Privacy Policy

Last updated: 16 June 2026

This Privacy Policy explains what data mitbringen ("we", "us") collects when you use the mitbringen mobile app and the mitbringen.at website, how we use it, and the rights you have over it. mitbringen is operated as a personal project by an individual based in Austria. We follow the EU General Data Protection Regulation (GDPR).

1. Who is the data controller

The data controller for personal data processed by mitbringen is the developer of the project. You can reach us by email at vamshee3000@gmail.com for any privacy-related question or request.

2. What data we collect

We collect only what we need to run your account and your shopping list. Specifically:

Account data — your email address and the password you set (stored as a salted hash, never in plain text).
Profile data (optional) — the name you choose to display in the app, and the monthly savings goal you set.
Shopping list contents — the items you add to your shopping list and how often you add them.

What we do not collect

We do not collect your location.
We do not collect payment information — mitbringen is free.
We do not use any third-party advertising trackers, no Google Analytics, no Facebook SDK, no Crashlytics.
We do not read your contacts, photos, calendar or other apps.

3. Why we use it (legal bases)

Performance of a contract (GDPR Art. 6(1)(b)) — to provide the account and shopping-list features you signed up for.
Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and debug technical issues.

4. Who we share it with

We share data only with the infrastructure providers we need to run the service, and only the data they need to do their job:

Amazon Web Services (AWS Lightsail and AWS Object Storage) — hosts the application server and stores supermarket flyer PDFs. Data is held in the Frankfurt (eu-central-1) region.
Let's Encrypt — issues the TLS certificate that secures the connection between your device and our server.

We do not sell your personal data. We do not share it for advertising. We do not give it to data brokers.

5. How long we keep it

Account, profile and shopping-list data is kept while your account is active and deleted on request (see Section 7).

6. Security

All traffic between the app and our server is encrypted with TLS. Passwords are stored as bcrypt hashes. The database and server access are restricted to the developer over SSH key authentication. We do not export or copy user data off the server.

7. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data — most fields can be edited in the app's Profile screen.
Have your data deleted ("right to be forgotten").
Export your data in a portable format.
Withdraw consent at any time.
Lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) at dsb.gv.at.

To exercise any of these rights, send an email from your account address to vamshee3000@gmail.com. We will respond within 30 days and, in the case of deletion, confirm once your data has been removed from active databases and backups.

8. Children

mitbringen is not designed for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Changes to this policy

If we change anything material, we will update the "Last updated" date at the top and, for significant changes, notify you in the app. Continued use after a change means you accept the updated policy.

10. Contact

Questions about this policy or about your data: vamshee3000@gmail.com

Privacy Impressum