Privacy in the App

Controller and overview

Controller

The most important points first

SchnäppZettl does not operate a server of its own. There is no user account with the provider and no analytics or crash reporting tools of its own. Your lists are stored on your device and – if you are signed in to iCloud – in your own iCloud account. The provider has no access to them.

The app shows ads unless you have purchased “SchnäppZettl Pro”. The ads are not personalized and are not used for tracking across apps and websites – see the section “Advertising” below for more.

What data is processed where

Broken down by where the data resides: on the device and in the user's own iCloud account.

Data on your device

Using the app creates data that is initially stored exclusively locally:

• Your shopping lists with items, quantities, stores, notes, deal periods, and completion status;
• Your settings: timing and type of notifications, the threshold for “ending soon” (“endet bald”), badge display, the grace period when checking items off, and collapsed stores per list.

The purpose is to provide the app's functions. The legal basis is Art. 6(1)(b) GDPR (performance of the usage relationship) and, beyond that, Art. 6(1)(f) GDPR (legitimate interest in a working app).

Camera (text recognition from flyers)

With the camera button in “Aus Prospekt eingeben” (“Enter from flyer”), you can have text recognized from a photographed flyer. The text recognition runs entirely on your device using Apple's image recognition; no photos are stored or transmitted, and only the text you confirm ends up as a new item in your list. This requires your permission to access the camera, which you can revoke at any time in the iOS settings. The legal basis is Art. 6(1)(a) GDPR.

Syncing via iCloud

If you are signed in to iCloud on the device, the app syncs your lists between your devices using Apple's CloudKit service. The data is stored in the private database of your own iCloud account (container iCloud.de.codewave.ShoppingList). The provider can neither view nor retrieve this data.

The provider of the service is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple's Privacy Policy applies. The legal basis is Art. 6(1)(b) GDPR. You can turn off syncing at any time in the iOS settings; the app then keeps working purely locally, and list sharing is no longer available.

Shared lists

If you share a list, the people you invite get access to its contents and can change them. Conversely, you see the contents of lists that others share with you. To invite someone, you enter an email address or phone number, or pick one using the iOS contacts picker; the app passes this information to Apple's own participant lookup (CloudKit sharing) to find the right person. The app itself displays the list of invited people along with their invitation status – but this information is stored and processed exclusively within your own iCloud account or at Apple, not on a server of the provider. The legal basis is Art. 6(1)(b) GDPR; sharing happens solely at your initiative.

Notifications

The app schedules notifications about deal periods (“Angebot beginnt” – deal starts, “endet bald” – ending soon) locally on your device. Nothing is sent via a server of the provider, and the provider learns nothing about your items.

In addition, CloudKit uses silent push notifications from Apple to inform the app about changes to your own and shared lists. These messages contain no content; they merely trigger a sync. The device identifiers required for this are managed by Apple, not by the provider. You can turn off notifications at any time in the iOS settings or in the app's settings. The legal basis is Art. 6(1)(a) and (b) GDPR.

Advertising

Until you have purchased “SchnäppZettl Pro”, the app shows ads via the Google AdMob service. In the process, a device identifier, IP address (for rough location estimation), and information about ad interaction (e.g. whether an ad was displayed or tapped) are transmitted to Google. For the ad SDK's own operation, Google also collects crash and performance data (e.g. app launch time).

The ads are not personalized: your device's advertising identifier (IDFA) is not accessed, and your behavior is not tracked across other apps or websites. Before the first ad, the app asks for your consent via Google's “User Messaging Platform” where required under the GDPR/UK GDPR; you can change or withdraw it at any time in the app's settings under “Datenschutzoptionen” (“Privacy options”). The legal basis is your consent (Art. 6(1)(a) GDPR).

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's Privacy Policy applies. Processing may also take place outside the EU; Google relies on the EU Commission's standard contractual clauses for this.

Purchasing “SchnäppZettl Pro” removes the ads permanently (with the one-time purchase) or for the duration of a subscription. Purchases are handled entirely through Apple's App Store; the provider receives no payment data in the process.

Retention and deletion

Your lists, items, and stores remain stored until you delete them yourself. When you remove the app, synced data remains in your iCloud account; it can be managed and deleted via Settings → [Your Name] → iCloud → Manage Storage (app data).

For list sharing, the provider itself creates no additional records – see “Shared lists” above. How long Apple retains its own sharing records (CKShare) is up to Apple; you can end a sharing arrangement at any time via the app's sharing sheet.

Recipients and what does not take place

Recipients

The recipient is Apple, insofar as this is necessary for iCloud/CloudKit, push delivery, and making the app available through the App Store, as well as – for serving ads – Google Ireland Limited (Google AdMob), see the section “Advertising”. Processing may also take place outside the EU; both providers rely on the EU Commission's standard contractual clauses for this, and Apple additionally on the EU-US Data Privacy Framework.

What does not take place

The app itself does not integrate any third-party analytics or crash reporting services; the ad SDK merely collects crash and performance data for its own operation, see the section “Advertising”. There is no tracking across apps and websites, no personalized advertising, and no automated decision-making including profiling. Apart from Apple and – for advertising – Google, no connections to third-party servers are established.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. To exercise your rights, a message to info@schnaeppzettl.de is enough.

Independently of this, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR); the authority responsible for the provider is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Obligation to provide data

You are not obliged to provide any personal data. Without signing in to iCloud, syncing and sharing are unavailable; the app can still be used fully locally.

Changes

This policy will be updated whenever the app changes. The version published here at any given time applies.