Privacy Policy
This policy explains what Cartee does with your personal data, why, and what you can do about it. We have tried to write it in plain language rather than in the usual fog.
The short version
- Your private lists never leave your phone. They are stored on the device itself. We cannot see them, because we never receive them.
- Shared lists do go to our servers — that is the only way two phones can show the same list at the same moment.
- We do not sell your data, we do not show you advertising, and we do not use your lists to train machine-learning models.
- Product analytics in the app, and marketing email, are opt-in — off unless you turn them on. The website counts visits without cookies and without anything that identifies you.
- You can delete your account, and everything tied to it, from inside the app.
1. Who is responsible for your data
The data controller is MediaHub.Guru EOOD, UIC 201456304, 122 Ovche pole str., office EMC2, floor 4, 1303 Sofia, Bulgaria.
For any privacy question or request, write to support@cartee.eu. We have not appointed a data protection officer, because we are not required to — that address reaches the people who can actually act on your request.
2. What we collect
Data you give us
| What | Details |
|---|---|
| Account | Email address; whether you signed in with Google, Apple or a password. Passwords are handled by Firebase Authentication and are never visible to us. |
| Profile | First and last name, display name, and your avatar — which is a colour choice plus at most one character or emoji. Cartee has no profile photos at all. |
| Shared list content | The names of shared lists, categories and items, quantities, and who added or ticked off what, and when. Only for lists in a household — never for private ones. |
| Household | Which household you belong to, who owns it, and the email addresses used to send invitations. |
| Consents | Whether you opted in to product analytics and marketing email, and which version of the Terms and this Policy you accepted, with the time you accepted it. |
| Support | Whatever you write to us at support@cartee.eu, and our reply. |
Data we collect automatically
| What | Details |
|---|---|
| Push notification token | A token identifying your installation, its platform (iOS or Android) and a device identifier, so we can tell your phone that someone added an item. |
| Diagnostics | Crash reports and error traces: app version, operating system, device model, and the sequence of actions leading to the fault. Scrubbed of personal data, and never containing list or item content. |
| Product analytics (only if you opt in) | Categorical events about how the app is used — that a list was created, that an item was added, which plan tier a household is on. Never list names, item names or email addresses. |
| Technical delivery data | Our providers process IP addresses and similar connection data to deliver the service and protect it from abuse. |
| Website visits | On the cartee.eu website only: which page was visited, roughly where from, the kind of browser and device, and how quickly the page loaded. Aggregate counts with no cookie and no identifier, so visits cannot be linked to each other or to you. |
Payment data
We never receive your card details. Subscriptions are bought through the App Store or Google Play, and those companies take the payment. We only receive confirmation of what you are entitled to — the plan, whether it is active, when it renews — so the app can unlock shared lists.
What we deliberately do not collect
No contacts, no location, no photos, no advertising identifiers, no cross-app tracking, and nothing that follows you between websites.
The website at cartee.eu sets no cookies. It does run one analytics script — Cloudflare Web Analytics — which counts visits and measures how quickly pages load. It uses no cookies and no identifier that could pick you out or recognise you on a later visit, which is why there is no cookie banner to click. It is the only thing on the site loaded from anyone other than us.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account; syncing shared lists; households and invitations; providing paid features | Performance of a contract — Art. 6(1)(b) |
| Verification codes, invitation emails, and other transactional email | Performance of a contract — Art. 6(1)(b) |
| Push notifications about household activity | Performance of a contract — Art. 6(1)(b) |
| Keeping the service secure, preventing abuse, and fixing crashes and errors | Our legitimate interests in a working, secure product — Art. 6(1)(f) |
| Product analytics in the app | Your consent — Art. 6(1)(a) |
| Counting visits to the cartee.eu website and measuring its speed | Our legitimate interests in knowing the site works and is worth keeping — Art. 6(1)(f). No cookie and no identifier are used, so there is nothing to consent to |
| Marketing and product-update email | Your consent — Art. 6(1)(a) |
| Keeping tax, accounting and transaction records | Legal obligation — Art. 6(1)(c) |
You can withdraw consent at any time, and doing so does not affect anything we did before you withdrew it.
4. Who we share it with
We do not sell personal data and we do not share it for anyone else’s marketing. We do use service providers, who process data on our instructions under data-processing agreements:
| Provider | What they do | Where |
|---|---|---|
| Google (Firebase) | Authentication, database, server functions, push notifications, analytics | EU / USA |
| Sentry | Crash and error monitoring | USA |
| Resend | Sending transactional email | USA |
| RevenueCat | Managing subscription entitlements | USA |
| Cloudflare | Hosting the cartee.eu website, and its cookieless visit and page-speed analytics | Global network |
| Apple, Google | Distributing the app and taking payment (they act as independent controllers under their own privacy policies) | Global |
We will also disclose data if the law genuinely requires it, or to establish or defend legal claims. If our business is ever reorganised or sold, data may transfer with it — and you would be told before that changed anything about this policy.
People in your household see what you would expect them to see: everyone in a household can see the shared lists in it, the items on them, who added or ticked each item, and each member’s name and avatar. Sharing a list is sharing it.
5. Sending data outside the EU
Some of our providers are in the United States, so your data may be transferred there. Those transfers are covered by the European Commission’s Standard Contractual Clauses, and, where the provider is certified, by the EU–US Data Privacy Framework. You can ask us at support@cartee.eu for details of the safeguards that apply.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Shared lists and their contents | Until deleted by the household, or until the household is deleted |
| Private lists | On your device only — removed when you delete them or uninstall the app |
| Verification codes | Minutes. They expire and are deleted automatically |
| Push tokens | Until you sign out, uninstall, or the token stops working |
| Crash and error diagnostics | Around 90 days |
| Product analytics (app) | Up to 14 months |
| Website visit counts | Held by Cloudflare as aggregate totals. Nothing in them is linked to you, so there is nothing about you in there to find or remove |
| Support email | As long as needed to deal with the matter and any follow-up |
| Records of your acceptance of these documents | While you have an account, and afterwards for as long as we may need to show what you agreed to |
| Tax and accounting records | As long as Bulgarian law requires, regardless of account deletion |
7. Deleting your account
You can delete your account in the app under Settings → Delete account. We confirm it with a code sent to your email address, and then, in order:
- verification codes are deleted;
- you are removed from any lists shared with you;
- lists you own are deleted with everything in them;
- your profile, your consents and your push tokens are deleted;
- your login account itself is deleted.
We ask why you are leaving. That answer is sent to our support inbox anonymously — the reason and anything you type, with no name, no email address and nothing that identifies you — and it never goes into analytics.
Deleting your account does not cancel a subscription bought through Apple or Google. Cancel that in the store, or it will keep renewing.
8. Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data — much of which you can do yourself in the app;
- restrict or object to how we use it, including anything based on our legitimate interests;
- port your data to another service in a machine-readable form;
- withdraw a consent you previously gave.
Write to support@cartee.eu. We answer within one month, and we do not charge for it. We may need to confirm it is really you before we act on a request.
If you think we have got it wrong, you can complain to the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg), or to the supervisory authority in the EU country where you live. We would appreciate the chance to fix it first.
9. Children
Cartee is not intended for children under 13, and we do not knowingly collect their data. If the law where you live sets a higher age for consenting to online services, that age applies instead.
If you believe a child has given us personal data, write to support@cartee.eu and we will delete it.
10. Security
Data is encrypted in transit and at rest by our providers. Access to shared lists is enforced on the server by household membership, not merely hidden in the app. Access to production systems is limited to those who need it.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your rights, we will notify you and the supervisory authority as the GDPR requires.
11. Changes to this policy
We will update this policy when the product or the law changes.
Every version is dated and published at cartee.eu/privacy, and the current text is always readable inside the app. If a change materially affects how we use your data, we will ask you to accept the new version in the app before you carry on — because staying silent is not consent — and we will show you a plain-language summary of what changed.
12. Contact
MediaHub.Guru EOOD
122 Ovche pole str., office EMC2, floor 4
1303 Sofia, Bulgaria
UIC 201456304
This is the same text the Cartee app shows under Settings → Legal. Questions about it go to support@cartee.eu.