Privacy policy
Version 3, effective 22 October 2026
This is a translation provided for information only. The French version prevails.
Data controller: Digression SAS (see the legal notice). Contact: hello@shopinata.com.
What we collect, and why
| Data | Why | Legal basis | How long | Who sees it |
|---|---|---|---|---|
| First name or nickname, avatar | Your account; recognising you in a group | Contract | As long as the account exists | The members of your groups; the person who opens your invitation link |
| Email (only if you secure your account) | Recovering your account, inviting by email, notifying you (changes, deletion) | Contract | As long as the account exists | Only us |
| Sign in with Google (if you choose it, once it is offered): Google sends us your email, your Google identifier and your first name | Creating or recovering your account without an email code | Contract | We only keep the email and the fact that Google confirmed it; the identifier and first name sent are not stored | Only us |
| Sign in with Apple (on iPhone, if you choose it): Apple sends us your email (or a relay address @privaterelay.appleid.com if you hide your email) and your Apple identifier | Creating or recovering your account without an email code | Contract | We only keep the email (or the relay address) and the fact that Apple confirmed it; the identifier sent is not stored | Only us |
| The aisle order you set for a store | Showing your list in your order each time you shop there; offering others the most chosen order for that store (an anonymous average: the store and the order, never your identity) | Contract (your order); legitimate interest (the anonymous average, with no personal data) | Your order: as long as the account exists; the average: no limit, it contains nothing personal | Your order: the members of the group; the average: everyone |
| Account identifier and login token (random) | Keeping you logged in | Contract | As long as the account exists | No one |
| App language | Writing to you in your language (for example the notice before an inactive account is deleted) | Contract | As long as the account exists | Only us |
| Year of birth and gender (optional, "And you?") | Checking the age required by the law of your country before some questions and for the panel; attached to your receipts only if you take part in the panel | Consent (you give them if you wish, and can erase them) | As long as the account exists, or until you erase them | Only us, never the members of your groups |
| Household (optional, "Who lives with you?"): how many at the table, children (none, 1, 2 or more), dog or cat | Setting recipe portions; later, if you accept promotions, suggesting suitable products (snacks, pet food) | Legitimate interest for portions; your "promotions" consent for products | As long as the group exists; can be cleared at any time in Settings | Members of the group |
| Meals and allergies (optional): diet (vegetarian, vegan, no alcohol, no pork, halal, kosher) and the household's allergies or intolerances, with a first name if you give one. An allergy concerns health; "no pork", "halal" or "kosher" may reveal a religious belief: this is sensitive data (GDPR, Article 9) | Flagging or hiding recipes that don't suit you, warning you before adding a recipe to your list, showing halal or kosher shops | On your phone only: nothing is sent to us. On our servers: your explicit consent (GDPR, Article 9(2)(a)), asked separately, box not pre-ticked | Until you withdraw your consent; withdrawing immediately deletes the copy on our servers (your phone keeps your choices) | You; a member of your group only if you choose to show it to them, person by person |
| Acceptance of the terms, answers to privacy questions (date, version, phone or web) | Proving your choices | Legal obligation (GDPR art. 7.1) | As long as the account exists | Only us |
| Lists, items, chosen stores, groups | Making the app work | Contract | As long as the group exists; finished lists: 2 years (30 days if history is turned off) | The members of the group |
| Shopping log: item added, ticked or removed, list finished, store and store's town. It carries a random identifier, never your name or email: it is pseudonymised personal data, protected as such. It is only kept if history is turned on. | a) Your history and your regular items. b) Understanding how the app is used, to improve it. c) Only if you said yes to "Help keep Shopinata free": overall figures, calculated over at least 100 households. | a) Contract (can be turned off). b) Legitimate interest (you can object). c) Consent | 2 years, then deleted; deleted with your account | Only us, as overall figures |
| Loyalty cards and gift cards (store, number, format; for a gift card: amount, date, code) | Showing them at the checkout; sharing them if you choose | Contract | Until the card or the account is deleted | You, and the members of the groups you share it with (not during a temporary share) |
| My recipes: text, photo of the dish (if you add one), who can see it (just me, my close ones, everyone) | Finding your recipes on all your phones; showing them to your close ones if you choose | Contract | As long as the recipe or the account exists; a replaced photo or a deleted recipe is erased | You; members of your groups if you choose "My close ones" or "Everyone" |
| Recipe suggested to Shopinata ("Everyone"): text, photo of the dish (required), the 3 commitments ticked (date and version), nickname chosen when you suggest it, app avatar (a drawing, never a photo) | Publishing the recipe with your nickname and your avatar ("suggested by …") | Contract (your suggestion, confirmed by the box ticked at that time). After you remove your name or delete your account: legitimate interest (keeping the recipe published) | Nickname and avatar: as long as the recipe is published with your name. After you remove your name or delete your account, the recipe stays published without nickname or avatar | Public: everyone, in the app, on shopinata.com and in search engines |
| Receipts ("My spending", if you turn it on): photo or PDF of the receipt, items, prices, total, store, date and time | Showing you your spending | Contract | Kept only on your phone, until you delete them. The receipt is read on the phone. We do not receive your receipts (except shared prices and the panel, below). We do not back them up and they are not in your data download: reinstalling or changing phone erases them, unless you export them. | Only you |
| Shared prices from your receipts: for each item, name as printed, aisle, price, quantity, currency, day (without the time), retailer, store and phone country | Building prices per store to help everyone compare | Legitimate interest, set country by country: on by default where the law allows it, and you can stop it with one tap in settings. In Canada (Quebec rule) and if your country is not known: consent, asked after a receipt (at most once a month). | 2 years, then deleted. They arrive over a connection linked to your account, but are stored without your identifier, the time or the whole receipt. To limit abuse, a one-day fingerprint of your account is kept for 2 days. | Us; later, everyone, as prices per store, with no link to you |
| Shopinata panel (only if you join it, adults only): full receipts (items, prices, total, store, day and time), year of birth, gender if you gave it, country, number of members of your groups (the largest) | Consumer studies sold to brands and retailers, always as figures grouped over many people, never your name or a single receipt | Consent, asked separately, with the full text; you can leave at any time | 2 years, then deleted. Your receipts are linked together by a code computed from your account, without your name or email: this is pseudonymised data, not anonymous. Leaving the panel immediately erases everything that was sent. | Only us; buyers of studies only receive grouped figures |
| Location (if you allow it, only while the app is open) or typed town | Finding nearby stores and their opening hours | Consent (phone permission) | Last location kept on your phone. Sent to our servers with each search, without being stored there. | The geocoding services below, without your identity |
| IP address | Security (limiting abuse); guessing your town if you have not given your location | Legitimate interest | Technical logs: 7 days | Us and Cloudflare |
| Crash reports: phone model, version, error, account identifier (random). Email addresses and long numbers (card, phone) found in an error message are removed before sending. | Fixing bugs | Legitimate interest | 90 days at most | Us and Sentry |
| "Write to us" messages and reports (text, email if you give it, phone model, version) | Answering you, fixing things | Legitimate interest | 3 years after the last exchange; deleted with your account | Only us |
| Email of a person you invite | Sending them the invitation | Legitimate interest | 14 days (validity of the invitation) | Only us |
Only the first name is required, and a nickname is enough. Everything else is optional.
- The email addresses of invited people are only used for the invitation.
- A recipe photo may show your kitchen or your hands: we may crop or replace it before publishing the recipe.
- We never sell the data of a person or a household. If you say yes to the question "Help keep Shopinata free", only overall figures may be shared. They are made anonymous using a documented method in line with the French data protection authority's (CNIL) recommendations: grouping, a minimum number of households per figure, removal of rare cases and a re-identification risk check before any sharing.
- The panel follows the same rule, with your separate consent: the studies sold only contain grouped figures, calculated the same way. No buyer receives your receipt, your panel code or any data that could identify you.
- We do not infer sensitive information (health, religion…) from your lists or receipts. For shared prices, we only keep the item name, the price and the store, never the whole receipt.
- Meals and allergies: this information is never used for advertising or promotions, never sold or counted in aggregate figures, and does not appear in our administration tools. When someone joins your group, we first ask whether you want to show it to them: until you answer, they see nothing. You can change this for each person in Settings › Meals and allergies.
- Flagged allergens and the labels "halal compatible" or "kosher compatible" are deduced from recipe ingredients: they are indicative and replace neither reading the label nor a certification.
- A recipe suggested to everyone is reviewed by our team before any publication. Until it is accepted, only you and your close ones can see it. If we refuse it, you see the reason and can appeal in the app.
Who processes your data for us
- Cloudflare, Inc. (hosting, database, emails), United States, certified under the Data Privacy Framework;
- Sentry (Functional Software, Inc.), United States, data hosted in the European Union;
- Google (Google Ireland Ltd), only if you choose to sign in with Google: it confirms your email address to us;
- Apple (Apple Distribution International Ltd, Ireland), only if you choose to sign in with Apple on iPhone: it confirms your email address (or a relay address) to us;
- geocoding services: they receive a location or a town name, never your identity: Base Adresse Nationale (French State), Photon (Komoot, Germany), OpenStreetMap Overpass servers (Germany).
Transfers to the United States rely on the EU-US Data Privacy Framework and, failing that, on the European Commission's standard contractual clauses.
Your rights
You can access your data, correct it, get a copy, have it deleted, restrict its use, object to the usage log (b) and withdraw your consent at any time, as easily as you gave it. On a recipe you suggested that is published, you can remove your name yourself in the app: your nickname and your avatar disappear (article 4a of the terms of use). The simplest way: Settings › My account (view, download, delete) and Settings › Privacy (your choices). Or write to hello@shopinata.com. We answer within one month, or within three months at most for a complex request, letting you know. You can complain to the CNIL, the French data protection authority (cnil.fr).
If your account has no email address
Your account is only linked to your phone. We know neither your surname, nor your email, nor your number.
- Exercise your rights from the app: that is where we know the account is yours. By email, we cannot check it. We will ask you to use the app or to add your address to it.
- Lost phone or uninstalled app: we can neither give you back your account nor know that it is yours (article 11 of the GDPR). It is deleted automatically after 12 months without use. The lists of your shared groups stay with the other members.
Inactive accounts and deletion
Inactive accounts: an account without an email address is deleted after 12 months without a connection, with no possible notice. An account with an email address is deleted after 3 years without a connection, after a notice email sent 30 days before, in the language of your app. Just open the app before the date given to keep it. We never delete an account whose notice could not be sent.
Finished lists: deleted 2 years later (30 days if history is turned off), even if nobody opens the group any more.
Deletion: from the app, your account is deleted immediately. It disappears from our backups at the latest 30 days later. What remains: the lists of your shared groups (your first name becomes "Former member" there), the recipes you suggested that are published (without your nickname or avatar) and, only if the law requires it, some technical data for the legal period. See also: delete your account.
Advertising and promotions
- Today, Shopinata shows no advertising and does not use your data to choose offers.
- We use no advertising identifier (Apple or Android) and do not track your activity in other apps or websites.
- If one day we offer promotions picked for you based on your shopping, we will ask you first, with a separate question, never ticked in advance. It will say which data is used, including your history already recorded. It may also invite you, with no obligation, to give your year of birth, your gender and your household make-up. If you say no, Shopinata stays free and you will see non-personalised promotions.
- These promotions will never be chosen from sensitive information (health, pregnancy, religion, sex life), nor from your loyalty card numbers, and will never be personalised for anyone under 18.
- Promotions on alcoholic drinks will only be shown to people who have said they are 18 or older.
- We will never pass to a retailer or brand any data that could identify you.
Security
Exchanges are encrypted (HTTPS). The content of your lists cannot be viewed in our administration tools.
Minors
Shopinata is not intended for children under 13, and we do not knowingly collect their data. If we learn that an account belongs to a child under 13, we delete it. Between 13 and the age at which the law of your country lets you consent alone to the processing of your data, a parent's consent is required, for example when a parent invites their child into the family group. This age is applied country by country: for example 13 in Belgium, Denmark, the United Kingdom and the United States, 14 in Spain, Italy, Austria and Canada, 15 in France, 16 in Germany and the Netherlands, and 16 when your country is not known. Below that age, Meals and allergies stays on your phone: nothing is sent to our servers. We only ask consent questions (such as "Help keep Shopinata free") to people who have reached that age: if you have not given your year of birth, the "Yes" button asks you to confirm it ("Yes, I'm 15 or older"). The panel is reserved for adults in their country; we check this when you join and with every receipt sent. We will never show personalised advertising to anyone under 18.