Privacy Policy

Last updated: November 5, 2026

Cartlas™ is a grocery list and in-store routing app. This policy explains exactly what it stores, where, and how to get rid of it. It is short because the app collects very little.

The summary: you can use Cartlas™ entirely on your device without an account, and nothing leaves your phone. If you create an account, your email, name and your grocery data sync to our server so you can use more than one device. There is no advertising, no analytics, no tracking, and nothing is ever sold or shared for marketing.

1. Who we are

Cartlas™ is operated by Ariel Quintanilla, who is the controller of your personal data and responsible for it under data protection law. You can reach us at support@cartlas.app.

2. Using Cartlas™ without an account

An account is optional. Signed out, the app is fully functional and every piece of your data — your list, departments, store map, saved layouts and saved lists — is stored only in your device's local storage. We do not receive it, and we cannot see it. Deleting the app deletes that data.

3. What we collect when you create an account

Account information

Email address — your login identifier, where we send a link to confirm the address when you sign up and password-reset links you request, and the way we would contact you about the service.
Name — optional, and used only to display in the app. If you leave it blank, we use the part of your email before the "@".
Password — stored only as a salted hash. We never store or have access to your actual password.
Sign in with Apple identifiers — if you sign in with Apple, we store the account identifier and tokens Apple returns so we can keep you signed in.

Session information

Each time you sign in we create a session record containing a session token, its expiry, and the IP address and device user-agent string that the sign-in came from. This is used to keep you signed in and to help identify suspicious account access. Sessions are deleted when you sign out, and within an hour of expiring.

To protect accounts from password guessing and abuse, we also briefly keep the IP address that requests to sign in, sign up and other account actions came from. These records are deleted within an hour. Email-confirmation and password-reset links stop working when they expire, and their records are deleted within an hour of that.

Your Cartlas™ data

When you are signed in, the app uploads your app state so it can be restored on your other devices. That is:

Grocery items — names, quantities, department, and whether they are checked off
Departments and custom categories you create, with their emoji and colour
Your store map layouts, including saved layouts for different stores
Saved item lists (for example a recurring weekly list)
Your item history, which is what powers the per-department suggestions

This is stored as a single record tied to your account identifier. We do not analyse it, profile you with it, or use it for any purpose other than syncing it back to you.

4. What we do not collect

No location data. The app does not request or use location services. The store map is a layout you draw yourself, not a real-world position.
No analytics or crash SDKs. There are no third-party tracking libraries in the app.
No advertising identifiers (IDFA), and no tracking across apps or websites.
No access to contacts, photos, camera, microphone, or health data.
No payment information. The app does not take payments.

5. How we use the information

We use it only to operate the service: to authenticate you, keep you signed in, sync your data between your devices, and secure the account. We do not sell personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles.

6. Where it is stored, and who else can see it

The backend runs on Cloudflare Workers with data in Cloudflare D1, and account emails such as password resets are sent through Cloudflare Email Service. Cloudflare processes and stores the data on our behalf as a service provider and may process it in the United States and other countries where it operates. Apple processes your sign-in, under its own privacy policy, if you use Sign in with Apple. Those are the only third parties involved. Data is transmitted over HTTPS.

Our service providers, including Cloudflare, process your data only on our instructions and under written agreements that require them to protect it to at least the standard described in this policy.

Some of our providers process data outside your country, including in the United States. Where the law requires a safeguard for that transfer, they rely on the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses (with the UK Addendum for data from the UK).

7. How long we keep it

Account and synced data are kept for as long as your account exists. Session records expire on their own. When you delete your account, the deletion happens immediately — see below.

8. Deleting your data

To delete your account, go to Account → Delete Account in the app. We may ask you to confirm with your password or by re-authenticating with Apple. This permanently deletes your user record, all of your sessions, any linked sign-in provider, and your entire synced Cartlas™ data record, and revokes the Sign in with Apple authorization for Cartlas™. It cannot be undone.

The list and map currently on that device stay on the device, and you can keep using the app signed out. Deleting the app then removes them too.

You can also email support@cartlas.app to request deletion.

9. Your rights

Depending on where you live — including under the GDPR in the EU/UK and the CCPA/CPRA in California — you have the right to access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable form, to object to or ask us to restrict how we process it, and not to be discriminated against for exercising those rights. You can exercise access, correction and deletion directly in the app's Account screen. For anything else, including a copy of your data (which we send as a JSON file), email support@cartlas.app. We aim to respond within 30 days.

You can withdraw your consent at any time by deleting your account in the app or by emailing support@cartlas.app.

Where the GDPR applies, our legal basis for processing your account and synced data is the performance of our contract with you (providing the app), and for session and security data our legitimate interest in keeping accounts secure.

You also have the right to complain to a data protection authority: in the UK, the Information Commissioner's Office (ICO); in the EU, the authority in your country. We would appreciate the chance to resolve your concern first, so please contact us.

10. Children

Cartlas™ is not directed to children under 13, and we do not knowingly collect personal information from them. Some countries, including several in the EU, set the age of digital consent higher, up to 16. If you live in one of them and are under that age, you need a parent or guardian's consent to create an account. If you believe a child has created an account, contact us and we will delete it.

11. Security

Traffic is encrypted in transit with HTTPS, passwords are stored only as salted hashes, and sessions are token-based and expiring. No system is perfectly secure, so please use a strong, unique password. If a data breach affects your personal information, we will notify you as required by applicable law.

12. Changes to this policy

If this policy changes materially we will update the date at the top and, where appropriate, notify you in the app. Continuing to use Cartlas™ after a change means you accept the updated policy.

13. Contact

Questions about this policy or your data: support@cartlas.app.