Privacy policy

In short

Refismart stores your data on your device. You do not need an account. Where there are exceptions and who still gets to see something is set out below.

• Recipes, pantry, shopping lists, week plan and budget live on your device. We cannot see them.
• The app reads receipts right on the device. The image is not uploaded anywhere.
• Backup and sync run through your own iCloud, the Nextcloud connection through your own server. Both are optional.
• When you scan a barcode, the app asks Open Food Facts about the product. The request carries the barcode number.
• The free version shows ads from Google AdMob. Whether they may be personalised is your choice, and you can change it at any time.
• We use no analytics SDKs. The website uses neither cookies nor tracking.
• Signing up as a tester is a mail to us. What Apple and Google receive from it is under Signing up as a tester.

Controller

The controller for the processing of personal data under the GDPR, for the Refismart app and for the website refismart.app, is:

We are not required to appoint a data protection officer. Questions about data protection are answered directly at this address.

This policy applies to the Refismart app on iPhone, later also on Android, and to the website refismart.app.

What stays on your device

Everything you create in the app is stored locally:

• recipes, cookbook and favourites, including the photos of your dishes
• pantry with expiry dates and shelves
• shopping lists
• week plan
• budget and recorded spending
• photos and PDFs of receipts, for as long as you keep them

None of this reaches us. We currently run no servers holding app content, so we have no technical access to it.

The app only uses the camera when you open it: for receipts, barcodes, expiry dates on the pack and photos of your dishes. The images are analysed on the device.

The app schedules reminders on your device, for instance before something expires or when next week is not planned yet. Nothing runs through a server of ours for that.

You can change, export or delete every entry inside the app. Delete the app and the locally stored data is gone. Anything in your iCloud you delete in the app or in your iCloud settings.

iCloud, backup and Nextcloud

Daily backup

The app writes the daily backup to your private iCloud, into an area only Refismart on your devices can read. We have no access to it. Without an iCloud sign-in there is no backup.

Sync between your devices (Pro)

If you switch on sync, Apple keeps your Refismart data in step between your devices through your own Apple account. Here too the data lives in your private iCloud, not with us.

Apple is responsible for iCloud. What Apple processes is set out in Apple's privacy policy.

Nextcloud Cookbook (Pro)

If you connect your own Nextcloud, the app stores the server address and your credentials in your device's keychain. The connection runs directly between your device and your server. We are not involved, and the server is your responsibility.

Receipt scanner

Text recognition runs entirely on your device. The photo or PDF and the lines read from it stay there. None of it reaches us or any third party.

If the app does not read a receipt cleanly, you can choose to send it to info@refismart.app. We then process what you send us, that is the file, your email address and the time.

• Purpose: understand the error and improve recognition.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in recognition that works. You decide whether to send anything.
• Retention: until the analysis is done, twelve months at the most.

Please black out anything we do not need first. Item lines and prices are enough for the analysis.

Barcode scan with Open Food Facts

When you hold the camera over the barcode of a food item, the app reads the number on the device and then asks Open Food Facts for the product's name, size and category. Open Food Facts is a free food database run by a non-profit association in France.

The request carries the barcode number, an identifier of the app (name and version) and, as with any request on the internet, your IP address. No images or other content from the app go with it. The app keeps the answer on your device for up to 30 days, so the same barcode does not have to be looked up again.

• Purpose: showing the product for the scanned barcode and filling in the pantry form.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in providing the function you asked for. Without a scan there is no request.
• Recipient: Open Food Facts, France. What happens to connection data there is set out in Open Food Facts' privacy policy.

Recipe import from links

When you import a recipe URL, the app calls that page directly from your device, without going through a server of ours. Its operator sees the usual connection data, in particular your IP address and your device identifier. We have no influence on that; it is the same processing as opening the page in a browser.

Advertising with Google AdMob

The free version is partly financed by ads. They come from Google AdMob, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The test version shows no ads yet. From the App Store launch the following applies; with Pro the ads are gone.

Google processes, among other things:

• your advertising ID (IDFA on iOS, Advertising ID on Android)
• your IP address and the coarse location derived from it
• device and usage data such as device type, operating system and language
• your interaction with the ad

Your decision

Before the app shows personalised ads, it asks you. On the iPhone, Apple also shows its own prompt ("App Tracking Transparency"). Without your consent you only see non-personalised ads. Google processes data for those too, but considerably less and without a profile across apps.

You can change your decision at any time, in the app settings and in your device's system settings. That is also where you can reset or switch off the advertising ID.

• Legal basis: your consent under Art. 6(1)(a) GDPR. For non-personalised ads we rely on Art. 6(1)(f) GDPR, our legitimate interest in financing the app.
• Recipients: Google Ireland Limited and affiliated companies.
• Third country: Google also processes data in the United States, based on the EU-US Data Privacy Framework and standard contractual clauses.
• Withdrawal: at any time with effect for the future, without the app ceasing to work.

More in Google's privacy policy and in the overview of how Google uses data from apps and sites.

Pro subscription and purchases

You buy Refismart Pro through the App Store, later through Google Play. Apple and Google handle the payment. We never see payment data, only aggregated sales reports with no link to a specific person.

The app checks on the device whether your subscription is active, using the purchase confirmation of your store account. There is no server of ours for that.

Statistics and crash reports

We use no analytics SDK: no Firebase, no Crashlytics, no telemetry of our own. We only see the aggregated figures Apple provides in App Store Connect and Google in the Play Console, meaning downloads, crashes and ratings without any link to a person.

Whether your device sends crash reports to Apple or Google is your choice in the system settings.

Getting in touch

If you write to us, we store what you send, meaning your address, the content and the time. We need it to handle your enquiry and keep it for six months in case of follow-up questions. We delete it afterwards unless a statutory retention obligation says otherwise. Without your consent we pass none of it on.

• Purpose: handling and answering your enquiry.
• Legal basis: Art. 6(1)(f) GDPR, legitimate interest in communication. Where it concerns using the app or pre-contractual questions, Art. 6(1)(b) GDPR.
• Retention: six months from the last message.

Everything about the app and the test programme has its own mailbox: info@refismart.app. Everything else, including the exercise of your rights, goes through office@refismart-factory.com.

Both mailboxes are hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Switzerland, the same provider as the website. Mail is not encrypted all the way in transit, so please do not send us anything particularly sensitive.

Signing up as a tester

The "Sign up as a tester" buttons on the website open your own mail app with a prepared message to info@refismart.app. There is no form, and nothing is sent to any third party. The mail only goes out when you send it yourself. Until then we know nothing about it.

The mail asks for three things: which platform you want to test on, the email address for the invite and which language you use the app in. It ends with a sentence in which you agree to us storing these details. With the mail we also receive your sender address and the time it was sent. Anything else you write is up to you.

On iPhone the invite address has to be the one of your Apple ID, on Android the one of your Google account, because Apple and Google run their test channels through those accounts.

• Purpose: adding you to the test channel and sending you messages about the test.
• Legal basis: Art. 6(1)(a) GDPR, your consent. You give it by sending the mail.
• Retention: until the test programme ends. No later than three months after that we delete your details and the mail and remove you from the test channels at Apple and Google. The GDPR sets no fixed period. It requires that data is kept no longer than the purpose needs (Art. 5(1)(e) GDPR). The three months are the time in which we collect the last feedback.
• Withdrawal: an informal mail to info@refismart.app is enough. We then delete your details right away and remove you from the test channel.

Passing your address to Apple and Google for the test

To invite you, we enter your invite address into the respective test channel: TestFlight at Apple for iPhone, the closed testing group in the Google Play Console for Android. We pass on nothing but the address. From then on Apple and Google process it under their own privacy policies, which you find in the respective app.

From the test channels we receive whether you installed the app, crash reports and the feedback you submit through TestFlight or the Play Store. On Android, crash reports come without your name.

The contracting parties are Apple Distribution International Ltd. and Google Ireland Limited, both in Ireland. Both may transfer data to their parent companies in the United States, Apple Inc. and Google LLC. The basis for that is the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which both companies are certified.

This website

As soon as you open refismart.app, the server records your IP address and the start and end of the session. Without them a page cannot technically be delivered. The processing therefore rests on our legitimate interest in running the site reliably and securely, Art. 6(1)(f) GDPR.

refismart.app is a static website: no cookies, no tracking, no analytics and no ad networks. There is no contact form, so we process no input from you here.

Besides IP address and time, the host's server logs hold the file requested, the amount of data transferred, the browser identification and the referrer. They serve secure operation and troubleshooting and are not combined with other data.

• Host: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias, Switzerland
• Log retention: at least 7 days, after which they are deleted automatically
• Legal basis: Art. 6(1)(f) GDPR, legitimate interest in secure operation.

The servers are located in Switzerland. The European Commission has found Switzerland to provide an adequate level of data protection, so this transfer needs no additional instrument under Chapter V GDPR.

The page follows your system's light or dark setting. If you switch it by hand at the top right, your browser remembers that one choice locally (localStorage, key "theme", value "light" or "dark"). It does not leave your device, we cannot read it, and it serves only the display you asked for. It is not a cookie and needs no consent banner. You can delete the entry at any time through the site data in your browser settings.

Fonts and external services

The typefaces Oswald and Source Sans 3 are stored as files on the same server as the page and are loaded from there. No connection to Google Fonts or any other font service is made. The same holds for images, icons and stylesheets. The site embeds no map services, video players, social media elements or font CDNs.

The Instagram link in the footer is an ordinary link. It loads nothing. A connection to Instagram is only made once you click it.

Who else receives data

Apple and Google may transfer data to the United States, see Advertising and Signing up as a tester. There are no other recipients. We do not sell data.

App privacy and data safety

This overview matches the declarations in the App Store ("App Privacy") and on Google Play ("Data safety").

Data safety

• App data sits in the app's protected storage area and is covered by your device encryption.
• Nextcloud credentials live in the system keychain, not in plain text inside the app.
• Outbound connections run encrypted over TLS only.
• We currently run no servers holding your content.

Your rights

For the data we hold about you, you generally have these rights:

• Access to what we have stored about you (Art. 15 GDPR)
• Rectification of incorrect details (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Portability of your data (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR) and withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Because your content lives on your device and in your iCloud, you exercise these rights there directly: change, export, delete. For anything we hold, which mainly means emails, write to office@refismart-factory.com. We answer as quickly as we can, within one month at the latest.

If you suspect that the processing of your data breaches data protection law, get in touch with us. You are also entitled under Art. 77 GDPR to lodge a complaint with the Austrian data protection authority.

Children

Refismart is aimed at adults. We do not knowingly collect data from children. If you believe something has reached us that came from a child, write to us and we will delete it.

Changes and what is coming

We update this policy when features or recipients change. The version with the date at the top is the one that applies. The app shows you a new version on its next launch. If a change needs your consent, we ask for it first.

Planned are an optional Refismart account, sharing prices with other users, a marketplace and sharing with your household. For some of these, data would for the first time live on servers we run or commission. Before any of these features arrives, we extend this policy. Whether you use them is up to you. Without an account the app keeps working as it does now.