Privacy Policy

01Data we collect

We only collect what the app needs to do its job. That falls into a few categories:

What

Details

Account

Your email address and an encrypted password (or the identifier from your chosen sign-in provider), so you can log in and sync across devices.

Saved links

The product URLs you add, plus the title, price, and image we automatically extract from each page so your cart is readable.

Uploaded photos

Any images you attach to an item yourself. Stored only to display them back to you.

Push token

A device token used solely to send the reminder when an item's 48-hour cool-down ends. No token, no notifications.

Currency preference

The currency you pick, so prices and savings totals display correctly.

Analytics events

Aggregated, non-identifying usage events via Firebase Analytics (e.g. "item added", "screen opened") to understand what to improve.

We do not collect payment card details — Cold Cart never processes purchases — and we do not sell your personal data to anyone, ever.

02How we use it

To run the core feature — hold your saved items, run the cool-down timer, and remind you when it ends.
To display your cart — the extracted title, price, and image make each saved link recognisable.
To sync your account — so your cart follows you across devices.
To improve the app — aggregated analytics show us which features help and which need work.
To respond to you — when you email us for support or exercise a data right.

We never use your data for third-party advertising, and we don't build advertising profiles about you.

Under the GDPR, our legal bases for processing are: performance of a contract — running your account and the core features; legitimate interest — aggregated analytics and keeping the service secure; and consent where required, such as push notifications, which you can withdraw at any time in your device settings.

03Service providers

To operate Cold Cart we rely on a small set of trusted infrastructure providers. Each processes only the data needed for its function, under its own privacy terms:

HetznerServer hosting (EU) — stores your account and saved items.

CloudflareCDN, security, and image delivery.

Google / GeminiFirebase Analytics, and AI processing of product pages to extract title & price.

Scrape.doFetches product pages so we can read their public details.

ResendSends transactional email (verification, account notices).

ExpoDelivers push notifications for cool-down reminders.

Some of the providers above (Cloudflare, Google, Resend, Expo) are based in the United States, so limited data may be transferred outside the EEA. Such transfers rely on recognised safeguards — the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

04Affiliate links

Some outbound product links in Cold Cart may be affiliate links. If you buy through one, we may earn a small commission at no extra cost to you.

This never changes the price you pay, never affects which items you can save, and never influences the cool-down process. It simply helps support the app.

05Retention & deletion

We keep your data only for as long as your account exists. You can delete everything yourself, at any time:

In-app deletion — open Settings → Delete account. This permanently removes your account, saved items, uploaded photos, and preferences from our servers.
By email — write to [email protected] and we'll process the deletion for you.

Once deleted, data cannot be recovered. Some minimal records may persist briefly in encrypted backups before being overwritten on their normal cycle.

06Your GDPR rights

If you're in the EEA or UK, you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — have your data deleted (see section 05).
Restriction & objection — limit or object to certain processing.
Portability — receive your data in a portable format.
Complaint — lodge a complaint with your local data-protection authority.

To exercise any of these, email us and we'll respond within 30 days.

07Children

Cold Cart is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we'll delete it promptly.

08Contact

Questions about this policy or your data? Reach the developer directly at [email protected]. Cold Cart is operated by an individual developer, who is the data controller for the purposes of GDPR.