Cartomi / Privacy
Privacy policy
This policy describes how Cartomi processes information when you use the website and app. It reflects the current technical implementation.
Data controller
Martin Rud Drift ApS is the data controller for the processing of personal data in Cartomi.
Martin Rud Drift ApS
Danish company registration (CVR): DK-45052052
Emborgvej 8c
8680 Ry
Denmark
Email: hello@cartomi.app
What data we process
For anonymous use, Cartomi creates a device identifier (stored locally on your device and linked to your account on the server) so your lists can sync without an email address. Grocery lists, items, memberships, and history are stored in our database. Your device also keeps local copies in IndexedDB and some preferences in localStorage.
If you sign in with email, we link your account to that email address. Sign-in uses a one-time link or one-time code (valid for 15 minutes). After sign-in, an HttpOnly session cookie (grocery_session) is set, typically for up to 180 days. You can stay signed in on multiple devices; you can sign out on the current device or all devices. An anonymous session can be merged into your email account when you sign in.
When a list is shared, we store memberships and any invitations. The owner can create a share link (invite token) and can revoke the link so new people cannot join. Existing members are only removed if the owner removes them or the member leaves. Members can see the list contents (items, etc.). The owner can see member email addresses where available. For email invites and sign-in we may process IP addresses temporarily for security (e.g. rate limiting and one-time links).
Voice input uses your device/browser speech recognition (Web Speech API). Cartomi does not upload audio files to our servers. Recognised text may be sent to OpenAI to suggest grocery items (Cartomi Plus). We do not store audio recordings at Cartomi. How your browser or operating system processes audio is controlled by that vendor.
Photo analysis (Cartomi Plus) sends the uploaded image temporarily to OpenAI Vision in the request; Cartomi does not keep the analysis image as a separate file for that purpose. If you add an item photo (Plus), the file is stored in our object storage (Hetzner Object Storage) with a reference on the item. The image is deleted from object storage when you delete the image or soft-delete the item. When an entire list is deleted, database rows are removed, but related image files may sometimes remain in object storage - a known technical limitation we intend to close.
Cartomi Plus records trial and any paid access status on your user account (status and dates). There is not yet a built-in payment integration in the product, so payment processing via an external payment provider is not active app data processing. Use of AI features is logged (type, tokens/estimates) for quotas and operations.
Purposes and legal bases
We process information to provide the grocery list service, sync across devices, enable sharing, handle sign-in and account security, send login and invite emails, process speech/text and images at your request (Plus), and for necessary operations, security, and troubleshooting.
Legal bases under GDPR Article 6: providing the service and sync - Art. 6(1)(b) (contract / necessary to deliver the service); sign-in, security, rate limiting, and operations - Art. 6(1)(f) (legitimate interests) and/or 6(1)(b); login and invite emails - 6(1)(b) / 6(1)(f); AI processing of text and images at your request - typically 6(1)(b) and/or consent 6(1)(a) (especially when using OpenAI).
Retention and deletion
Lists and related data are stored in PostgreSQL on our server until you delete the list (as owner), leave it, or we delete data on request. When an owner deletes a list, the list and related database rows are removed. When you delete an item, it is hidden immediately and any item photo is removed from object storage; the hidden database row is hard-deleted automatically after 30 days. Sessions expire after at most 180 days or on logout. Login and OTP links expire after 15 minutes. Local copies on your device remain until you clear app/browser data. Server backups are handled outside the app (e.g. VM snapshots); exact backup retention is not defined in the app. Self-serve deletion of an entire account is not yet available - contact us to request deletion.
Cookies and local storage
We use technically necessary cookies: grocery_session (sign-in session, HttpOnly) and grocery_locale (language). These are not analytics or marketing cookies. The app also uses localStorage (e.g. device id and preferences), sessionStorage (e.g. temporary session handoff), and IndexedDB (offline copies of lists and a sync queue). We do not use product analytics cookies.
Processors and vendors
Hosting, database, and object storage: Hetzner (Germany/EU hosting as used in our operations). Transactional email: Amazon SES. AI (text and image analysis): OpenAI. The Inter and Space Grotesk fonts are hosted on Cartomi’s own website (not Google Fonts). We do not collect product analytics in the app, and we do not currently use a separate error-monitoring service in the app.
When data is sent to OpenAI, information may be processed outside the EU/EEA. The specific transfer mechanism (e.g. standard contractual clauses) and OpenAI’s retention are subject to legal review and depend on the agreement with OpenAI in force at the time. We do not guess data-centre regions here.
Your rights
Under the GDPR you have rights including access, rectification, erasure, restriction of processing, objection, and - where applicable - data portability. If processing is based on consent, you may withdraw consent. You can delete lists you own in the app. Other rights are exercised by contacting us - full self-serve support for every right (e.g. account deletion) is not yet available.
You may lodge a complaint with the Danish Data Protection Agency (Datatilsynet). https://www.datatilsynet.dk
Privacy contact
Email hello@cartomi.app. Contact