Legal
Privacy Policy
This policy explains what data the Stocker (SimpleStocker) app and the simplestocker.com website process, why, who we share it with, how long we keep it and what your rights are. The Polish version prevails in case of discrepancies.
Effective from: 12 October 2026 · Wersja polska
1. Who the data controller is
The controller of your personal data is Sebastian Bolek, Zawada 12A, 64-930 Szydłowo, Polska, Polish tax ID (NIP) 7651656515, REGON 365641696 ("we"). In the app stores we publish the "Stocker" app under the developer account somniumcode.
For anything related to personal data, write to [email protected]. We have not appointed a data protection officer because we are not required to.
This policy covers the iOS and Android app, the Apple Watch and Wear OS apps, the app server (api.simplestocker.com) and the simplestocker.com website.
2. What data we process and where it comes from
| Category | What exactly | Source |
|---|---|---|
| Account data | Google or Apple account identifier, email address, name or display name, profile picture URL (Google only). With Apple you can hide your address; we then receive an Apple relay address. | From Google or Apple when you sign in. You do not create a password with us. |
| Sessions and security | Session identifiers for each device (phone, watch), hashes of refresh tokens, session creation and refresh times. The tokens themselves are stored in the device keychain (Keychain, Keystore). | Created by the app and the server at sign-in. |
| Your inventory | Storage names, products (name, brand, barcode, quantity, unit, category, package size, expiry date, photo), shopping lists and their items, app settings. | From you and from household members you share a storage with. |
| Product photos | Photos taken with the camera or picked from the gallery for a product. The app only accesses the photo you choose. | From you. |
| Sharing | Email address of the person you invite, invitation status, who shared which storage with whom. | From you (the inviter provides the invitee’s address). |
| Error and stability data | Error details, device model, OS and app version, account identifier and display name, actions leading up to the error. For some sessions (10% and sessions that end with an error) we record a screen replay in which text, images and form fields are masked. | From the app, automatically (Sentry). |
| Server logs | IP address, time, API endpoint called, response code, account identifier for data operations. | From the server, automatically. |
| Notifications | Expiry reminders are scheduled locally on your phone; no data is sent to the server for them. Once we launch server-sent notifications: the device push token, platform, app version, language and your notification settings. | From the app, after you allow notifications in the system. |
| Once we launch email: your verified address, verification codes, records of messages sent (invitations, confirmations, and summaries if you turn them on). | From you and from the server. | |
| Subscription | Once we launch the paid plan: transaction and subscription identifiers, plan, status, purchase and renewal dates, store country. We never see your card details or other payment data; Apple or Google handles them. | From Apple (App Store) or Google (Google Play). |
| Support | Message content, sender email address and attachments such as screenshots. | From you, when you contact us. |
The camera is used to read barcodes and take product photos. The camera preview is analysed on the device and is not sent to the server. We do not use the microphone.
We do not collect location, contacts, health data or advertising identifiers. We show no ads, do not sell data and do not profile you for marketing.
3. Shared product catalog
We get product data from the open Open Food Facts and Open Products Facts databases. When you save a product with a barcode, its name, brand, category, package size and photo are also added to our shared product catalog, so other users who scan the same barcode see this information. The catalog does not record who added a product, but do not put personal data in product names or photos.
Quantities, expiry dates, storages and shopping lists never go into the catalog. Only you and household members you share a storage with can see them.
4. Why we process data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, sign-in, storing and syncing your inventory across devices, sharing storages, shopping lists, reminders | Performance of the contract (Art. 6(1)(b)) |
| Shared product catalog | Performance of the contract and our legitimate interest in giving users complete product data (Art. 6(1)(b) and (f)) |
| Processing the email address of an invitee who does not have an account yet | Legitimate interest of the inviter and ours in enabling invitations (Art. 6(1)(f)) |
| Service security, abuse detection, server logs | Our legitimate interest in protecting the service and users’ data (Art. 6(1)(f)) |
| Error diagnostics and session replays in Sentry | Our legitimate interest in a stable app (Art. 6(1)(f)). You can object by writing to [email protected]. |
| Server-sent push notifications | Performance of the contract; sent only after you allow them in system settings, which you can withdraw at any time |
| Emails needed for the account (address verification, invitations, deletion confirmation) | Performance of the contract (Art. 6(1)(b)) |
| Summary and reminder emails | Your consent given with a toggle in the app (Art. 6(1)(a)), which you can withdraw at any time |
| Subscriptions, billing and tax obligations | Performance of the contract and legal obligation (Art. 6(1)(b) and (c)) |
| Answering messages and complaints | Performance of the contract, legal obligations under consumer law, legitimate interest (Art. 6(1)(b), (c) and (f)) |
| Establishing, pursuing and defending legal claims | Our legitimate interest (Art. 6(1)(f)) |
Providing data is voluntary, but without account data we cannot provide the service. We make no decisions about you based solely on automated processing.
5. Who we share data with
| Recipient | Role and scope | Where |
|---|---|---|
| Server infrastructure | Storing the database, photos, backups and logs. | The administrator’s own server in Poland |
| Google (Google Ireland Ltd., Google LLC) | Sign in with Google, Google Play, Google Play billing, delivering notifications to Android (Firebase Cloud Messaging). For sign-in and payments Google acts as a separate controller under its own privacy policy. | EU, USA |
| Apple (Apple Distribution International Ltd., Apple Inc.) | Sign in with Apple, App Store, App Store payments, delivering notifications to iPhone and Apple Watch (APNs). For sign-in and payments Apple acts as a separate controller. | EU, USA |
| Functional Software, Inc. (Sentry) | Collecting error reports and session replays. Processor acting on our behalf. Data is stored in an EU data centre (Frankfurt). | EU; support access from the USA |
| 650 Industries, Inc. (Expo) | Relaying push notifications to Apple and Google, once we launch them. Processor. | USA |
| Resend, Inc. | Sending emails from the app from [email protected] (verification codes, invitations, account deletion confirmations), once we launch it. Processor. Data processed in the EU region. | EU; support access from the USA |
| Open Food Facts (association, France) | The app loads product photos directly from Open Food Facts servers, so they see your device’s IP address. We do not share your account or inventory data with them. | EU |
| Household members | People you share a storage with see its contents, your name and your email address. A person you invite sees your name and email address. | — |
| Public authorities | When required by law, e.g. at the request of a court or prosecutor. | — |
Transfers outside the European Economic Area (to the USA) rely on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) for certified companies or on the Commission’s standard contractual clauses. You can request a copy of the safeguards at [email protected].
6. How long we keep data
| Data | Period |
|---|---|
| Account, inventory, lists, photos, shares | Until you delete your account. You can delete individual products, storages and lists at any time. |
| Device sessions | Until you sign out, the session is revoked or the account is deleted. |
| Invitations | Until accepted, declined or withdrawn, at the latest until the account is deleted. |
| Server logs | 30 days |
| Database backups | 30 days, then overwritten. |
| Error reports and session replays (Sentry) | 30 days |
| Subscription and billing data | For the duration of the subscription; billing records for 5 years from the end of the year in which the tax obligation arose. |
| Correspondence and complaints | Until the matter is closed, then until the limitation period for claims expires. |
| Shared product catalog | Indefinitely. The catalog contains no personal data. |
7. Deleting your account
You can delete your account in the app (Profile → Account settings → Delete account) or without the app by following the steps on the Delete account page. Right after the request we sign you out on all devices and hide the account from other users. We usually delete the data within 24 hours and no later than 30 days.
- We delete: the account and linked Google and Apple sign-ins, email address, sessions, push tokens, settings, storages you own together with their products, your shopping lists, shares and invitations, and uploaded photos. We also revoke the Sign in with Apple token.
- We keep: products you added to someone else’s shared storage (they belong to the storage owner’s inventory), with no link to you, and entries in the shared product catalog, which contain no personal data.
- Expires later: server logs (30 days), backups (30 days) and error reports (30 days). We never restore deleted accounts from backups.
Deleting your account does not cancel a subscription in the App Store or Google Play. Cancel it in the store settings.
8. Your rights
You have the right to:
- access your data and get a copy of it,
- rectify your data,
- erase your data,
- restrict processing,
- data portability for data you provided, in a machine-readable format,
- object to processing based on legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
- lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl) or the supervisory authority in your country of residence.
To exercise your rights, write to [email protected] from the address linked to your account. We reply within one month. We may ask you to confirm your identity so that we do not disclose data to an unauthorised person.
9. Security
The connection between the app and the server is encrypted (HTTPS). We store no passwords because you sign in with Google or Apple. Sign-in tokens are kept in the device keychain and the server stores only their hashes. Every storage operation is permission-checked on the server. Only the administrator has access to the server and database.
10. Children
The app is intended for people aged 16 or over. We do not knowingly collect data from younger children. If you learn that a child under 16 has created an account, contact us and we will delete it.
11. The simplestocker.com website
The website uses no cookies or analytics tools and loads no third-party scripts. The web server keeps technical connection logs (IP address, time, page address, browser) for security purposes for 30 days.
12. Changes to this policy
When we change how we process data, we will update this policy and the date at the top of the page. We will announce material changes in the app or by email before they take effect.