a shared shopping list is the point of it.

After an invitation is revoked: revoking is a status change, not a deletion. The row therefore remains — with the invited person's email address and the time at which they accepted. That is deliberate, so it stays traceable who had access. Only deleting the list or the account removes these rows.

Access control: access is enforced by rules inside the database (row level security): a list is readable only by the people on it. A pending invitation may see the list's name, but not its items.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract: sharing is the function you trigger).

5. Invitations by email

If you invite someone by email address, we store their email address together with the status of the invitation, so that the invitation can be matched to them once they sign in.

Important, as of today: email delivery is prepared in the code but not in operation. So no email is currently sent to invited people — the invitation exists only in the database, and the person who invited them has to say so themselves. Once delivery is activated it will run through Resend (Resend, Inc., USA); the invitation email will then contain the inviter's address, the list title and a short note on how to accept. This policy describes both states, because they can be switched without changing this text.

Legal basis: Art. 6(1)(b) GDPR (preparing and performing the contract with the inviting person) and, for notifying the invited person, Art. 6(1)(f) GDPR (the legitimate interest in delivering an invitation that another person explicitly triggered). The inviting person is responsible for being allowed to use the invited person's address.

6. Camera and microphone

Both are optional and are used only while you actively operate the relevant feature. They never run in the background.

Camera — scanning barcodes

The camera reads a barcode, and only when you open the scan feature. The barcode is decoded on the device. No photo is taken, stored or uploaded. The decoded number is matched against a product list built into the app — with no network request.

Microphone — dictating items

The microphone is active only while you use the voice feature. Speech-to-text is performed by your operating system's speech recognition service — Apple's on iOS, your device manufacturer's or Google's on Android. That service may process your audio on its own servers, under its own privacy policy and outside our control. Basketiers does not record, store or transmit your audio and receives only the resulting text. If you add a dictated item to a shared list, that text is uploaded like any other item.

Legal basis: Art. 6(1)(a) GDPR (your consent), given through the operating system's permission prompt. The provider of the operating system's speech service is the controller for its processing, not us.

You can revoke camera and microphone permission at any time in your device settings. The rest of the app keeps working.

7. Payments

Basketiers is free. There are no in-app purchases, no subscriptions and no advertising. We therefore collect and process no payment data — no card numbers, no billing addresses, no purchase history. If that ever changes, this policy will be updated first.

8. No analytics, no ads, no tracking

• No analytics. The app contains no analytics or usage-tracking software.
• No advertising. There are no ads and no advertising IDs.
• No tracking. We do not track you across other apps or websites and we do not build advertising profiles.
• No selling, no sharing for advertising. We do not sell your data and do not give it to anyone for their own marketing.
• No crash reporting service. The app has a place where a crash reporter would sit; it is deliberately empty. Nothing is sent.
• No automated decision-making. There is no profiling and no automated decision within the meaning of Art. 22 GDPR.

9. Recipients and processors

We use a small number of service providers, and only for the purposes above. They process data on our behalf (Art. 28 GDPR) or as independent controllers, as noted below.

Resend is used only when invitation delivery is activated. While it is off, no email is sent and no invited person's address reaches Resend.

Transfers to third countries

Clerk, Vercel, Resend and Expo may process data outside the EU/EEA, in particular in the United States. That transfer relies on:

• standard contractual clauses under Art. 46(2)(c) GDPR agreed with the providers, and
• where the provider in question is certified under the EU-US Data Privacy Framework, the European Commission's adequacy decision under Art. 45 GDPR.

Supabase (database and hosting for shared lists) and Zoho (mailbox) run in data centres in the EU — Supabase in Frankfurt am Main. No third-country transfer therefore takes place for either of them.

You can request a copy of the safeguards, or further information, at the email address above. You can also check whether a provider is currently DPF-certified in the European Commission's list and in the provider's own privacy notice.

10. How long we keep it

No statutory retention periods require longer storage of this data. We delete or anonymise once the purpose falls away.

11. Deleting your account and your data

In the app: sign in, open Settings and choose Delete account, then confirm. Your account and all data named in sections 3 and 4 is deleted immediately.

Via this website: the delete account page describes the route step by step — including the case where you can no longer sign in. It is readable without login and without JavaScript, and it is the URL registered in Google Play's Data safety form.

What is deleted: your account including email address and identifier; the shared lists you own (including their items, for everyone reading them); your memberships of other people's lists including the email address stored there; and pending invitations addressed to you.

What remains: lists that only ever existed on your device stay there — they were never part of your account. Delete them in the app or uninstall it. Invitation emails already sent cannot be recalled.

Timeline: deletion in the app takes effect immediately. Requests by email are handled without undue delay and at the latest within the statutory one-month period (Art. 12(3) GDPR).

12. Your rights

Under the GDPR you have in particular the following rights:

• access (Art. 15 GDPR) — what data we process about you
• rectification (Art. 16 GDPR) — correcting inaccurate data
• erasure (Art. 17 GDPR) — see section 11
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR) — receiving the data you provided in a common format
• objection (Art. 21 GDPR) — to processing based on Art. 6(1)(f) GDPR
• withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future, for example for camera and microphone

An email to hallo@basketiers.de is enough for all of these. We reply within one month; for complex requests that period may be extended under Art. 12(3) GDPR, and we will tell you if it is.

Complaint to a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. Competent for us:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), competent for Bayern.

The addresses of all German state authorities are listed by the Federal Commissioner for Data Protection. Your right to complain to another competent authority is unaffected.

13. This website

This website is hosted by Vercel. When you request a page, Vercel processes the technically necessary connection data as a processor, in particular your IP address, the date and time of access, the file requested, the amount of data transferred, the referrer and your browser's user agent. This data ends up in server logs.

Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in operating the website securely and stably and in defending against attacks. Retention: no longer than 30 days.

This website sets no cookies, uses no analytics, no advertising and embeds no external resources. Fonts come from your device's system. There is no contact form: the email link opens your own mail client, and the message only leaves your device when you send it there. The pages work fully with JavaScript disabled — none is served.

The few links to external sites (for example statutes or our providers' privacy notices) are plain links. Only when you click one does your browser connect to that server, and that provider's terms then apply.

14. Children and young people

Basketiers is not directed at children. The app is not intended for anyone under 16; under Art. 8 GDPR the age limit for information society services in Germany is 16. We do not create accounts for children and do not knowingly collect their data. If you believe a child has given us data, write to us — we will delete it.

15. Security

Shared lists are protected by database access rules, so a list is readable only by the people on it. All connections use HTTPS. Credentials are handled entirely by Clerk and never pass through the app.

No system is perfectly secure. We cannot promise that data will never reach someone who should not have it.

16. Do you have to provide data?

No. Using the app without an account requires no personal data at all. Signing in is voluntary and only needed if you want to share; the email address given there is required for sign-in. Without it the sharing feature cannot be provided. There is no disadvantage to you in that — the app remains fully usable without an account.

17. Changes to this policy

If this policy changes, the date at the top changes. We will note material changes in the app's release notes. The version published here applies to use after a change.

18. Contact

Questions about this policy, or requests concerning your rights:

Statutory bases for this policy: Art. 13 GDPR, Art. 77 GDPR, § 5 DDG. This policy is a carefully researched draft, not legal advice; see the Impressum.