Privacy policy

In short

• Your lists sync through our serversWhen you’re signed in, your lists are stored on our servers so your family and devices stay in sync.
• Visible to the members you inviteOnly the members of a list can see or change it.
• No ads, no sellingWe never sell your data or use it for advertising.
• Anonymous analyticsUsage statistics to improve the app, never linked to your account.

Who we are

Basket Pal is made by Evo Factory S.à r.l., a company registered in Luxembourg (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us at any time through the contact form; choose the topic Privacy & data.

Your account and your lists

To share a list with your family or use Basket Pal on several devices, you create an account, with Sign in with Apple or with an email address and a password.

What we receive

• Account details: your email address (with Sign in with Apple, this can be Apple’s private relay address), your password in hashed form if you use one, and the display name you choose, which the other members of your lists can see.
• Your lists: everything in the lists you sync — products, stock, targets and thresholds, stores, aisles, categories, variants, shopping trips, purchases and prices — so that they reach your other devices and the members of your lists. Anything you created before signing in is synced too.
• Photos: product photos and store logos you add to a synced list.
• Receipt pages: only on a list with Premium, so they reach every member and device.
• Devices: the name you give each device and when it last synced, so syncing works reliably across them.
• Invitations: who invited whom to which list. Invite codes are stored only in hashed form.

Why, and on what legal basis

We use this data only to provide the service you signed up for — your account, synchronization and sharing — which is necessary to perform our agreement with you (Article 6(1)(b) GDPR). Reminders and notification settings are never synced; they stay on each device.

Sharing a list

When you invite someone to a list, every member can see and edit its content, the display names of the other members, and who bought what during shopping trips (for example “2 bought by Anna”). An invite link works only once and expires after seven days. A member can leave a list at any time, and the owner can remove members. Restricted shopping hides chosen products from some members’ Shopping and Pantry tabs, but every member still sees all purchases in the Log.

Without an account

Used alone, Basket Pal works without an account. Your data then stays on your iPhone and is not sent to our servers; it is removed when you delete the app. You can export it at any time from Settings → Database → Export.

On your iPhone, the Basket Pal database sits in a storage area shared with other apps from Evo Factory installed on the same device (for example NuTrack), so that they can read it locally if you use them together. This happens only on your device; nothing is sent to us through it.

Photos, receipts & camera

Basket Pal uses your camera and photo library only when you choose to take or pick a photo of a product, a store logo or a receipt. iOS asks for your permission first, and you can change it at any time in the iPhone Settings.

Receipts are read on your iPhone with Apple’s Vision framework: the photo is not sent to us or to anyone else to be read. Receipt pages are stored on your iPhone, and are synced only on a Premium list, as described above.

Notifications

Pantry-check reminders and the low-stock digest are local notifications, scheduled by your iPhone. They don’t go through our servers and require your permission.

Anonymous analytics

To understand which features are used and where the app can be improved, Basket Pal sends anonymous usage events to PostHog, a product-analytics service.

What is collected

• Which screens are opened and which features are used — for example “product created”, “receipt reconciled” or “list shared” — and errors the app runs into.
• Technical context: app version, iOS version, device model, and the language and region settings.
• A random identifier created when the app is installed, so that events from the same installation can be counted together. It is not linked to your account or to your identity, and it changes if you reinstall the app.

What is never collected

• Your name, email address or account identifier.
• The content of your lists: product or store names, quantities, prices, photos or receipts.
• Your location, contacts or Apple advertising identifier (IDFA).

Your IP address is not stored with the events. Analytics data is used only by us, to improve Basket Pal; it is not used for advertising and is not shared with anyone else. We rely on our legitimate interest in improving the app (Article 6(1)(f) GDPR); you can object at any time by contacting us.

What we never do

• We don’t show ads, and we don’t sell, rent or trade your data.
• We don’t track you across apps and websites owned by other companies, and we don’t use data brokers.
• We don’t use the content of your lists or receipts for analytics, advertising or profiling.

Service providers

We work with a small number of providers who process data on our behalf, under contracts that require them to protect it and use it only to provide their service to us.

Some of these providers may process data outside the European Economic Area. When they do, the transfer is protected by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

How long we keep data

• Account and synced lists: for as long as your account exists. When you ask us to delete your account, we delete it and the data synced with it within 30 days, including from backups. Lists you shared remain available to their other members.
• Deleted items: when you delete something from a synced list, a small marker is kept until every device has synced the deletion, then it is removed.
• Analytics events: at most 25 months.
• Support messages: as long as needed to help you, and no longer than 3 years after our last exchange.

Your rights

Depending on where you live — and in any case if you live in the European Union or the United Kingdom — you have the right to access your personal data, correct it, delete it, receive a copy in a portable format, restrict or object to its processing, and withdraw your consent where we rely on it. Many of these you can exercise directly in the app: edit your display name, export your data, leave a list or sign out. For anything else, contact us through the contact form; we answer within one month.

You also have the right to lodge a complaint with your data protection authority.

Security

Data travels between the app and our servers over encrypted connections (HTTPS). On the server, access rules ensure that only the members of a list can read or change it.

Your lists are not end-to-end encrypted: they are stored in a form our service can read, which is what allows them to sync between members and devices. We don’t look at the content of your lists, except when you ask us to help with a problem or when the law requires it.

Children

Basket Pal is a household tool and is not directed at children. We don’t knowingly create accounts for children under 15. If you believe a child has given us personal data, please contact us and we will delete it.

This website

This website uses no cookies, no analytics and no advertising trackers. Its fonts are served by Bunny Fonts, which does not log visitors’ IP addresses. Like any website, our hosting provider may keep standard server logs (such as IP address and pages requested) for a short time for security purposes.

When you use the contact form, your name, email address and message are delivered to us through Formspree. We use them only to answer you.

The invitation and email-confirmation pages only hand you over to the app: the invite code in the link is passed to Basket Pal on your iPhone, and the pages store nothing.

Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change is significant — for example a new kind of data or a new use of it — we will also tell you in the app before it takes effect.

Contact

Questions or requests about your data? Use our contact form and choose Privacy & data. We answer in English or French.