Shopper Privacy Policy
Last updated: 31 October 2026
Overview
Shopper is a shared shopping list app. It works offline and syncs your lists through our server. We use no advertising, analytics or crash-reporting services, and we do not sell data.
Controller: Rezsek Máté (natural person). Contact: rezsekmv.dev@gmail.com
What we collect
- Account data. On first launch the app creates an anonymous guest account (a random user id). If you register, we store your email address and a hashed password. Registering is optional.
- Login sessions. When you sign in (a guest account is signed in too), our authentication service stores the session with your IP address and your device's user agent. A session is kept until you sign out or your account is deleted. Once a session has been idle for 90 days, its IP address and user agent are erased (a daily job).
- Display name. A name you choose; it is shown to other members of your spaces.
- Your content. Spaces, lists, items, who added or ticked an item and when, and prices. It lives on your device and is synced to our server, where other members of the same space can see it.
- Receipt photos (optional). If you use receipt scan, the photo (downscaled) and the names of the items on that list are sent to our server and forwarded to the Anthropic API to read the receipt lines. Our server does not store the photo; it logs only your user id and the number of items, for abuse and cost control. If we temporarily turn on diagnostics to investigate a reported scan problem, the item names and the receipt line texts of scans (including loyalty or coupon lines) are also logged, kept for at most 14 days like other server logs. We also keep a per-user, per-day count of scans in our database (your user id, the day and the number of scans) to enforce the daily limit; it is deleted with your account. Receipt scan needs a registered account and is limited per day.
- AI client API keys (optional). If you create an API key so an AI client (for example Claude) can read and write your lists through our MCP server, you send your email and password to the server once. We verify them against our own authentication service and do not store the password. We store only a one-way hash of the key (never the key itself), your user id, an optional label you chose, the creation time, the time the key was last used, and the time it was revoked. We use this to recognise the key, act as you with the same permissions you have in the app (the AI client can read, add, rename, tick and delete your lists and items), and to let you revoke it. What an AI client does with the list data it reads is governed by that client's provider, not by us.
- Emails you send us. If you write to us (for example to delete your account or exercise your rights), we receive your email address and your message.
We do not collect your location, contacts, microphone audio, advertising id or analytics data.
What a receipt photo can show
A receipt can contain more than the items: the store's name and address, the date and time, the last digits of a payment card, a loyalty card number or name, or a tax number. We use only the item lines and their prices, to suggest prices for the items on your list, which you review and edit before anything is saved. We do not extract or keep the rest; the only exception is the temporary diagnostics described above. If you prefer, crop or cover the parts of the receipt you do not want processed before you photograph it.
Why we process your data and on what legal basis
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Providing your account and signing you in | User id, email address and password hash (registered accounts), login sessions with IP address and user agent | Performing our contract with you: providing the service you use (GDPR Art. 6(1)(b)) | Until you delete your account. The IP address and user agent of a session are erased once it has been idle for 90 days. A guest account that has not connected to our server for 12 months is deleted with its data (see Deleting your account). |
| Lists, sharing and sync | Display name, spaces, lists, items, who added or ticked an item and when, prices | Art. 6(1)(b) | Until you delete your account. Items you added to a space shared with others stay there without your name. |
| Receipt scan | Receipt photo and the item names on the list | Art. 6(1)(b) | Not stored by us. Anthropic deletes it within 30 days (see Who sees your data). |
| AI client API keys | Key hash, user id, label, created, last used and revoked times | Art. 6(1)(b) | Until you revoke the key; revoked key records are deleted 30 days after revocation, and all of them when your account is deleted. |
| Security, troubleshooting and abuse prevention | Server, gateway and authentication logs (IP address; for sign-in events your email address and user id; for receipt scans your user id and the number of items; the scan texts while diagnostics are on) | Our legitimate interest in keeping the service secure, investigating faults, and preventing fraud and abuse (Art. 6(1)(f)) | 14 days |
| Daily receipt scan limit | User id, day and number of scans | Our legitimate interest in preventing abuse and controlling the cost of AI processing (Art. 6(1)(f)) | Until you delete your account |
| Backups | A copy of the database (all of the data above held there) | Our legitimate interest in restoring the service and your data after a failure (Art. 6(1)(f)) | Each daily backup is kept for 14 days. |
| Handling your deletion and rights requests | Your email address, your request and our reply | Our legal obligation to handle these requests (Art. 6(1)(c), with GDPR Art. 12 and 17) | Until the request is handled |
| Keeping proof that we handled a request | The same | Our legitimate interest in being able to show that we complied and to defend legal claims (Art. 6(1)(f)) | 1 year, then deleted |
Do you have to give us this data?
No law requires you to give us any data. Registering (email and password) is optional: without it you can use the app as a guest, but you cannot use receipt scan or API keys, and you cannot sign in to the same account on another device. Receipt photos are sent only when you use receipt scan.
Automated decisions
We make no decisions about you based solely on automated processing, and we do no profiling (GDPR Art. 22). Receipt scan only suggests item lines and prices, which you can review and edit.
Revoking an API key
There is no in-app screen for API keys yet. To revoke a key, email rezsekmv.dev@gmail.com from the address you registered with; we mark the key revoked, and it stops working within about 60 seconds. Revoked key records are deleted 30 days after revocation. When your account is deleted, your API key records are deleted with it.
Camera
The camera is used only to scan invite QR codes and to photograph receipts.
Cookies and tracking
The app has no tracking, advertising or analytics code. It stores your sign-in session and a few settings on your device only so that you stay signed in and the app works; this is strictly necessary for the service you asked for. The page hosting this policy is a static page and sets no cookies.
Who sees your data
- Other members of a space see its lists, items, display names and who checked what. Any member can remove another member. An invite code grants access to a space: share it only with people you trust.
- Our hosting provider, Hetzner Online GmbH (Germany), data centre in Nuremberg, Germany, hosts the servers that run our authentication, database, sync and receipt scan services and hold their logs. It processes this data on our behalf, as our processor. We run the software on these servers ourselves.
- Google receives the emails you send to rezsekmv.dev@gmail.com, because that mailbox is a Gmail account. Google (in the EEA: Google Ireland Limited) handles them under its own privacy policy (policies.google.com/privacy), and may process them on servers outside the EEA, including in the United States.
- Anthropic processes receipt photos and the item names that accompany them only for the scan feature, on our behalf, as our processor. Anthropic may not use this data to train its models (Anthropic Commercial Terms, section B) and processes it under its Data Processing Addendum. Anthropic deletes these inputs and outputs within 30 days, unless they are flagged for a usage policy violation (then up to 2 years) or the law requires longer (source). Anthropic may process this data outside the EEA and the UK; such transfers are covered by the European Commission's Standard Contractual Clauses (and the UK and Swiss addenda), which are part of Anthropic's Data Processing Addendum.
- API key records and receipt scan counts can be read only by us as operators of the server; the app and other users never receive them.
The app and our servers send no emails: registration is confirmed automatically, and there is no password reset by email. We use no email delivery service.
Storage, security and retention
Server logs: our servers, API gateway and authentication service record each request in logs, including your IP address and, for sign-in events, your email address and user id. These logs, and the sign-in records of our authentication service, are kept for at most 14 days and then deleted.
Security: data is sent over HTTPS. Passwords are stored only as a hash by our authentication service, and API keys only as a one-way hash. Access to lists and items is enforced in the database (row-level security): a user can reach only the spaces they are a member of. Backups are encrypted.
Retention: we keep your data until you delete your account, except where the table above gives a shorter period. Lists and items you created stay in a space after you leave it or are removed. Uninstalling the app removes only the local copy. The database is backed up daily; the backups are stored encrypted on the controller's own computer in Hungary, and each backup is kept for 14 days, so data you deleted can remain in a backup for up to 14 days.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted (see Deleting your account);
- have the processing of your data restricted;
- data portability: on request we send you an export of your data in a machine-readable format (JSON).
Right to object. Where we rely on our legitimate interest (server logs, the daily scan limit, backups), you can object at any time, on grounds relating to your particular situation. We then stop that processing, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.
How to exercise your rights: email rezsekmv.dev@gmail.com from the email address of your account, so we can tell that the account is yours. A guest account has no email address; save it with an email address on the Account screen first (this keeps the same account and data). Requests are free of charge. We respond within one month of receiving your request; for complex or numerous requests this can be extended by two more months, and if so we tell you why within the first month.
Complaints and court: you can lodge a complaint with a supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information, NAIH), https://naih.hu; you can also complain to the authority in the EU country where you live or work. You can also go to court: in Hungary the regional court (törvényszék) has jurisdiction, and you can also bring the case before the courts of the EU country where you live.
Deleting your account
You can find this page in the app under Account screen > Delete account (opens this page). The app does not have an in-app delete button yet. Until it does, email rezsekmv.dev@gmail.com from the address you registered with and ask us to delete your account. We act only on requests sent from the account's own email address, and we confirm to that address. We complete the deletion within 30 days. It removes:
- your account: email address, password hash, login sessions (with their IP addresses) and sign-in records;
- your memberships and display names;
- every space where you are the only member, with its lists and items;
- your API key records and your receipt scan counts.
Spaces you share with others stay for the other members, with their lists and items. Items you added or ticked there stay, but no longer show who added or ticked them: we remove your user id from them. Our sync service keeps, for each such shared space, a record that your membership was removed, identified by your former user id and the space id and holding no other data, until that space's sync data is rebuilt. After deletion that id is not linked to any other data we hold. Data on other members' devices is removed when they next sync. Server logs and backups that still contain your data are deleted within 14 days. We keep your deletion request and our reply for 1 year as proof that we handled it.
Guest accounts have no email address, so we cannot tell from an email whose guest account it is. To have a guest account deleted now, first save it with an email address on the Account screen (this keeps the same account and data), then email us from that address as above. Otherwise, a guest account that has not connected to our server for 12 months is deleted with its data, in the same way: the spaces where it is the only member (with their lists and items), its memberships, and its user id on items in shared spaces. "Connected" means created, signed in or synced; a guest who uses the app only offline for 12 months, never syncing, counts as inactive, and its server data is deleted. Until then you can delete your lists and items in the app yourself. The same applies to a guest account left behind when you sign in to another account on the same device.
Children
You must be at least 16 years old to use Shopper. If we learn that an account belongs to someone younger, we delete it.
Changes
If we make a material change to this policy, we tell you in the app before it takes effect, and update this page. The date at the top shows when the policy last changed.