Privacy policy

Last updated: 31 October 2026

Zakupomat is an app for a shared household shopping list. We collect only the data the service needs in order to work and to improve. We show no ads, we use no third-party tracking or analytics tools, and we do not sell data.

This is a translation provided for convenience. The Polish version is the binding one; if the two differ, the Polish text prevails.

What data we process

• Household name — the one you enter when you create the account.
• Access key — generated at random; on the server we store only its irreversible digest (SHA-256 hash), never the key itself.
• List content — item names, quantities, notes, order and ticked-off status, all entered by you.
• Shopping history — when you finish shopping, we record for your household what was bought and what was not (item names and quantities as they were at that moment; of a note only whether there was one — never its text), when it happened, and from which app version and platform (iOS, Android, web browser, AI assistant). This lets us show you a summary of your shopping and, in the future, statistics for your household. The history belongs to the household, not to any person — we do not know which member of the household did the shopping.
• App in use — on a day your household uses the app, we record that date for the household together with the app platform and version (e.g. “iOS 1.9.0”) — once a day, with no time of day, no IP address and nothing about what was done. It serves aggregate statistics only: how many households use which versions, so we know when old versions can stop being supported.
• Installation identifier and game records — when you open the optional game, the app sends a random identifier for this installation. When you improve your record, we store the best score for this installation, household and scoring version. We do not collect player names, nicknames, hardware identifiers or the sequence of moves in a round. Your household sees scores only, without identifiers. This data enables personal records and competition within the household.
• Usage statistics — if “Usage statistics” is on in the app’s Settings (it is by default), the app adds a random identifier for this installation to its requests. We then store the days on which the installation used the app (with the household, platform and app version) and, once a day, its latest settings: the major system version, the app and phone language, the theme and the app’s settings. We do not tie what you do with the list to the identifier — no ticks, trips or reports. The web version sends the identifier, language and theme. This serves aggregate statistics only: how many installations use which versions, languages and settings.
• Reports from the app — bugs and ideas you send from the app: their text, type, app version, platform and language. We store them without any link to your household.
• Crash reports — when the app crashes, it saves a description of the error on your device (the type of exception and where in the code it happened), the app version, the system version, the phone model and the time of the crash, and sends it to us the next time it starts. A report does not contain your list and we store it without any link to your household. It is used only to fix bugs.
• IP address — processed briefly, solely to protect against abuse (limiting login attempts) and in standard server logs.
• Product categories — the category a product has and any category you pick by hand. In the shared category base we keep the normalised product name (lower case, without quantities and notes in brackets) together with its category — not linked to any household.

We do not collect an email address, a password, your name, your location, your contacts or advertising identifiers.

Camera

We use camera access solely to scan the QR invite code (the access key) on your device. Photographs and the camera image are neither stored nor sent to the server.

Data kept on your device

On your device we store the access key (so you do not have to sign in every time), a report you are still writing and have not sent, which “What’s new” you have already seen, and the queue of changes waiting to be sent while you are offline. This data stays on the device. A crash report waits on the device until the next start, is then sent and removed from the device.

We also keep the installation identifier, game record and a pending score locally. The score is sent to the server only as part of the optional game; the identifier is also sent while you use the app if “Usage statistics” is on. Signing out does not change the installation identifier.

Purpose and legal basis

We process data in order to provide the shared shopping list service, including summaries and statistics for your household (Article 6(1)(b) GDPR), to keep the service secure, and to improve it on the basis of aggregated information about its use and the reports you send (legitimate interest, Article 6(1)(f) GDPR).

Automatic product categories rely on legitimate interest (Article 6(1)(f) GDPR); you object by turning off “Automatic categories” in Settings.

Usage statistics rely on legitimate interest (Article 6(1)(f) GDPR); you object by turning off “Usage statistics” in Settings.

Where and for how long

Data is stored on servers in the European Union (OVH), backups included. We keep it for as long as your account exists. Shopping history and reports from the app are kept for at most 24 months, information about the app in use for at most 13 months, crash reports for at most 6 months; the running totals (the number of items bought and of shopping trips) stay for as long as the account exists. The app offers a “Delete account” option, which permanently and irreversibly removes the household together with all its items, lists and shopping history.

Game records and their installation identifier remain until the household is deleted; deleting the household also deletes these records.

Usage statistics (an installation’s days and latest settings) are kept for at most 13 months after the installation was last used; deleting the household deletes its days.

The shared category base (a normalised product name and its category, not linked to any household) stays after an account is deleted — it cannot be tied to anyone.

Sharing data

We do not sell your data or share it with third parties — with one exception: product names for automatic categories (see below). The content of your list is visible to anyone you give your household's access key to, and to AI assistants you connect to the list yourself.

AI assistants (Claude, ChatGPT)

You can connect your list to an AI assistant, such as Claude or ChatGPT, by pasting your household key on our connection page. The assistant can then read and change the list and the product database on your behalf. On the server we record only the connection itself: for which household, with which assistant (its name) and when it was last used. We do not store the key, and we keep the connection tokens only as irreversible digests (SHA-256 hashes). Shopping finished by the assistant goes into the shopping history with the platform “AI assistant”.

Whatever the assistant reads from your list goes to its provider (for example Anthropic or OpenAI) and is covered by that provider’s own terms — the connection is your decision. You can end it in the assistant’s settings; deleting your account ends it too. A connection that is not used expires after 180 days.

Automatic categories (Jev, TypeSafe AI)

As a trial, Zakupomat picks categories for products by itself (fruit, dairy, cleaning…). When a product name is not in the shared category base yet, our server sends it to the Jev model by TypeSafe AI, Inc. (USA), which picks a category from our fixed list. We send only the normalised product name (lower case, without quantities, notes in brackets or a trailing “for …”) — without the household name, the key, the IP address or anything else that points to your household. Each name is sent only once, however many households use it.

TypeSafe AI processes these names on our behalf under a data processing agreement (part of its terms of service), and the transfer to the USA relies on the European Commission's standard contractual clauses (module 2). TypeSafe AI does not train its models on our data; it keeps it for as long as providing the service requires.

You can turn this off in Settings → “Automatic categories” — the setting applies to the whole household. When it is off, your product names never leave our server; products get a category only if it is already in the shared base or you set it by hand. A category picked by hand applies to your household only. This is a trial: if it turns out too expensive, we will switch it off.

Your rights

You have the right to access your data, to correct it and to have it erased (directly in the app through “Delete account”, or by contacting us). You may also lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

Children

The service is not directed at children under the age of 16.

Changes

If anything changes, we will update this page and the date at the top.