Privacy Policy
This policy explains what Cartee does with your personal data, why, and what you can do about it. We have tried to write it in plain language rather than in the usual fog.
The short version
- Your private lists never leave your phone. They are stored on the device itself. We cannot see them, because we never receive them.
- Shared lists do go to our servers — that is the only way two phones can show the same list at the same moment.
- We do not sell your data, we do not show you advertising, and we do not use your lists to train machine-learning models.
- Product analytics in the app, and marketing email, are opt-in — off unless you turn them on. The website counts visits without cookies and without anything that identifies you. Its only cookie belongs to the check that protects the support form.
- You can delete your account, and everything tied to it, from inside the app.
1. Who is responsible for your data
The data controller is MediaHub.Guru EOOD, UIC 201456304, 122 Ovche pole str., office EMC2, floor 4, 1303 Sofia, Bulgaria.
For any privacy question or request, write to support@cartee.eu or use the form at cartee.eu/support. We have not appointed a data protection officer, because we are not required to — that address reaches the people who can actually act on your request.
2. What we collect
Data you give us
| What | Details |
|---|---|
| Account | Email address; whether you signed in with Google, Apple or a password. Passwords are handled by Firebase Authentication and are never visible to us. If you sign in with Apple, a token Apple gives us for that sign-in. |
| Profile | First and last name, display name, and your avatar — which is a colour choice plus at most one character or emoji. Cartee has no profile photos at all. |
| Shared list content | The names of shared lists, categories and items, quantities, and who added or ticked off what, and when. Only for lists in a household — never for private ones. |
| Household | Which household you belong to, who owns it, and the email addresses used to send invitations. |
| Guest access | If a household adds you as a guest on one of its lists: which of its lists you are on, the email address the invitation was sent to, and a copy of your name and avatar shown to that household. If you add a guest to one of your lists, the same about them. |
| Consents | Whether you opted in to product analytics and marketing email, and when you last turned each on or off; and which version of the Terms and this Policy you accepted, with the time you accepted it. |
| Support | Whatever you write to us — by email at support@cartee.eu, or through the form at cartee.eu/support, where you give your first and last name, email address and message — and our reply. |
Data we collect automatically
| What | Details |
|---|---|
| Presence on a shared list | Which shared list you have open and when you were last active on it, while the app is in the foreground. Other members of your household — and any guest on that list — see this as a highlighted avatar so you can tell who is shopping. It is removed when you close the list, and expires by itself within a couple of minutes if your phone goes offline. Never for private lists. |
| Push notification token | A token identifying your installation, its platform (iOS or Android) and a device identifier, so we can tell your phone that someone added an item. |
| Diagnostics | Crash reports and error traces: app version, operating system, device model, and the sequence of actions leading to the fault. Scrubbed of personal data, and never containing list or item content. |
| Product analytics (only if you opt in) | Categorical events about how the app is used — that a list was created, that an item was added, which plan tier a household is on. They are linked to your account by an internal code. Never list names, item names or email addresses. |
| Technical delivery data | Our providers process IP addresses and similar connection data to deliver the service and protect it from abuse. |
| Server logs | Records of the requests our servers handle, kept for up to 30 days to run and maintain the service. The text of a message sent through the support form is never written to them. |
| Support form checks | When you use the form at cartee.eu/support: Cloudflare Turnstile checks that a person, not a program, is sending it, using signals from your browser and your IP address, and sets a cookie to do so. To stop the form being flooded, we keep a scrambled (hashed) form of the email address you enter and of your IP address, so we can count how many messages each sends in an hour. |
| Sign-in checks | When you enter your email address to sign in or create an account, we check whether it already has an account. To stop anyone using that check to test lists of addresses, we keep a scrambled (hashed) form of your IP address and of the email addresses entered from it, to limit how many checks one network can make. |
| App integrity check | The app asks Apple (App Attest) or Google (Play Integrity) to confirm that its requests to our servers come from a genuine copy of Cartee. They check this using information about your device and the installed app; we receive only a short-lived token saying whether the check passed. |
| Website visits | On the cartee.eu website only: which page was visited, roughly where from, the kind of browser and device, and how quickly the page loaded. Aggregate counts with no cookie and no identifier, so visits cannot be linked to each other or to you. |
Payment data
We never receive your card details. Subscriptions are bought through the App Store or Google Play, and those companies take the payment. We only receive what the store reports about your subscriptions — which plan and any guest pack, which store, when each was bought, whether it is active, when it renews or ends, and whether it was refunded — so the app can unlock shared lists and show you your purchases.
If we give you free access to a plan, we record which plan, why, who granted it and until when. It is deleted with your account.
What we deliberately do not collect
No contacts, no location, no photos, no advertising identifiers, no cross-app tracking, and nothing that follows you between websites.
The website at cartee.eu sets no cookies, with one exception: the support form at cartee.eu/support is protected by Cloudflare Turnstile, a check that tells people from programs, and Turnstile sets a cookie to do that job. It loads only on that page, once the form is on screen, and it is strictly necessary to protect the form you are using.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account; syncing shared lists; households and invitations; providing paid features | Performance of a contract — Art. 6(1)(b) |
| Verification codes, invitation emails, and other transactional email | Performance of a contract — Art. 6(1)(b) |
| Push notifications about household activity | Performance of a contract — Art. 6(1)(b) |
| Keeping the service secure, preventing abuse, and fixing crashes and errors | Our legitimate interests in a working, secure product — Art. 6(1)(f) |
| Running and maintaining the service (server logs) | Our legitimate interests in keeping it working and secure — Art. 6(1)(f) |
| Product analytics in the app | Your consent — Art. 6(1)(a) |
| Counting visits to the cartee.eu website and measuring its speed | Our legitimate interests in knowing the site works and is worth keeping — Art. 6(1)(f). No cookie and no identifier are used, so there is nothing to consent to |
| Marketing email — news, tips and promotions about Cartee | Your consent — Art. 6(1)(a) |
| Keeping tax, accounting and transaction records | Legal obligation — Art. 6(1)(c) |
You can withdraw consent at any time, and doing so does not affect anything we did before you withdrew it. In the app, Account → Preferences → Data & privacy has a switch for product analytics and one for marketing messages; every marketing email also carries an unsubscribe link.
4. Who we share it with
We do not sell personal data and we do not share it for anyone else’s marketing. We do use service providers, who process data on our instructions under data-processing agreements:
| Provider | What they do | Where |
|---|---|---|
| Google (Firebase) | Authentication, database, server functions, push notifications, analytics | EU / USA |
| Sentry | Crash and error monitoring | USA |
| Resend | Sending transactional email | USA |
| RevenueCat | Managing subscription entitlements | USA |
| Cloudflare | Hosting the cartee.eu website, its cookieless visit and page-speed analytics, and the Turnstile check on the support form | Global network |
| Apple, Google | Distributing the app, taking payment, and confirming the app’s requests come from a genuine copy of Cartee (they act as independent controllers under their own privacy policies) | Global |
We will also disclose data if the law genuinely requires it, or to establish or defend legal claims. If our business is ever reorganised or sold, data may transfer with it — and you would be told before that changed anything about this policy.
People in your household see what you would expect them to see: everyone in a household can see the shared lists in it, the items on them, who added or ticked each item, and each member’s name and avatar. Sharing a list is sharing it. They can also see the household’s plan — which one it is, when it ends, and whether it is set to renew — because when it ends, their access changes too.
Guests see one list, and are seen on it. If a household adds you as a guest on one of its lists, you and that household’s members see each other on that list the way members see each other: names, avatars, who added or ticked each item, and who has the list open. You see nothing else of that household — not its other lists’ names or contents, or its plan — and nobody’s email address is shown to anyone, in either direction. To show who is on your list, the app receives each member’s activity in that household: when they last opened each of its lists, identified by an internal code rather than a name, and which one they have open. The household’s members can see which of their lists you are a guest on.
5. Sending data outside the EU
Some of our providers are in the United States, so your data may be transferred there. Those transfers are covered by the European Commission’s Standard Contractual Clauses, and, where the provider is certified, by the EU–US Data Privacy Framework. You can ask us at support@cartee.eu for details of the safeguards that apply.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Apple sign-in token | Until you delete your account — we then use it to end Cartee’s access at Apple, and delete it |
| Shared lists and their contents | Until deleted by the household, or until the household is deleted — which happens 30 days after the household’s plan ends, unless it is renewed |
| Free access we have given you | Until you delete your account |
| Guest access | Until you leave the list, the owner removes you, the list or the household is deleted, or you delete your account. If the owner’s guest pack stops covering you, you lose access at once, but the record stays until one of those happens, so that access can come back if the pack grows again |
| Subscription record at RevenueCat | Until you delete your account. We keep no billing record of our own about you; Apple and Google keep theirs, as the sellers |
| Private lists | On your device only — removed when you delete them or uninstall the app |
| Verification codes | They stop working after 10 minutes and are deleted automatically within a day |
| Invitations | Until accepted, cancelled or expired, then deleted after 30 days |
| Push tokens | Until you sign out, uninstall, or the token stops working |
| Crash and error diagnostics | Around 90 days |
| Server logs | Up to 30 days |
| Product analytics (app) | Up to 14 months. If you delete your account, Google erases it within the time its own deletion process takes |
| Website visit counts | Held by Cloudflare as aggregate totals. Nothing in them is linked to you, so there is nothing about you in there to find or remove |
| Support messages (email or form) | As long as needed to deal with the matter and any follow-up |
| Support form counts | The hashed email address and IP address, for the hour they count; deleted automatically within a day |
| Sign-in check counts | The hashed IP address and email addresses; deleted automatically within a day |
| Records of your acceptance of these documents | While you have an account, and afterwards for as long as we may need to show what you agreed to |
| Tax and accounting records | The App Store’s and Google Play’s statements to us, which name no customers — kept for 10 years, as Bulgarian law requires |
7. Deleting your account
You can delete your account in the app under Account → Delete account. We confirm it with a code sent to your email address, and then, in order:
- verification codes are deleted;
- you are removed from your household, if you are in one — the shared lists stay, along with everything you added to them, because they belong to the household rather than to you;
- if the household was yours alone, it is deleted with all of its shared lists and any unused invitations;
- invitations sent to your email address that nobody has accepted are cancelled, freeing the seat they were holding, and you are removed from every list you are a guest on in another household;
- your profile, your consents and your push tokens are deleted;
- your subscription record at RevenueCat is deleted — if RevenueCat cannot be reached at that moment, we retry every day until it is;
- we ask Google Analytics to delete your product analytics, including anything collected before you switched it off — Google then erases it from its servers within the time its own deletion process takes; if Google cannot be reached at that moment, we retry every day until it accepts;
- if you signed in with Apple, we tell Apple to end Cartee’s access to your Apple Account — if Apple cannot be reached at that moment, we retry every day until it accepts;
- your login account itself is deleted.
Server logs expire on their own within 30 days; deleting your account does not remove them sooner.
If you own a household that other people are still in, we ask you to remove them before you can finish — the app takes you through it as part of the deletion. Deleting your account would otherwise take away shared lists that other people rely on, without them having agreed to it.
Private lists live on your device, not on our servers, so there is nothing for us to delete. They go when you delete them or remove the app.
We ask why you are leaving. That answer is sent to our support inbox anonymously — the reason and anything you type, with no name, no email address and nothing that identifies you — and it never goes into analytics.
Deleting your account does not cancel a subscription bought through Apple or Google. Cancel that in the store, or it will keep renewing.
8. Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data — much of which you can do yourself in the app;
- restrict or object to how we use it, including anything based on our legitimate interests;
- port your data to another service in a machine-readable form;
- withdraw a consent you previously gave — product analytics and marketing messages can each be switched off in the app, under Account → Preferences → Data & privacy.
Write to support@cartee.eu or use the form at cartee.eu/support. We answer within one month, and we do not charge for it. We may need to confirm it is really you before we act on a request.
If you think we have got it wrong, you can complain to the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg), or to the supervisory authority in the EU country where you live. We would appreciate the chance to fix it first.
9. Children
Cartee is not intended for children under 13, and we do not knowingly collect their data. If the law where you live sets a higher age for consenting to online services, that age applies instead.
If you believe a child has given us personal data, write to support@cartee.eu and we will delete it.
10. Security
Data is encrypted in transit and at rest by our providers. Access to shared lists is enforced on the server by household membership, not merely hidden in the app. Access to production systems is limited to those who need it.
No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your rights, we will notify you and the supervisory authority as the GDPR requires.
11. Changes to this policy
We will update this policy when the product or the law changes.
Every version is dated and published at cartee.eu/privacy, and the current text is always readable inside the app. Whenever we change it — even for a clarification or a corrected typo — we will ask you to accept the new version in the app before you carry on, because staying silent is not consent, and we will show you a plain-language summary of what changed.
12. Contact
MediaHub.Guru EOOD
122 Ovche pole str., office EMC2, floor 4
1303 Sofia, Bulgaria
UIC 201456304
This is the same text the Cartee app shows under Account → Legal. Questions about it? Write to us.