Privacy Policy — Sidecart

Last updated: 26 September 2026

Sidecart (“the app”, “we”, “us”) is a collaborative grocery-list app that lets you create shared shopping lists, invite others by code, edit them in real time, and have the app learn the order you walk your store. This policy explains exactly what data the app collects, why, where it is stored, and the choices you have.

We have deliberately kept data collection to the minimum needed to make the app work and improve it. We use no advertising SDKs, no trackers and no third-party marketing tools, we never collect your advertising identifier, and we never sell your data. The only usage measurement is Google Analytics for Firebase, described in section 2.7.

1. Who is responsible for your data

For any privacy question or request, contact us at marius.gutoi@gmail.com.

2. What we collect and why

2.1 Account information

• Email address — collected when you create an account or upgrade an anonymous account. Used to authenticate you and let you sign back in across devices.
• Anonymous account identifier — if you use the app without signing up, an anonymous user ID is created so your lists are tied to you. No email is collected in this mode.

Authentication is handled by Google Firebase Authentication.

2.2 Grocery list content

• Lists and list items you create (list name, emoji, item names, bought/unbought state, timestamps).
• Membership — the user IDs of people who share a list with you.
• Invite codes you generate to share a list.

This content is stored in Google Cloud Firestore so it can sync in real time between you and the people you share a list with. Anyone you share a list with can see and edit its items.

2.3 Store-route learning data (stays on your device)

The order in which you check items off as you shop, used to learn your typical store route and reorder future lists. This data is stored only locally on your device. It is not uploaded to our servers, not synced between your devices, and not shared with anyone.

2.4 Settings

App preferences such as your chosen font size, stored locally on your device.

2.5 Shared text (WhatsApp / system share)

When you share text into the app, it is parsed on your device into list items. We do not collect or transmit the shared text beyond turning it into items on the list you choose.

2.6 What we do NOT collect

No location, contacts, photos, camera, microphone, or advertising identifiers, and no tracking across other companies’ apps or websites. No payment card details: Sidecart Pro is billed by Apple, and through RevenueCat we receive only whether your subscription is active.

2.7 Usage analytics

• The app records a small, fixed set of events about how its features are used, for example “a list was opened”, “an item was added”, “an invite code was created”, “the subscription screen was shown”. Events carry counts and categories only, such as how many items were imported or whether an item was typed or imported.
• Events never contain the names of your items or lists, your email address, or invite codes.
• Events are linked to your app user ID and to a random app-instance identifier generated by Firebase, so we can see how many people get from one step to the next. They are not used for advertising and not shared with advertisers.
• This data is processed by Google Analytics for Firebase and kept for no more than 14 months.

3. Where your data is stored and processed

Data	Stored in	Location
Email / authentication	Firebase Authentication (Google)	Google Cloud
Lists, items, membership, invite codes	Cloud Firestore (Google)	Google Cloud
Email (on your device)	iOS Keychain / Android EncryptedSharedPreferences	Your device
Route-learning data, settings	On-device database / preferences	Your device
Usage events (section 2.7)	Google Analytics for Firebase (Google)	Google Cloud
Subscription status	RevenueCat	RevenueCat cloud

Cloud data is processed by Google Firebase, our sub-processor, which may process data in data centres outside your country. See Firebase’s privacy practices and Google’s Privacy Policy.

4. Legal basis (EEA/UK users)

Where the GDPR / UK GDPR applies, we process your data to perform our contract with you (the core list, sharing, and sync features) and on the basis of our legitimate interest in keeping the service secure and working and in understanding which features help people finish their shopping, using only the content-free usage events described in section 2.7. We do not process data for marketing.

5. How long we keep your data

• Account and list data is kept while your account exists.
• Deleting a list deletes its items from our servers; leaving a list removes you from membership.
• On-device data is removed when you uninstall the app or clear its data.

Deleting your account

You can permanently delete your Sidecart account and its associated data directly in the app:

1. Open Sidecart.
2. Tap the Settings (gear) icon in the top-right of the lists screen.
3. Tap Delete account.
4. Review the confirmation dialog and confirm. You may be asked to sign in again to verify it's you.

When you delete your account, we permanently remove:

• your account and sign-in credentials (email address and account identifier);
• any grocery lists you own, including all of their items (these are removed for all members of those lists);
• your membership in any lists shared with you (those lists remain for their other members).

Deletion is immediate and cannot be undone. Lists owned by other people that you were only a member of are not deleted, as they do not belong to you. Routine encrypted backups may retain residual copies for a short period before being overwritten. If you cannot access the app, you can also request deletion by contacting us at the email in section 10.

6. Your rights

You may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. To exercise these, contact us at the email above. You may also lodge a complaint with your local data-protection authority.

7. Children

The app is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their personal data.

8. Security

Credentials are managed by Firebase Authentication (we never see your password); your email is stored on-device in encrypted system storage; access to list items is restricted by server-side security rules to members of that list. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

9. Changes to this policy

We may update this policy from time to time; material changes are reflected by the “Last updated” date above.

10. Contact

Questions or requests: marius.gutoi@gmail.com