Privacy Policy

Last updated: 7 September 2026

This Privacy Policy explains what data mitbringen ("we", "us") collects when you use the mitbringen mobile app and the mitbringen.at website, how we use it, and the rights you have over it. mitbringen is operated as a personal project by an individual based in Austria. We follow the EU General Data Protection Regulation (GDPR).

1. Who is the data controller

The data controller for personal data processed by mitbringen is the developer of the project. You can reach us by email at vamshee3000@gmail.com for any privacy-related question or request.

2. What data we collect

We collect only what we need to run your account and your shopping list. Specifically:

Account data: your email address and the password you set (stored as a salted hash, never in plain text).
Profile data (optional): the name you choose to display in the app, and the monthly savings goal you set.
Shopping list contents: the items you add to your shopping list and how often you add them.

What we do not collect

We do not collect your location.
We do not collect payment information; mitbringen is free.
We do not use any third-party advertising trackers, no Google Analytics, no Facebook SDK, no Crashlytics.
We do not read your contacts, photos, calendar or other apps.

3. Why we use it (legal bases)

Performance of a contract (GDPR Art. 6(1)(b)): to provide the account and shopping-list features you signed up for.
Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse, and debug technical issues.

4. Who we share it with

We share data only with the infrastructure providers we need to run the service, and only the data they need to do their job:

Amazon Web Services (AWS Lightsail and AWS Object Storage): hosts the application server and stores supermarket flyer PDFs. Data is held in the Frankfurt (eu-central-1) region.
Let's Encrypt: issues the TLS certificate that secures the connection between your device and our server.

We do not sell your personal data. We do not share it for advertising. We do not give it to data brokers.

5. How long we keep it

Account, profile and shopping-list data is kept while your account is active and deleted on request (see Section 7).

6. Security

All traffic between the app and our server is encrypted with TLS. Passwords are stored as bcrypt hashes. The database and server access are restricted to the developer over SSH key authentication. We do not export or copy user data off the server.

7. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data; most fields can be edited in the app's Profile screen.
Have your data deleted ("right to be forgotten").
Export your data in a portable format.
Withdraw consent at any time.
Lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) at dsb.gv.at.

To exercise any of these rights, send an email from your account address to vamshee3000@gmail.com. We will respond within 30 days and, in the case of deletion, confirm once your data has been removed from active databases and backups.

8. Cookies and similar storage

The public website uses one first-party cookie. We do not use advertising cookies, analytics pixels, or social SDKs.

mb_consent: remembers that you dismissed the essential-cookie notice. It is strictly necessary to store that choice (TKG § 165; GDPR Art. 6(1)(f)). The value is v1.necessary.<unix timestamp>. It lives 13 months, is host-only, Path=/, SameSite=Lax, and Secure on HTTPS. It is not HttpOnly because a first-party script sets it when you tap the notice — there is no network call and no consent database.
Fonts: Schibsted Grotesk is self-hosted on this site. The website does not load Google Fonts, Google Analytics, advertising pixels, or social SDKs.
localStorage: a launch countdown, if shown, may keep its target timestamp in localStorage on this device. It never leaves the browser.
Sentry: if enabled, is server-side error reporting only and does not set a browser cookie on the marketing pages.

The footer Cookies link reopens the notice without clearing the stored choice until you confirm again.

9. Children

mitbringen is not designed for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we change anything material, we will update the "Last updated" date at the top and, for significant changes, notify you in the app. Continued use after a change means you accept the updated policy.

11. Contact

Questions about this policy or about your data: vamshee3000@gmail.com

Privacy Impressum Cookies