Privacy Policy

Last updated: November 7, 2026

This policy explains what information Spisko ("we", "us") collects when you use the app, why we collect it, and what control you have over it.

This is a plain-language policy drafted for Spisko's actual features. It is not a substitute for legal advice — have it reviewed by counsel before treating it as binding, especially if Spisko is offered outside your home jurisdiction.

What we collect

Account information. When you sign up, we (via Supabase Auth) store your email address and an authentication credential — either a password hash or an OAuth identity if you sign in with a third-party provider. We don't ask for your name, phone number, or any other personal details to create an account. You can choose to set a display name in Settings; the members of a space you share see it, including in the "who's shopping" bar while you have a shared list open.

Inventory and list data. Everything you enter to use the app: items, categories, storage locations, shopping lists, and quantities. This data is yours — it's scoped to your account (or to a shared space you've joined) and isn't visible to other users unless you explicitly share a space with them.

Quantity history and shopping trips. Each time an item's quantity changes — by you, by someone you share it with, or by an AI assistant you've connected — we record by how much, what it came to, when, who made the change, and how (the +/− buttons, the slider, a purchase). When you finish shopping, we record what that trip bought. This shows how your stock changes over time, which features like "when will this run out" are built on. We don't use the names of your items to draw conclusions about your health or habits.

Item photos. If your account has Plus, you can add a photo to an item. The photo is shrunk and re-encoded on your device before it's uploaded, which also removes the metadata a camera writes into it — including the location where it was taken. It's stored privately: only you and the members of a space the item is shared with can see it.

Barcode scans. When you scan a barcode, the product name and details are looked up against a shared, crowd-sourced database of barcode-to-product mappings that all Spisko users contribute to and benefit from. This mapping (barcode → product name) is not linked to your account or identity — it's shared product reference data, not personal data. A barcode that isn't in it yet is looked up on Open Food Facts by our server, which sends only the barcode, nothing about you.

Location data. Nearby stores and store reminders use your location: your device's position (only after you grant permission) or, if you turn on IP-based location in Settings, an approximate one worked out from your IP address by ipwho.is. To find the stores around you, your device sends that position directly to an OpenStreetMap "Overpass" server (see "Who else sees it"). We don't store your position on our servers. If you add a store location yourself (e.g. by placing a pin on a map), those coordinates are stored as part of that location record, the same as any other inventory data.

Maps. The maps in the app are OpenStreetMap's. Your device loads the map images and, when you search for a place, sends the search to OpenStreetMap directly, so OpenStreetMap sees your IP address and the area you're looking at.

Contact form submissions. If you use the contact form, we receive the subject and message you write, along with your email if you're signed in. It reaches us as an email sent through Resend. We use it only to respond to you — not for marketing.

Recipe imports. If you import a recipe (Spisko Plus), our server opens the link you give it, so the recipe site sees our server's address, not yours. When the page doesn't publish its recipe in the standard format sites use for search engines, or when you paste a recipe in, we send the page's text or the text you pasted to Mistral AI, which separates the ingredients from the steps. A recipe in another language than the app's also goes to Mistral AI to be translated, unless you turn translation off. Every imported recipe's ingredient lines go to Mistral AI too, to name what each one puts on your shopping list. Nothing about you or your account is sent with it, and what comes back is only a draft until you save it.

Activity readings. With Spisko Plus, you can ask the Activity page for a reading of a period. We send Mistral AI that period's counts (the days of the week you shop on among them, and which day it is today) and how often each item was bought; how much of each item is at home now, its goal and how fast it gets used; the items you used to buy regularly and stopped; your trips and items per month over the last year; what's on your active shopping lists (item names and amounts); and the names of the items and of the stores. Nothing else: no names of people, no list names, no account details. The reading is kept with your account and goes when the account does.

Purchases. If you buy Spisko Plus in the Android app, Google Play takes the payment; we never see your card or bank details, or the name Google has for you. Google gives the app a purchase token, which our server checks with Google and keeps with your account, together with the plan (monthly or yearly), whether the subscription is active, when the current period ends and whether it will renew. Google Play tells our server when a subscription renews, is cancelled or is refunded, and the server asks Google again each time. We use this only to know whether your account has Plus.

Server requests. Like any website, our server sees your IP address with each request. We use it to keep the service running and secure — for example, to limit repeated attempts to join a space — and don't link it to your inventory.

Error reports. When something in the app breaks, an error report is sent to our error monitoring service: what went wrong and where in the code, the page it happened on (without anything after a ? in the address), your browser and device type, and the random ID of your account. It doesn't include your email address, IP address, what you typed, or the contents of your inventory and lists; tokens and email addresses in error messages are masked before the report leaves your device. A small sample of page loads and requests is timed the same way, to find slow parts of the app.

Usage analytics. On spisko.com we use Google Analytics to count visits and see how Spisko is used: which pages are opened, where visitors come from (the referring site and any campaign tags in the link), and a few actions — signing up or in, creating a list, adding an item, finishing a shopping trip. It's told the kind of page (for example "a shopping list"), never the page's full address or title, the names or contents of your lists and items, your email address, or your account ID. Google also sees your IP address and your browser and device type, and works out an approximate location from them; Google Analytics doesn't store the IP address. If you allow cookies in the banner, Google Analytics sets cookies that recognise your browser on later visits. If you decline, or haven't answered yet, it sets no cookies and receives only pings without any identifier, which Google uses to estimate overall numbers. You can change your choice at any time in Settings.

Cookies and storage on your device. The only cookies are Google Analytics', and only if you allow them (see "Usage analytics"). We use your browser's storage to keep you signed in (your session token), to remember your preferences (theme, language, your analytics choice and similar settings), and to keep a copy of your recent data, changes you made offline that are waiting to be sent, and your item photos, so the app opens quickly and works without a connection. Your data, offline changes and photos are cleared from the device when you sign out. We don't use any of this for advertising or cross-site tracking, and we don't run ad scripts.

AI assistant access (MCP). If you generate a personal access token to connect an AI assistant to your Spisko data via our MCP server, that token grants the same access to your data that you have. Treat it like a password — anyone with the token can read and modify your inventory and lists until you revoke it.

How we use it

We use your data solely to operate the app: authenticating you, storing and displaying your inventory and lists, powering search/suggestions, and responding to support requests. We don't sell your data, and we don't share it with third parties except the infrastructure providers necessary to run the service (see below).

Why we're allowed to use it

To provide the service you signed up for (performance of a contract): your account, inventory, lists, sharing, photos, data exports, and your Plus subscription.
With your consent: your device's location, IP-based location, the store reminders built on them, and analytics cookies. You can withdraw it at any time by turning the feature off in Settings or in your browser.
Our legitimate interest in keeping the service secure, answering you, and knowing how many people use it: server request data, error reports, contact form messages, and the analytics pings sent without cookies.

Who else sees it

Service providers that work for us. They process data only on our instructions, under data processing agreements that include the EU Standard Contractual Clauses.

Supabase hosts our database, authentication, and file storage, in Ireland (EU).
Amazon Web Services runs the server the app is served from, in Sweden (EU).
Sentry (Functional Software, Inc.) stores error reports, in Germany (EU).
Resend delivers contact form messages to us by email, from the United States.
Mistral AI (France) reads and translates recipe pages and pasted recipes for recipe import, and writes the Activity page's readings, in the EU.
Google (Google Ireland Limited) runs Google Analytics for us; the data is processed in the United States.

Services your device contacts directly. These are independent services, run under their own terms and privacy policies, not on our behalf. They receive your IP address and what's described below, and only when you use the feature that needs them.

OpenStreetMap Foundation (United Kingdom): map images and place search, when you open a map.
OpenStreetMap Overpass servers run by community operators in Europe: your position and a search radius, when the app looks for stores near you.
ipwho.is: your IP address, only while IP-based location is turned on in Settings, to return an approximate location.
Google Play (Google): the purchase itself, when you buy Spisko Plus in the Android app, under Google Play's terms and Google's privacy policy.

Other members of a space you share can see the inventory, categories, lists and recipes within that shared space, including how shared items' quantities changed, what was bought on shared lists, and shared items' photos — that's the point of space sharing, and it's something you opt into explicitly.

We do not sell, rent, or share your data with advertisers or data brokers.

Where it's stored

Your account and everything you store in Spisko is kept in the European Union. Data leaves it only as described above: contact form messages and usage analytics (United States, under the Standard Contractual Clauses, and for Google also the EU–US Data Privacy Framework), OpenStreetMap requests (the United Kingdom, which the EU recognises as protecting personal data adequately; Switzerland likewise), Plus purchases, which Google Play handles under its own terms, and any of our providers' own subcontractors, under the same clauses.

Your controls

You can edit or delete any item, category, location, or list at any time.
Deleted items are soft-deleted (recoverable via undo) rather than immediately erased, so accidental deletes aren't unrecoverable. We don't currently run an automatic purge of soft-deleted items; they're excluded from every normal view but remain recoverable until you delete your account.
You can revoke any MCP personal access token at any time from Settings.
You can cancel Spisko Plus at any time in Google Play. Deleting your account cancels a renewing subscription first.
You can allow or refuse analytics cookies at any time in Settings; refusing removes the ones already set.
You can leave a shared space at any time, which removes your access to its data.
You can download a copy of your data (inventory, categories, locations, shopping lists, quantity history, shopping trips, and profile) at any time from Settings, as a JSON file. It includes a link to each of your item photos, which works for a week.
You can remove an item's photo at any time; the file is deleted, not just hidden. Photos are deleted along with your account.
You can delete your account yourself at any time from Settings — this is immediate and does not require contacting us. It removes your account and the inventory data scoped to it, other than data that has become part of a shared space owned by another user, or the crowd-sourced barcode database (which is not personal data).

Your rights

If you're in the EU, EEA or UK, you can ask us to show you, correct, delete, or hand over the personal data we hold about you, to restrict how we use it, or object to a use based on our legitimate interest. Most of this you can do yourself in the app (see above); for anything else, use the contact form. You can also complain to the data protection authority where you live.

Data retention

We keep your data for as long as your account is active. If you delete your account, we delete the personal data associated with it within a reasonable period, except where retention is required by law or where the data has been anonymized (like barcode→product mappings, which aren't tied to your identity). The record of each quantity change is kept for 12 months; after that, it's combined into weekly totals per item. The record of a Plus subscription is kept while your account exists and is deleted with it; Google Play keeps its own records of the payment. Error reports are deleted after 30 days, and Google Analytics keeps usage data for 14 months.

Children

Spisko is not directed at children and we don't knowingly collect data from them. We apply the higher of the age thresholds that can apply to you: under 16 in the EU/EEA and UK (the GDPR default, absent a lower age set by your member state), and under 13 elsewhere (the US COPPA threshold).

Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above. Continued use of Spisko after a change means you accept the updated policy.

Contact us

Questions about this policy or your data? Use the contact form on the homepage.