Cartdock privacy policy

1. Who is responsible for the data

Data controller: Siarhei Mishchanka, a natural person, Koposche aviatsonyaya 13, 247, Belarus, e-mail: support@cartdock.app. In this policy, “we” and “our” refer to the controller.

Questions and requests about your data: privacy@cartdock.app.

2. In short

• Without your consent to AI receipt reading, receipt photos never leave your device.
• Receipt photos are deleted from the service 30 days after they are read.
• The app has no advertising. Usage statistics (Google Analytics for Firebase) are sent only with your consent; crash reports (Firebase Crashlytics) are sent unless you turn them off (section 3.11).
• Data export, account deletion and consents are in the app: Profile → Data (the “My data” screen).

3. What data we process

3.1. Installation and account

• On first launch the app creates a random installation identifier and sends it to the service together with the platform (Android or iOS). This creates an anonymous account with no name and no email. Access tokens are kept on the device in the system's secure storage, and on the service only as hashes.
• If you sign in with Google or with an email and password, sign-in is performed by Firebase Authentication (Google). We store the sign-in method, your Firebase identifier and your email address. When you sign in with Google, we receive and store the name on your Google profile; we do not store its photo or other profile data. You may enter a first and last name for shared lists yourself on the account screen; this is optional. Your password passes through our service to Firebase Authentication and is not stored by us.
• Emails that confirm your address or reset your password are sent by Firebase.
• When you sign in, data created on the device before signing in moves to your account.
• To protect accounts from password guessing we count sign-in attempts; the email address is kept for this only as a hash, and the records are deleted after one day.

3.2. Shopping lists

• Lists are stored on your device. When you share a list (this needs an account), it is also stored on the service: its title, its lines (name, quantity, unit, note, aisle, bought mark, who added it), and its members and their roles.
• Members see each other by name: the first and last name you entered yourself, otherwise the name on your Google profile, otherwise the part of the email address before the “@”. The full address is never shown. Guests appear under an alias (an animal name).
• Removed lines of a shared list are permanently deleted from the service after 30 days.
• If the owner deletes a shared list or deletes their account, the list is deleted from the service, together with the lines the members added. When a member loses access to a list (for example, the owner deleted the list or their own account, or removed this member), a copy of the list stays on the member's device: it no longer updates and is not kept on the service. The member can delete the copy.

3.3. List links

• A link contains a random key; the service stores only its hash. Anyone who has the link can view the list while the link is valid.
• A link is either “View only” or “Take part” (taking part happens in the app). It lasts 24 hours, 30 days (the default) or has no end date.
• Through a link one can see the list title, the owner's name (chosen as for members; anyone who has the link sees it), the lines (name, quantity, unit, aisle, bought mark), the link level, the time of the last change and when the link expires. Line notes, members, receipts and spending are not visible.
• Revoking a link closes it immediately and removes the guests and viewers who joined through it.

3.4. Receipts and photos

• Receipt photos stay on your device until they are sent, and they are sent only if you allowed “AI processing”.
• Photos that were sent are kept in private Supabase Storage (region eu-central-1, EU).
• A saved receipt is stored on the service: the shop, purchase date, currency, total, the lines with quantities, prices and categories, and the recognition result. If you link a receipt to a list, the service also keeps the identifier of that list (not its title or lines).
• If you note how much a list cost without a receipt, the service keeps this amount in your account: the amount, currency, day and the identifier of the list. Other members of the list do not see it.
• To notice a receipt sent twice, we compare photo hashes within your account.
• On Android, the receipt edges in a photo are found by a Google ML Kit model on the device itself. The photo is not sent anywhere, but after the first edge search the library sends Google technical information about how it works.
• If you report a problem with a receipt, we receive the problem type, your comment and a reference to the recognition job. No photos are attached to the report.
• We count how many receipts you scanned and how many assistant questions you asked in a month, for the monthly limits.
• The app matches store logos in the receipt list on the device. At most once a day, while the receipt list is open, it downloads the shared logo catalog and all its files from our site — the same set for every installation. The request contains no store names, receipt data or account data, so the site log does not show where you shop. The site sees the IP address and the time of the request.
• Store logos belong to their owners. To have a logo removed, write to privacy@cartdock.app.

3.5. Reading receipts with AI

• Receipts are read by OpenAI. OpenAI receives the images of the receipt pages and our instructions. We do not include your identifier, email or other account data in this request. The request is sent with response storage at OpenAI turned off (store=false). If the receipt lines are not in the app language and translation is on in Profile → Data → Data processing, OpenAI translates the item names into the app language in the same request. We keep both the translation and the name as printed on the receipt.
• When OpenAI is unavailable, the receipt is read by Anthropic instead. Anthropic receives the same images and instructions, also without your identifier, e-mail or other account data, and translates item names in the same way. Anthropic has no setting like store=false; how long it keeps requests is in section 6.
• For each call we keep service records without any receipt text: the model, duration, size, cost and recognition quality counts.
• Without consent no photos are sent. After you withdraw consent no new photos are sent, and photos already taken wait on the device.

3.6. Assistant

• In the app the assistant is called Rinka. Rinka is an AI, not a person: answers are written by a language model of OpenAI or Anthropic. We choose which one in the service settings, and the other one can stand in when the first is unavailable.
• When Anthropic writes an answer, it receives the same data that OpenAI receives as described below, also without your e-mail or name.
• When you ask the assistant a question, OpenAI receives the text of the question, the identifiers of your lists (not their contents), the number of recent receipts and a technical identifier of your account with us (no email or name).
• The model does not receive the contents of your lists or receipts, or your spending. To follow the conversation, OpenAI receives, together with your question, up to 6 earlier questions and answers from the same conversation — no more than 6,000 characters and only from the last 48 hours. Earlier answers may contain item names that Rinka itself suggested. Questions from other conversations are not sent. The request is sent with response storage at OpenAI turned off (store=false).
• The question and the answer are kept on the service for 48 hours, then their text is deleted. A record that a question was asked remains, for the monthly limit.
• For each answer we keep service records without the text of the question or the answer: the model, duration, answer size and cost.
• The assistant works only with the “AI processing” consent — the same one receipts use: without it, or once it is withdrawn, no question is sent and an answer still being written is stopped. Data is sent only when you ask a question.
• Under each Rinka answer there is a “Report” button. If you report an answer, our service receives the answer, your question to it, the list Rinka offered in it (if any), the reason you chose and your comment (up to 500 characters); the report is linked to your account. While the service still keeps its own copy of the question and the answer (48 hours), it stores its copy instead of the one from your device. The service adds the model, the instruction version, the plan and the platform (Android or iOS) the answer was written with, and how the answer ended (completed, cut off or failed). The report does not include the contents of your lists or receipts, and neither OpenAI nor Anthropic receives it.
• We use reports to check answers and improve Rinka. The texts of a report — the question, the answer, the offered list and the comment — are deleted 30 days after we receive it; the reason and the information about the answer stay until the account is deleted, so that reports can be counted. Without a connection, a report waits on the device and is sent later; once the service has answered, the device keeps only its status. A report does not need the “AI processing” consent. You can object to this processing at privacy@cartdock.app; we will then delete the report.

3.7. Voice input

• You can dictate a question to the assistant. Speech is recognised by the speech recognition service of Android or iOS. Depending on the device, this happens on the device itself or on the servers of the system provider (Google, Apple) under its terms.
• The app receives only the recognised text and does not keep the recording. The microphone is on while the screen says “Listening”; you can stop the recording with the button.

3.8. What stays on the device

• Spending totals and purchase planning are calculated on the device from your receipts, lists and amounts noted without a receipt. The service keeps only the receipts and amounts described in section 3.4.
• Reminders are local notifications of the device, with no server and no mailings.
• Your consent answers are stored on the device.
• When you sign out, the personal lists of your account, the copies of shared lists you no longer have access to and the receipts of your account with their photos are not deleted from this phone but hidden: the app keeps them with the account identifier only (no e-mail address) and returns them when you sign in to the same account on this phone. Receipts not yet saved to the account get there only after that sign-in. A guest and other accounts on this phone do not see them. Deleting the account in the app on this phone erases them; the hidden lists and receipts of other accounts on this phone stay.
• On Android, the system makes a backup of app data in two cases only. The first is a cloud backup in your Google account: only if backup is turned on and Android can encrypt the backup on the phone, which needs a screen lock (PIN, pattern or password). If the backup cannot be encrypted, app data is not included in the cloud backup. The second is a transfer from your old phone to a new one when you change phones. Android 7 and 8 do not check backup encryption, so on them we do not promise that the cloud backup is encrypted.
• The backup holds your lists, receipts without photos, conversations with Rinka, the app language and settings, including your consent answers and, if you are signed in, the email address and name of your account. It also holds the lists and receipts (without photos) hidden on this phone at sign-out, including those of other accounts: with the account identifier, without the e-mail address. The backup does not hold access tokens, the installation identifier, receipt photos or reminders. After a restore, sign in again and turn reminders on again.

3.9. Service logs

• Each time the app contacts the service, a log record is kept: the IP address, the request method and address without parameters, and the response code. Link keys and temporary upload addresses are replaced with a marker in our log.
• The Google Cloud Run platform also keeps its own request log. It stores the full request address — including the link key when the app opens a list through a link. These logs can be seen only by people with access to the project's logs. Log retention: 30 days.
• The service also records on which days your account contacted it and from which platform (Android or iOS), to count active users. These records are deleted after 35 days; reports keep only total numbers without accounts. The last such day is also kept in the record of the device until the device is deleted. These records do not depend on the usage statistics choice (section 7).

3.10. The shared-list page in a browser

• The page runs on the Cartdock website (Google Cloud Run, region europe-west1) and loads the list from Supabase (region eu-central-1): the link key is sent in the request body, not in the address. Changes arrive through Supabase Realtime as a signal with no list data. Requests to /s/ pages are excluded from the platform request log. If a page fails to render, the container error log may retain the full address, including the link key in the /s/ path, for 30 days.
• List data is not saved in the browser.
• Visit statistics (Google Analytics 4) are turned on only if you press “Yes” in the question on the page. Until then the page does not contact Google. After “Yes”, Google receives events — page opened, the “Open in Cartdock” button and a Google Play or App Store button pressed, list saved as TXT or CSV, link no longer valid — with the platform type, file format or reason. The link key, the list title and lines and the owner's name are not included, and the page address is replaced with a generic /s/. Google Signals and advertising features are off.
• This policy page uses no analytics and no requests to other sites; the only cookie of the website is described in section 9.

3.11. Crash reports and usage statistics

• Android and iOS send crash reports. Only Android sends usage statistics. Debug builds send neither.
• Crash reports are on unless you turn them off: the “Send crash reports” box on first launch, or later Profile → Data → Data processing → “Crash reports”. If the app crashes, a report goes to Firebase Crashlytics (Google): where in the code the app failed, the error type and message, the time of the crash, the app version, the device model, the system version, the amount of memory and storage, whether the device is rooted, and a random Crashlytics installation identifier. To count sessions, Firebase also receives a random Firebase installation identifier and the time the app was on screen.
• A crash report does not include your account identifier, your e-mail address, the contents of your lists or receipts, or your questions to Rinka. The error messages of our code contain no such data.
• Without a connection, a report waits on the device and is sent at the next launch. If you turn crash reports off, reports not yet sent are deleted from the device at the next launch.
• Usage statistics (Google Analytics for Firebase) are off until you allow them: the “Allow usage analytics” box on first launch, or later Profile → Data → Data processing → “Usage statistics”. With your consent, Google receives events that the library records by itself — the first launch, the start and length of sessions, app and system updates — with the app version, the device model, the system version, the approximate region and a random app instance identifier. We send no events of our own, no screen names, no account identifier and no advertising identifier; advertising features are off.
• When you withdraw consent, statistics stop at once and the app resets its statistics identifier. Crash reports and statistics are not linked to your account: they are not in the data archive and are not deleted with the account; Google deletes them after the periods in section 6.

3.12. Subscriptions

• The Lite and Plus plans are bought in the app as subscriptions through Google Play or the App Store, and only after you sign in. You pay the store: it processes the payment under its own terms and privacy policy, and we never receive your card or other payment details.
• To check purchases we use RevenueCat. The app and the store send RevenueCat the identifier of your account with us (no e-mail or name), the product, the store, the store’s currency and locale, and the purchase record. RevenueCat keeps the history of purchases, renewals, cancellations and refunds of your account. RevenueCat receives this account identifier when you request subscription offers after signing in, even before a purchase. We also use the purchase history in RevenueCat to view subscription statistics.
• Our service asks RevenueCat about your subscription and keeps the plan, the product, the store, the date of purchase, the start and end of the current period, whether it renews, a payment problem and a refund. With these the service gives your account its plan.
• Deleting the account or the app does not cancel a subscription in the store. How to cancel it is described on the account deletion page.
• The price, renewal, cancellation, withdrawal and refunds of subscriptions are described in the terms of use. When you ask Apple for a refund of a subscription bought in the App Store, our service tells Apple, through RevenueCat, whether the subscription was delivered; it sends nothing from your lists, receipts or questions. The basis is our legitimate interest in a correct decision on the refund (Art. 6(1)(f) GDPR); you can object at privacy@cartdock.app before you ask Apple (terms of use, section 6).

4. Who receives the data and where it is processed

• Google Cloud Run — our service, region europe-west1 (EU).
• Google Cloud Run — the Cartdock website: the home page, the shared-list page and this page.
• Supabase — database, storage for photos and export archives, updates of the web page; region eu-central-1 (EU).
• Firebase (Google) — Authentication: sign-in and emails; data is processed only in the United States. The transfer basis is Google LLC’s certification under the EU-U.S. Data Privacy Framework (an adequacy decision, Art. 45 GDPR); if it stops applying, the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in Google’s data processing terms apply.
• OpenAI Ireland Ltd. (Ireland) — a processor acting for us: reading and translating receipts, Rinka’s answers. OpenAI may transfer data to its affiliates and sub-processors outside the EEA, including the United States, on the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) or an adequacy decision (Art. 45 GDPR). You can request a copy of these terms at privacy@cartdock.app. OpenAI does not use this data to train models and keeps it for up to 30 days in abuse-monitoring logs; the store=false setting does not change this period.
• Anthropic Ireland, Limited (Ireland) — a processor acting for us: reading and translating receipts when OpenAI is unavailable, Rinka’s answers. Anthropic may process data outside the EEA, including in the United States, on the basis of the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in its data processing addendum, which is part of Anthropic’s Commercial Terms. Anthropic does not use this data to train models.
• Firebase Crashlytics (Google) — crash reports from the Android and iOS apps; Google processes them on its global infrastructure, including in the United States. The transfer basis is the same as for Firebase Authentication: the EU-U.S. Data Privacy Framework, otherwise standard contractual clauses.
• Google Analytics for Firebase (Google) — usage statistics from the Android app, only after your consent; the same transfer basis.
• RevenueCat, Inc. (United States) — a processor acting for us: checking subscription purchases and keeping their history. The transfer basis is the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR) in RevenueCat’s data processing addendum.
• Google Play, App Store — selling subscriptions and taking payment, under the terms and privacy policies of Google and Apple.
• Google Analytics — only on the shared-list page and only after your consent.
• Google or Apple — speech recognition by the device system, only when you dictate.

Our service calls no other external services.

People in Switzerland: the same recipients and countries apply. Switzerland recognises the EU and EEA states as giving adequate data protection, and the United States only for companies certified under the Swiss-U.S. Data Privacy Framework, such as Google LLC. Transfers to RevenueCat in the United States, and transfers by OpenAI and Anthropic outside the EEA, rest on the European Commission’s standard contractual clauses with the amendments for Swiss law (Art. 16(2)(d) of the Swiss Federal Act on Data Protection, FADP).

5. Legal bases

• Consent (Art. 6(1)(a) GDPR) — reading and translating receipts with AI, Rinka’s answers and conversation memory, visit statistics on the shared-list page.
• Performance of a contract (Art. 6(1)(b) GDPR) — account and sign-in, sync and shared lists, storing receipts, export and deletion.
• Legitimate interest (Art. 6(1)(f) GDPR) — logs, protection against password guessing and abuse, monthly limits, counting active users, reports about Rinka’s answers. Our interest is the security of the service, a fair split of free limits, knowing how many people use the service, and finding and correcting harmful or wrong answers of Rinka.
• Legitimate interest (Art. 6(1)(f) GDPR) — also detecting abuse, account restrictions, the records of our decisions and the code of an e-mail address after the account is deleted (section 6, section 12). Our interest is that the free limits and the AI are not used up by one person or a program, and that deleting an account does not lift limits or restrictions. To detect abuse we use only data we already keep, and we keep the e-mail address only as a code.
• Consent (Art. 6(1)(a) GDPR) — also usage statistics in the app (section 3.11).
• Legitimate interest (Art. 6(1)(f) GDPR) — crash reports from the app. Our interest is finding and fixing crashes of the app. A report holds no account data, and you can turn reports off at any time (section 3.11); turning them off is your objection (Art. 21 GDPR).
• Performance of a contract (Art. 6(1)(b) GDPR) — also subscriptions: checking a purchase and giving your account its plan (section 3.12).

6. How long we keep data

• Receipt photos — 30 days after they are read, or less once a deleted receipt can no longer be restored.
• A deleted receipt can be restored for 7 days; 30 days after that it is deleted permanently.
• Assistant questions and answers — 48 hours.
• Requests at Anthropic — deleted within 30 days; if a request is flagged for breaking Anthropic’s usage rules, it is kept for up to 2 years, and the scores of its safety checks for up to 7 years.
• Service records of AI calls for receipts and Rinka, without any text — until the account is deleted.
• Counters of scans and questions for the monthly budget of each plan, not linked to an account — the current and the previous month.
• Crash reports — 90 days at Google (Firebase Crashlytics); a report not yet sent is deleted from the device once you turn reports off.
• Usage statistics events — 2 months at Google (Google Analytics for Firebase); reports keep only total numbers.
• Subscription records on our service and at RevenueCat — until the account is deleted; when the account is deleted, our service also deletes your record at RevenueCat. The store keeps its own purchase records under its terms.
• Reports about Rinka’s answers — the texts for 30 days after we receive the report; the reason and the information about the answer until the account is deleted.
• Removed lines of shared lists — 30 days.
• Export archive — 3 days; the download link works for 15 minutes and is issued again on request.
• Sign-in tokens — up to 90 days; their records are deleted 30 days after they expire.
• Sign-in attempt counters — one day.
• Logs — 30 days.
• Activity-day records — 35 days.
• The record of a carried-out or cancelled account deletion (the identifiers of the account and the device, the status of the request and the times) — 12 months after it was carried out or cancelled; when the service deleted a guest's data by itself — 35 days.
• Data without an account (guest) — while the app contacts the service; after 14 days without contact the service deletes it in the same way as a deletion you ask for. The data on the device stays.
• After the deletion of an account with an e-mail address — until the end of the month plus 1 day: a code of that address (an HMAC with a secret key; the address itself is not stored) and the number of scans and questions to the assistant in that month, so that a new sign-up with the same address in that month does not start the monthly limits over.
• An account restriction (section 12) — while it applies and 30 more days after it ends; if we lift it earlier or the account is deleted, the record is deleted at once.
• Records of our decisions about restrictions — 12 months from the decision; after the account is deleted they stay without its identifier; for a sign-up block the record has the first 8 characters of the address code.
• A sign-up block — a code of the e-mail address (an HMAC with a secret key) — up to 6 months from our decision; after the deletion of an account suspended for breaking a rule, 6 months from the deletion or until the suspension ends if that is later.
• Account, receipts, lists and problem reports — until you delete them or delete the account.
• Amounts noted without a receipt — until the account is deleted. An amount you delete is marked as deleted and leaves the archive, but its record stays until the account is deleted, so that an older change from another device cannot bring it back.

The periods above say when data becomes due for deletion. Our service then deletes it with a service task that runs every 10 minutes while the service is running. When nobody uses the service, it stops, and the task runs when the service starts again, so data can be deleted later than its period ends. Logs are deleted by the Google Cloud Run platform itself.

7. Consents

• On first launch you choose whether to allow AI processing (reading receipts and assistant answers) and usage statistics and whether to send crash reports, and you confirm that you are 16 or older.
• The “Allow AI processing” box is not ticked in advance. Without AI consent, lists work; receipt recognition and Rinka are off.
• Usage statistics are off until you allow them. Crash reports are on until you turn them off: they rest not on consent but on our legitimate interest (section 5), and turning them off stops them in the same way. The activity-day records of the service (section 3.9) are separate and do not depend on these choices.
• You can change or withdraw consent at any time: Profile → Data → Data processing. Withdrawal takes effect immediately and does not affect what was sent before.
• On the shared-list page, the choice is changed with the “Change” link at the bottom of the page.

8. Your rights

You have the right to access your data and get a copy, to rectification, erasure, restriction of processing, data portability, to object to processing and to withdraw consent.

• A copy of your data — Profile → Data → Archive → Prepare the archive. The archive contains your account details (the first and last name you entered, if any, the name on your Google profile, the email address, the sign-in methods, the plan and the activity days from section 3.9), devices, the shared lists you own or have joined, with their lines, saved receipts, amounts noted without a receipt, recognition jobs, problem reports, assistant questions and answers, reports about Rinka’s answers, the account restriction and our decisions about it, and photos. Lists you have not shared, copies of shared lists you no longer have access to and receipts you have not saved yet are only on your device and are not in the archive. Anything else we hold about you can be requested at privacy@cartdock.app.
• The archive also contains your subscriptions as our service keeps them (section 3.12).
• Deletion — Profile → Data → Deletion → “Delete the account and all data”. For 24 hours the deletion can be cancelled; then the service deletes the Firebase account, receipts, photos, amounts noted without a receipt, activity-day records, your membership of other people's lists and your devices, and the app removes the account’s data from the device; the hidden lists and receipts of other accounts on this phone stay (section 3.8). The shared lists you own are deleted from the service, together with the lines the members added; the members keep a copy on their own devices that no longer updates. Lines you added to other people's lists stay there without an author. What is kept is a record that the deletion was carried out and, if the account had an e-mail address, a code of that address with the month's numbers (section 6), and, if the account was suspended for breaking a rule, a sign-up block on that code (section 12). You can delete the account without the app by e-mail; how, and what else is kept, is described on the account deletion page.
• Rectification — receipts and lists can be edited in the app.
• For any other request, write to privacy@cartdock.app.
• You can lodge a complaint with the data protection supervisory authority of your country; in Poland this is the President of the Personal Data Protection Office (UODO, uodo.gov.pl); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), to whom you can report a breach of data protection rules.

9. Cookies and browser storage

• The shared-list page keeps only your answer to the statistics question in localStorage.
• Google Analytics cookies (_ga, _ga_…) appear only after “Yes” and are removed if you later say no.
• The website sets one cookie, lang, with the code of the chosen language for 1 year — only when you choose a language yourself in the language switcher. The home page and this page store nothing else in the browser.

10. Age

The app is intended for people aged 16 or older: you confirm your age on first launch. The shared-list page does not ask for age.

If you are in Türkiye and under 18, use the app with the consent of a parent or legal guardian.

11. How data is protected

• The app and the page exchange data with the services over HTTPS.
• Access tokens and link keys are stored on the service only as hashes.
• Photos and archives are kept in private storage; they can be uploaded and downloaded only through a temporary signed address that works for 15 minutes.
• On the device, sign-in data is kept in the system's secure storage (Keychain on iOS, Keystore on Android).

12. Rules and account restrictions

The free limits, Rinka and receipt recognition are meant for personal use. When you use the service, follow four rules:

1. Use the service through the app and the website; do not send requests with a program or script.
2. Do not get around the monthly limits — for example, do not delete your account and sign up again to get new limits.
3. Do not send links to lists in bulk or to people who have not agreed to receive them.
4. Do not keep illegal content in shared lists or show it through a link.

If a rule is broken, we may restrict the account. The measures, from the mildest to the strictest:

• Slowing down. When there are too many requests, the service refuses them for a while (no longer than 24 hours) and asks you to try again later. This is the only measure that a program applies without a decision by a person.
• AI pause — up to 90 days. Rinka and receipt recognition do not work for your account; a refused question or scan does not count against your limits. Lists work.
• Suspension — up to 180 days. The service accepts no changes from the account — to shared lists, receipts, links or the account name — and Rinka and receipt recognition do not work. You can still see your data, download the archive, delete lists, revoke links, delete the account and sign out. Lists on your phone that you have not shared work as before. Links to your shared lists keep opening; if a notice about illegal content is confirmed, we may revoke them.
• Sign-up block — up to 6 months from the decision. No new account can be registered with the e-mail address; signing in to an existing account still works. If you delete your account while it is suspended for breaking a rule, its e-mail addresses are blocked without a new decision — by force of our decision to suspend it — for 6 months from the deletion, or until the suspension ends if that is later. The address is kept only as a code (an HMAC with a secret key).

How we decide and what you can do:

• An AI pause, a suspension and a sign-up block are decided by a person — Siarhei Mishchanka, who runs the service — after checking the facts, not by a program. Each decision states its reason and its end date; a measure can be extended only by a new decision. When the period ends, the restriction lifts by itself. A guest account (without sign-in) is not restricted this way: the monthly limits and slowing down apply to it.
• To notice abuse, we look at figures from data we already keep: AI costs per account, the number of new links, limits being reached, repeated sign-ups with the same e-mail address after a deletion, and the number of reports about Rinka’s answers. The content of lists and receipts is not used for this, and we collect no new data.
• We tell you about an AI pause, a suspension or a sign-up block by e-mail to the account’s address no later than it takes effect: what is restricted and until when, which rule was broken and which facts show it, how we found out, and how to appeal.
• Your data is not deleted while the account is restricted. The restriction and our decisions about your account are in your data archive (section 8); the records of our decisions are kept for 12 months (section 6).
• You can appeal such a decision within 6 months of the notice: reply to our e-mail or write to privacy@cartdock.app. A person reviews the decision; we answer within 14 days of receiving the appeal and, if we agree, lift the restriction on the day we answer. You can also object to the processing of data for detecting abuse and for restrictions (Art. 21 GDPR), lodge a complaint with a data protection supervisory authority (Art. 77 GDPR, section 8) and go to court.
• If you ask us to restrict the processing of your data (Art. 18 GDPR), we suspend the account for that reason while your request is being settled (up to 180 days per decision; we extend it if needed): the data is only stored, and you can still see and export it. Links to your shared lists keep working — we will ask whether to revoke them, and you can revoke them yourself. Such a suspension is not a measure for breaking a rule: if you delete the account during it, no sign-up block is set, and you can sign up again with the same e-mail address. Before we lift the restriction of processing, we will tell you.
• To report illegal content in a shared list, use the “Report illegal content” link on the list page or write to privacy@cartdock.app. Give the link ID (the list page shows it), what is illegal and why, your name and e-mail address, and confirm that the information is accurate and complete. We will confirm receipt and tell you our decision.

13. People in the United States and Canada

• Do Not Track. We do not track people across other websites or services, so the app and the website work the same with or without the browser’s “Do Not Track” signal. On the shared-list page Google Analytics works only after your “Yes” (section 3.10), and the app sends usage statistics to Google only with your consent (section 3.11); in both cases advertising features are off. Apart from this, no third party collects data about your activity through Cartdock.
• We do not sell personal information and do not share it for advertising.
• Canada. Our service and its processors store and process data outside Canada — in the European Union and in the United States (section 4). There the data may be accessed by courts, law enforcement and other authorities of those countries under their laws.
• Quebec. The person in charge of the protection of personal information is the controller, Siarhei Mishchanka; write to privacy@cartdock.app. Before data of people in Quebec is sent outside Quebec, we assessed the privacy impact of this transfer (section 17 of the Quebec Act respecting the protection of personal information in the private sector).

14. Changes to this policy

The current version is always published at this address; its effective date is shown at the top of the page.