Privacy policy

Last updated: 12 July 2026

Zakupomat is an app for a shared household shopping list. We collect only the data the service needs in order to work. We show no ads, we use no tracking or analytics tools, and we do not sell data.

This is a translation provided for convenience. The Polish version is the binding one; if the two differ, the Polish text prevails.

What data we process

• Household name — the one you enter when you create the account.
• Access key — generated at random; on the server we store only its irreversible digest (SHA-256 hash), never the key itself.
• List content — item names, quantities, notes, order and ticked-off status, all entered by you.
• IP address — processed briefly, solely to protect against abuse (limiting login attempts) and in standard server logs.

We do not collect an email address, a password, your name, your location, your contacts or advertising identifiers.

Camera

We use camera access solely to scan the QR invite code (the access key) on your device. Photographs and the camera image are neither stored nor sent to the server.

Data kept on your device

On your device we store the access key (so you do not have to sign in every time), the list of new items you have already seen, and the queue of changes waiting to be sent while you are offline. This data stays on the device.

Purpose and legal basis

We process data in order to provide the shared shopping list service (Article 6(1)(b) GDPR) and to keep the service secure (legitimate interest, Article 6(1)(f) GDPR).

Where and for how long

Data is stored on a server in the European Union (OVH, France). We keep it for as long as your account exists. The app offers a “Delete account” option, which permanently and irreversibly removes the household together with all its items and lists.

Sharing data

We do not sell or share your data with third parties. The content of your list is visible to anyone you give your household's access key to.

Your rights

You have the right to access your data, to correct it and to have it erased (directly in the app through “Delete account”, or by contacting us). You may also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

Children

The service is not directed at children under the age of 16.

Changes

If anything changes, we will update this page and the date at the top.