Privacy Policy

1. About the App

Cart ("the App") is a mobile application that helps individuals and couples manage their shopping lists. The app operates in two modes:

• Solo Mode: All data is stored locally on your device only. No internet connection required.
• Couple Mode: Data is uploaded to Supabase cloud infrastructure for real-time sync with your partner.

2. Data We Collect

2.1 Identity Information (Device-Based)

Cart has no account registration. Instead, two unique identifiers (UUIDs) are generated and stored encrypted in your device's secure storage (flutter_secure_storage):

• Device ID (device_id): A permanent, unique identifier assigned to the device on which the app is installed. It does not change.
• Household ID (household_id): Initially the same as the device ID. In couple mode it takes on your partner's household ID.

These identifiers are randomly generated and do not personally identify you.

2.2 App Data

The names of shopping lists you create, product names, check-off history, and points information are stored. This data is kept:

• In solo mode only in the SQLite database on your device.
• In couple mode on your device and on Supabase.

2.3 Data We Do Not Collect

The following information is never collected under any circumstances:

• First name, last name, email address, phone number
• Location data
• Photo, camera, or microphone access
• Address book or contacts
• Device information (brand, model, OS) — not collected for analytics

3. How We Use Your Data

Collected data is used solely for the following purposes:

• Syncing your shopping lists on your device or with your partner
• Calculating and displaying your points
• Verifying your subscription status via RevenueCat
• Sending push notifications via Firebase Cloud Messaging (FCM) — only in couple mode, at points milestones

Your data is not used for advertising and is not sold to third parties.

4. Third-Party Services

Cart uses the following third-party services. We recommend reviewing each service's own privacy policy:

In solo mode, Supabase and Firebase are not used. If you haven't purchased a subscription, RevenueCat only performs a free-tier status check.

5. Data Storage & Security

• Device credentials are stored encrypted in iOS Keychain / Android Keystore via flutter_secure_storage.
• The Supabase database is protected by Row Level Security (RLS) policies; only devices belonging to the same household can read/write data.
• All server communication is encrypted via HTTPS/TLS.

6. Data Retention

• Solo mode: Data remains on your device until you delete the app.
• Couple mode: Data on Supabase is retained as long as the household is active. If you wish to delete your account, email hello@keremcebi.co; all your data will be deleted within 30 days.

7. Children's Privacy

Cart is not directed at children under the age of 13. We do not knowingly collect personal data from individuals under 13. If we become aware of such a case, we will delete the relevant data immediately.

8. Your Rights

You have the following rights regarding your personal data:

• Right of access: You can find out what data is held about you.
• Right to erasure: You can request deletion of your data.
• Portability: You can request a copy of your data.
• Objection: You can object to our data processing activities.

To exercise these rights, email hello@keremcebi.co. We will respond to requests within 30 days.

9. Cookies & Tracking

The mobile app does not use cookies. This website (getcartapp.com) may use first-party cookies for technical functionality only; no third-party tracking or advertising cookies are used.

10. Policy Changes

This privacy policy may be updated from time to time. We will publish an in-app notification for significant changes. The current version of the policy is always available on this page. Continued use of the app constitutes acceptance of the updated policy.

11. Contact

For questions about our privacy policy:

Cart App Team
Email: hello@keremcebi.co
Web: getcartapp.com