Sidecart (“the app”, “we”, “us”) is a collaborative grocery-list app that lets you create shared shopping lists, invite others by code, edit them in real time, and have the app learn the order you walk your store. This policy explains exactly what data the app collects, why, where it is stored, and the choices you have.
We have deliberately kept data collection to the minimum needed to make the app work. We do not use analytics SDKs, advertising SDKs, trackers, or third-party marketing tools, and we never sell your data.
For any privacy question or request, contact us at marius.gutoi@gmail.com.
Authentication is handled by Google Firebase Authentication.
This content is stored in Google Cloud Firestore so it can sync in real time between you and the people you share a list with. Anyone you share a list with can see and edit its items.
The order in which you check items off as you shop, used to learn your typical store route and reorder future lists. This data is stored only locally on your device. It is not uploaded to our servers, not synced between your devices, and not shared with anyone.
App preferences such as your chosen font size, stored locally on your device.
When you share text into the app, it is parsed on your device into list items. We do not collect or transmit the shared text beyond turning it into items on the list you choose.
No location, contacts, photos, camera, microphone, advertising identifiers, analytics/usage data, or payment information (the app is currently free).
| Data | Stored in | Location |
|---|---|---|
| Email / authentication | Firebase Authentication (Google) | Google Cloud |
| Lists, items, membership, invite codes | Cloud Firestore (Google) | Google Cloud |
| Email (on your device) | iOS Keychain / Android EncryptedSharedPreferences | Your device |
| Route-learning data, settings | On-device database / preferences | Your device |
Cloud data is processed by Google Firebase, our sub-processor, which may process data in data centres outside your country. See Firebase’s privacy practices and Google’s Privacy Policy.
Where the GDPR / UK GDPR applies, we process your data to perform our contract with you (the core list, sharing, and sync features) and on the basis of our legitimate interest in keeping the service secure and working. We do not process data for marketing.
You can permanently delete your Sidecart account and its associated data directly in the app:
When you delete your account, we permanently remove:
Deletion is immediate and cannot be undone. Lists owned by other people that you were only a member of are not deleted, as they do not belong to you. Routine encrypted backups may retain residual copies for a short period before being overwritten. If you cannot access the app, you can also request deletion by contacting us at the email in section 10.
You may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. To exercise these, contact us at the email above. You may also lodge a complaint with your local data-protection authority.
The app is not directed at children under 13 (or the minimum age in your country) and we do not knowingly collect their personal data.
Credentials are managed by Firebase Authentication (we never see your password); your email is stored on-device in encrypted system storage; access to list items is restricted by server-side security rules to members of that list. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.
We may update this policy from time to time; material changes are reflected by the “Last updated” date above.
Questions or requests: marius.gutoi@gmail.com