Privacy Policy for Kraut

1. Introduction

Kraut (“we”, “our”, or “us”) is a smart shopping list and inventory management application. This Privacy Policy explains how we collect, use, and protect your personal information when you use our mobile application and website.

2. Information We Collect

2.1 Account Information

• Email Address: Collected when you sign in with Google, Apple, or email (via Clerk authentication service)
• Name: Your display name from your authentication provider
• Profile Image: Your profile picture from your authentication provider
• Username: Optional custom username you choose

2.2 Device Information

• Device Identifier: A unique app ID generated for each device installation
• Device Metadata: Platform (iOS/Android), device brand, model, operating system version
• Device Token: For push notifications (only if you enable notifications)

2.3 Usage Data

• Shopping Lists: Lists you create, including names and descriptions
• Shopping Items: Products you add to lists, including names, quantities, notes, and prices
• Product Photos: Images you take or upload for shopping items
• Purchase History: Records of items you've marked as purchased, including location, date, and business information
• Location Data: Your current location (only when actively using location features) to find nearby stores and businesses, detect shopping locations automatically, and provide location-based suggestions
• Real-Time Activity: Connection status and activity indicators when using shared lists

2.4 Shared Data

• When you share shopping lists with other users, they can see the list name, items, and any photos you've added
• Your username and profile image may be visible to users you share lists with

3. How We Use Your Information

3.1 Core Functionality

• To provide shopping list management and sharing features
• To sync your data across multiple devices in real-time using Socket.IO technology
• To enable collaboration on shared shopping lists with live updates
• To send push notifications about shared lists, items, and shopping activity (if enabled)
• To show your online/offline status to users you share lists with
• To provide purchase history tracking and analytics

3.2 Location Services

• To find nearby stores and businesses when you're shopping
• To automatically detect when you're at a shopping location and notify users you share lists with
• To track where you've purchased items for your personal purchase history
• To provide location-based AI suggestions for repeat purchases
• Location data is only used while the app is active and you have granted location permissions
• Location tracking can be disabled at any time in app settings

3.3 Camera and Photos

• To take photos of shopping items
• To scan barcodes for product identification
• To access photos from your device library to add to shopping items
• Photos are compressed and stored on our servers
• If you have a product photo analysed to suggest a product name, brand and description, that photo is transmitted to our service provider Anthropic PBC (USA) and read there by an AI model (see 5.6)
• The photo is not permanently stored for this analysis. If you then save the item, the point above applies: the photo is stored on our servers
• The suggestions are non-binding. They are shown to you in the form for review and are only adopted when you save
• Please note that product photos often capture their surroundings as well (hands, rooms, shops, other people). The image is transmitted as you took it

4. Data Storage and Security

4.1 Data Storage

• Your data is stored on secure servers using MongoDB
• Product photos are stored on our servers and associated with your account
• Some data is cached locally on your device for offline functionality

4.2 Data Security

• We use industry-standard security measures to protect your data
• Authentication is handled by Clerk, a trusted third-party authentication service
• Data transmission is encrypted using HTTPS

5. Third-Party Services

5.1 Clerk

We use Clerk for user authentication (Google, Apple, Email sign-in). Clerk processes your authentication credentials according to their privacy policy.  Learn more

5.2 Expo

We use Expo's push notification service to send you notifications. Your device token is shared with Expo's servers for notification delivery.  Learn more

5.3 Socket.IO / Real-Time Services

• We use Socket.IO technology to provide real-time updates for shared lists
• Your connection status (online/offline) is tracked while using the app
• Real-time data is transmitted through secure WebSocket connections

5.4 Google Play Services (Android)

Android devices use Google Play Services for certain app functionality.  Google's privacy policy applies

5.5 Website Contact Form

• Our website uses a contact form powered by Nodemailer and Gmail SMTP
• Messages sent through the contact form are delivered to service@kraut.net
• Contact form submissions include your name, email, and message content

5.6 Anthropic (AI features)

For AI-assisted features we use the API of Anthropic PBC, San Francisco, USA. The following is transmitted:

• Product categorization: product name, brand and description, in order to suggest a matching product category
• Photo product identification: the photo you took, in order to suggest a product name, brand and description

Your name, email address, account identifier, lists and location are not transmitted.

Anthropic processes this data as a processor acting on our instructions, under Anthropic's Data Processing Addendum, which is incorporated into their Commercial Terms by reference. Under those Commercial Terms, Anthropic does not use transmitted content to train its models. According to Anthropic, API inputs and outputs are automatically deleted within 30 days, unless they have to be retained longer to enforce their usage policies or to comply with the law.  Learn more

Processing takes place in the USA. Anthropic states that it relies on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) for transfers to third countries.

For cost control we log technical metadata for each AI call: timestamp, model, number of tokens processed, cost, duration and success. These logs contain no photo or product content and are kept for 400 days. If you delete your account, the link between these logs and your account is removed.

5.7 UPCitemdb (barcode database)

When you scan a barcode, we send the barcode number to the UPCitemdb product database to retrieve product data. If a product search in the app returns too few matches from your own data, we also send the search term you typed to UPCitemdb in order to obtain further product suggestions. No information about you or your account is transmitted.  Learn more

5.8 OpenStreetMap / Overpass

To find shops near you we query the Overpass service of the OpenStreetMap project. The coordinates of the area being searched are transmitted, not your account data. The query is made from our servers, so your IP address is not passed to OpenStreetMap.  Learn more

5.9 DigitalOcean (hosting)

Our servers and database run on DigitalOcean. The data centre we use is located in Frankfurt am Main, Germany. DigitalOcean processes the data stored there as a processor on our behalf.  Learn more

6. Anonymous Usage

You can use Kraut without creating an account. In this case:

• A unique device identifier is generated for your installation
• Your shopping lists and items are associated with this identifier
• You can later sign in to sync this data to an account
• Anonymous data is treated with the same security measures as authenticated accounts

7. Data Sharing

7.1 With Other Users

• When you share a shopping list, other users can see the list contents and any photos
• Your username and profile image are visible to users you share with
• Users you share lists with can see when you're online and actively using the app
• Users you share lists with can see when you start shopping at a location (if notifications enabled)
• Your purchase activity may be visible to users you share lists with in real-time

7.2 We Do Not Sell Your Data

• We do not sell, rent, or trade your personal information to third parties
• We do not use your data for advertising purposes

8. Your Rights

8.1 Access and Deletion

• You can access your data through the app
• You can delete your account and all associated data at any time through the app settings
• Account deletion removes all your shopping lists, items, photos, and purchase history

8.2 Data Portability

• Your shopping lists and items can be accessed and managed through the app
• You can delete individual lists or items at any time

9. Children's Privacy

Kraut is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date.

11. Contact Us

If you have questions about this Privacy Policy, please contact us at: