Privacy policy

This policy describes how Cartomi processes information when you use the website and app. It reflects the current technical implementation.

Data controller

The data controller for Cartomi is available on request. Contact us at the email below if you need legal details about the controller.

What data we process

For anonymous use we create a device identifier so your session and lists can work. If you sign in, we process your email address. Lists, items, memberships, and invite tokens are stored so sharing and sync work. For login and invites we may process technical data such as IP for security (e.g. one-time links).

Purpose

We process data to provide the grocery list, sync across devices and participants, send login and invite emails, and secure the service.

Storage

Lists and related data are stored in our database. Your device also keeps local copies (including IndexedDB and local storage) for speed and offline use. Exact retention periods are available on request until published.

Cookies and local storage

We use a session cookie (grocery_session) when you are signed in, and a language cookie (grocery_locale). The app also uses localStorage, sessionStorage, and IndexedDB for device id, preferences, onboarding flags, and offline data. We do not use product analytics cookies.

Processors

The service is hosted by our hosting provider. Transactional email is sent via our email provider (SMTP/SES). The website loads the Inter and Space Grotesk fonts from Google Fonts. We do not collect product analytics in the app.

Your rights

You can delete individual lists in the app. You can request access, correction, or deletion of personal data by contacting us. Note that self-serve account deletion is not yet available in the app.

Privacy contact

Email hello@cartomi.app. Contact