Privacy policy

As of October 26, 2026. This is a translation; the German version is binding.

In short

• I only store what the Shopping List needs to work.
• No advertising, no tracking, no analytics services, no content from other providers (fonts, maps, videos).
• Just one cookie, for signing in. That is why there is no cookie banner.
• I do not sell data. It only goes to the service providers I need to run the app (section 6).

1. Controller

I run the Shopping List as a private individual. There is no data protection officer; none is required.

2. Your account

When you register or accept an invitation, I store your username, your name, your email address, your password (only as a scrypt hash; nobody can read it), your role in the household (admin or member), the household's name and your settings (such as how you check off items, display, translation mode, which lists are in “Everything”, what you call that view, the order of your lists). Also which version of the terms of use you agreed to, and when.

Why: so you can sign in and keep lists with your household. I need the email address so you can reset your password yourself; never for advertising. So that it only reaches you, you confirm it with a link while signed in with your account; until then I also store a new, not yet confirmed address, and when you confirmed one. You only get emails about your account: the link to confirm, the link under “Forgot password?” (only to a confirmed address), and a note when your password or your address was changed (section 6).

Legal basis: Art. 6(1)(b) GDPR (performance of the contract of use). Without username, name, email address and password, no account can be created.

3. Lists and what is on them

Your lists are stored with everything you and the others enter: items, quantities, notes, organic and urgency, stores and their order, photos of products. Also who added, checked off or bought something and when, who is shopping right now, a history of changes and the purchase log (what was bought on a shopping trip and by whom).

Everyone who belongs to a list sees this: your household and guests you share the list with. Guests from other households see your name and your household's name (“Anna (Weber)”); if you are a guest yourself, the other household sees yours.

The app makes photos smaller on your device and saves them anew; metadata such as where and when a photo was taken is dropped. Please photograph products, not people.

Legal basis: Art. 6(1)(b) GDPR.

4. Connection to Food Plan and Vorratsbuch

Food Plan is a second app that I also run. If an admin connects your household to a household in Food Plan, Food Plan sends shopping into the lists the admin releases for it: items with quantities, the dishes they are meant for, and the name of the person who sent them. For this, Food Plan learns your household's name, the names of the released lists and whether guests see them too. The connection can be ended in the settings at any time.

Legal basis: Art. 6(1)(b) GDPR, at your admin's request. Food Plan has its own privacy policy.

Vorratsbuch is another app that I run; it keeps track of a household's pantry. If an admin connects your household to Vorratsbuch, Vorratsbuch writes what needs to be bought again into the lists the admin releases for it: items with quantities, a note and the name of the person who sent them. Vorratsbuch also fetches the finished shopping of these lists to put it away: when, which list, who did the shopping (the name, for guests with their household) and what (item, quantity, organic, aisle). Only shopping from the time of the connection on is fetched. For this, Vorratsbuch also learns your household's name, the names of the released lists and whether guests see them too. The connection can be ended in the settings at any time; after that, Vorratsbuch fetches nothing more.

Legal basis: Art. 6(1)(b) GDPR, at your admin's request; for the shopping of guests on such a list Art. 6(1)(f) GDPR (the list's household wants to put its shopping away), and the app says so when the list is shared. Vorratsbuch has its own privacy policy.

5. On your device

• One cookie (einkauf_session) keeps you signed in: 60 days or until you sign out. The server only keeps a hash of it.
• Device storage (IndexedDB): your lists and changes that have not reached the server yet, so the Shopping List works without signal. It is emptied when you sign out.
• Settings of this device (localStorage): such as the language and the list opened last.
• The app's cache (service worker): the app's files and photos, so they are there offline.

All of this is strictly necessary for the service you use; no consent is needed for it (§ 25(2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act). None of it is used to recognize you across other sites.

6. Server, backup and service providers

Server: The Shopping List runs on a rented server of Contabo GmbH, Munich, in a data center in the EU. Contabo processes the data on my behalf (Art. 28 GDPR).

What the server sees on a request: Your browser sends your IP address and information about itself (such as browser and language) with every request. There is no access log.

• When you sign in, register, use “Forgot password?” or open links, the server remembers the IP address in memory, for “Forgot password?” also the username or email address entered, to slow down too many attempts in a short time (protection against guessing passwords and against emails nobody asked for). Only attempts in the last hour count; the address is never written to disk for this.
• If the app is briefly unreachable (for example during a restart), the web server in front of it writes an entry with IP address, time, the address requested and the browser's information to its error log; cookies are not in it.
• If something goes wrong in the app, it writes the time, the address requested and, where applicable, your username to its error log.

Both logs are limited to 30 MB each; older entries drop out. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working service).

Backup: Every night I back up the database and the photos. The backup is encrypted before it leaves the server; only I have the key. It is stored with Backblaze, Inc., San Mateo, USA, which only sees encrypted data. Backblaze is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Legal basis: Art. 6(1)(f) GDPR (protection against data loss).

Dictionary: To improve the dictionary, I count which item names it does not know yet and in how many households they appear, without reference to a household or person. Legal basis: Art. 6(1)(f) GDPR.

Sending email: The emails about your account go through a Google Mail account (Google Ireland Limited, Dublin): the link to confirm your address (valid for 7 days, with your name, username and the household's name), the link under “Forgot password?” (valid for one hour), and the notes “Your password was changed” and “Your email address was changed” (to the previous address), each with your name and username. If you had entered an address before October 26, 2026, you get the link to confirm once without asking. For this, Google receives your email address and the content of the email. Google may also process data in the USA; Google is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission applies (Art. 45 GDPR). Legal basis: Art. 6(1)(b) GDPR for the links (you entered the address or requested the link), Art. 6(1)(f) GDPR for the one-time link and the two notes (legitimate interest in protecting your account: you notice when someone else changes something).

There are no other recipients. I only pass data to authorities when a law obliges me to.

7. How long

• Account: until you delete it (Settings → My account), an admin removes it or the household is deleted. What you added to lists then stays for the others, without your name; the purchase log then says “former member”.
• Household: until an admin deletes it (Settings → Household); then everything it stored, immediately.
• Checked-off and deleted items: 60 days after the last change, then deleted for good.
• History of a list: the last 100 entries.
• Purchase log: two years, with the name of the person who shopped; after that each purchase is deleted automatically.
• Photos: until no item and no product uses them any more.
• Links: 7 days for invitations, password resets by an admin and confirming the address, one hour when requested by email (“Forgot password?”), 14 days for sharing a list.
• Error logs: 30 MB each, older entries drop out (section 6).
• Sign-in: 60 days, immediately on signing out.
• Backup: I keep older states for up to six months. After that, deleted data is gone from the backup too.

8. Your rights

You have the right to

• access to your data (Art. 15 GDPR),
• rectification (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability, i.e. your data in a common format (Art. 20),
• object to processing based on legitimate interest (Art. 21).

Much of this works directly in the app: you change your name, email address and password under Settings → My account; there, “Download my data” gives you everything stored for your account and your household as a file, and you delete your account. Admins delete the whole household under Settings → Household. For everything else, write to datenschutz@zurmuehl.info; I answer within one month.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for me: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

9. No automated decisions

The Shopping List sorts items into aisles using a dictionary. Beyond that, there are no automated decisions and no profiling (Art. 22 GDPR).

10. Changes

If something new is added, I adapt this policy. The date at the top shows the version.

Imprint · Terms of use