Privacy in the app

This statement covers the SmartBasket Android app. The website has its own statement; it processes entirely different — and far fewer — data.

Controller

Email: samzakharo@gmail.com

In short

The app contains no analytics, tracking or advertising services and no crash reporting SDK. No usage profiles are built and no data is sold. What is processed is what you enter so the app can plan — and the voice recording, if you use it.

Account

An account processes your email address and password. The password is never stored in clear text, only as a cryptographic hash at the authentication service. The purpose is signing in and associating your data with you. Legal basis: Art. 6(1)(b) GDPR.

Profile and nutrition data

For planning, the app stores:

• display name, sex, age, height, weight, activity level
• nutrition goal and daily calorie and protein targets
• dietary patterns: vegetarian, vegan, pescatarian, lactose-free, gluten-free, diabetes
• allergens: milk, eggs, fish, shellfish, peanuts, tree nuts, soy, wheat, sesame
• intolerances: lactose, gluten
• household size, planning period and budget

Allergies, intolerances and diabetes, and the combination of body data with nutrition goals, are health data and therefore a special category of personal data under Art. 9 GDPR. They are processed solely on the basis of your explicit consent under Art. 9(2)(a) GDPR. You may withdraw that consent at any time with future effect by removing the entries in the app or having your account deleted. The app makes no diagnosis and gives no medical advice.

Details about people you cook for

When planning for several people you can record each person’s name, age, sex, nutrition targets, dietary patterns, allergens and intolerances. These details concern people other than you.

Please enter them only with that person’s agreement, and tell them about this statement. For children, those with parental responsibility decide. The entries can be changed or removed in the app at any time; they are deleted with the plan they belong to and with your account.

Plans, baskets, pantry and purchase history

The app stores your meal plans with the chosen dishes, the shopping baskets generated from them with quantities and estimated prices, your pantry with leftover amounts, and completed shops, so that leftovers can be credited against later plans. Legal basis: Art. 6(1)(b) GDPR.

Voice input

If you use the voice feature, the app records through the microphone once you have confirmed. The recording is sent to a server function of our own and forwarded from there to OpenAI: first to turn it into text, then to interpret that text into planning values. The current plan and the available dishes are sent along with it.

The requests are made so that the provider does not retain them. Recordings, transcripts and target values are not logged on the server function. The recording itself is held on the device only briefly, in order to be sent.

The legal basis is your consent under Art. 6(1)(a) and, where health-related details are included, Art. 9(2)(a) GDPR. You can type your wishes instead — no recording is made that way.

Processors

• Supabase — account, database and server functions. The project is hosted in the Ireland region (eu-west-1) within the European Union.
• OpenAI — turning the recording into text and interpreting the request. Processing outside the European Union cannot be ruled out here.

Data processing agreements are in place with both providers.

Retention and deletion

Your data is kept for as long as your account exists. Deleting the account deletes everything linked to it — profile, preferences, plans, baskets, the people you cook for, pantry and purchase history.

You can request deletion of your account at any time, informally, by email to samzakharo@gmail.com. It is carried out without asking for a reason.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and you may withdraw any consent with future effect. Please write to the address above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Changes

This statement is updated when the app changes. The version published here is the one that applies.

Last updated: 24 September 2026