ShoppyFoxx Privacy Policy
Who is responsible
ShoppyFoxx is run by two companies that are joint controllers of your personal data (GDPR Article 26) and are equally responsible for it:
- KheniTech, a sole proprietorship of Dharmesh Tulshibhai Kheni, 3rd Floor, Plot 15, Sangana Row House, P-1, Shyam Dham Chowk, Punagam, Surat, Gujarat 395006, India. GSTIN 24CAFPK6077E1ZR. KheniTech publishes the app on the App Store and Google Play.
- DNA TECHBASE S.R.L., Aleea Romanilor nr. 23, bl. 12, sc. 2, ap. 107, Deva, jud. Hunedoara, 330107, Romania. Trade register J2025048383009, CUI 52084942. DNA TECHBASE S.R.L. is also KheniTech’s representative in the European Union (GDPR Article 27).
You can contact either of them about anything in this policy at contact@shoppyfoxx.com, and exercise your rights against either one.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your name, email address and a user id, from Sign in with Apple or Google Sign-In. With Apple you may hide your email; we then receive an Apple relay address. | To give you an account and keep your lists on all your devices. | Contract (providing the app you asked for) |
| Your lists and items: names, notes, quantities, units, prices and budgets, reminder dates, the shop name you type, and the photos you add to items or your profile. | To store and show your shopping lists. | Contract |
| Crash reports: what went wrong in the app, device model, operating system and app version, and your user id (not your name or email). | To find and fix crashes. | Legitimate interest in a working app |
| App integrity check: a token from Apple (DeviceCheck) or Google (Play Integrity) that confirms requests come from the genuine app. | To protect your data from abuse of our servers. | Legitimate interest in security |
| Messages you send us: your email address, what you write, and the app version, platform and user id the app adds to a support email. | To answer you. | Legitimate interest in answering requests |
ShoppyFoxx 2.0 has no analytics, no advertising and no tracking, and does not sell or share your data for advertising. Reminders are scheduled on your device; their content does not leave it. The shop name you type is stored with your item and handed to Apple Maps or Google Maps only when you tap Directions.
Who receives it
- Google (Firebase): account sign-in, the database and photo storage, crash reports (Crashlytics), the app integrity check (App Check), and our backups. Google processes this data for us.
- Apple and Google as sign-in providers, when you choose Sign in with Apple or Google Sign-In, and for the integrity check above.
- Google Workspace: our support mailbox, when you write to us.
- KheniTech’s internal administration tool, which can read the list of sign-in accounts (name, email, user id) to support users and run the service. It does not read your lists.
We do not give your data to anyone else, unless the law requires it.
Where it is kept
Your account, lists, photos and backups are stored by Google in the United States (Firestore multi-region nam5, Cloud Storage us-central1). Crash reports are processed by Google in the United States.
For transfers from the EU, EEA, UK and Switzerland to the United States we rely on Google LLC’s certification under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. Data Privacy Framework), and on the Standard Contractual Clauses in Google’s Cloud Data Processing Addendum, which we have accepted for ShoppyFoxx.
How long we keep it
- Your account, lists, items and photos: until you delete your account. Deleting it removes them from our database and storage at once.
- Backups (used only to recover from a failure): erased automatically within 180 days.
- Crash reports: kept for Firebase Crashlytics’ standard period (90 days).
- Support emails: as long as needed to answer you, then deleted.
Deleting your account
In the app: Profile → Delete my account. Without the app: see how to delete your account. With Sign in with Apple, deletion also removes ShoppyFoxx from your Apple ID’s apps.
Your rights
You can ask for a copy of your data, its correction or deletion, to restrict or object to its use, and to receive it in a portable format. Write to contact@shoppyfoxx.com; we answer within one month. You can also complain to a data protection authority, for example the one where you live or Romania’s ANSPDCP (dataprotection.ro).
Children
ShoppyFoxx is rated 4+ on the App Store and is meant for anyone who keeps shopping lists. It has no ads and no analytics. We do not knowingly collect more data from children than the app needs to work.
ShoppyFoxx 1.0 (older iPhone version)
Until you update to 2.0, version 1.0 also does the following, which 2.0 no longer does:
- sends your name and email with crash reports to Google Crashlytics;
- uses Google Analytics for Firebase and Firebase Performance, which collect usage statistics, a device identifier and an approximate location derived from your IP address;
- sends what you type when searching for a shop to Google Maps Platform (Places), and stores the chosen shop’s map location with the item.
Updating to 2.0 stops these.
Changes
We will update this page when the app changes what it does with your data, and change the date at the top.