Legal

Privacy Policy

Last updated: 27 September 2026

BasketPal (“BasketPal”, “we”, “us”) is a mobile app that keeps a live running total of your shopping as you add items by voice. This policy explains what personal data we process when you use the BasketPal app and website, why, and the choices you have. We are the controller of this data. Questions or requests: hello@basketpal.app.

The short version

• Your basket, budget and onboarding answers stay on your phone.
• We never receive audio. Your phone turns speech into text; we receive the text of a voice command so we can update your basket, and we don’t keep it.
• We don’t show ads, don’t sell or share your data for advertising, and don’t use analytics or tracking SDKs.
• Payments are handled by Apple or Google. We never see your card details.

What we collect and why

Your account

When you create an account we store your email address, the name you give us, and a hash of your password (never the password itself). If you sign in with Apple, Google or Telegram, we receive an identifier for that account and, where the provider shares it, your email and name. We also keep sign-in session records (a hashed refresh token, when it was last used and the device type) so you stay signed in and can be signed out securely. We use this to provide your account and keep it secure.

Voice commands

BasketPal uses the microphone only while you hold Push to place. Speech recognition is done by your phone’s operating system: when the language is installed for offline use, it happens on the device; otherwise Apple or Google may process the audio under their own privacy terms. BasketPal never receives or stores audio.

When you release the button, the app sends our voice service the text of what you said (and the recognizer’s alternative readings), your voice language and currency, and the names, prices and quantities of the items currently in your basket. We use this only to work out the change to your basket, and we send it to our AI provider, Anthropic, to do so (see “Who we share data with”). We do not store the text of your voice commands. Our service logs record the time, your account identifier, how many items changed and technical details such as response time; they do not contain what you said or your item names.

Your basket and preferences

Items, prices, quantities, budgets, currency, voice language and your answers to the onboarding questions are stored on your device. They are not uploaded to our servers, except for the basket contents sent with a voice command as described above.

Notifications

If you turn on notifications, we store a push token for your device, its platform (iOS or Android) and your account identifier, so we can send you reminders and updates. You can turn notifications off in the app or in your phone’s settings at any time.

Subscriptions

Subscriptions are bought through the App Store or Google Play. Apple or Google processes the payment; we only learn whether your subscription is active so we can unlock the app.

Emails

We send account emails, such as email verification and password reset. We don’t send marketing emails without your consent.

Technical data

Like any online service, our servers receive your IP address and basic request information. We use it to operate the service, prevent abuse (for example rate limiting) and fix problems.

Legal bases (EEA and UK)

• Contract: to provide your account, voice commands, notifications you ask for, and your subscription.
• Legitimate interests: to keep the service secure, prevent abuse and fix errors.
• Consent: for microphone and notification permissions, which you can withdraw in your phone’s settings.
• Legal obligation: where we must keep records by law.

Who we share data with

We share personal data only with service providers that process it for us, under contract:

• Anthropic — AI processing of voice command text and basket items, to work out basket changes.
• Railway and our other cloud hosting providers — hosting our servers and databases.
• Expo, Apple (APNs) and Google (Firebase Cloud Messaging) — delivering push notifications.
• Resend — sending account emails.
• Apple, Google and Telegram — when you choose to sign in with them.
• Apple and Google — subscription purchases, and speech recognition by your phone.

We may also disclose data if the law requires it, or to protect our users or the service. We never sell your personal data.

International transfers

Some of these providers process data outside your country, including in the United States. Where data leaves the EEA or UK, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep data

• Account data: until you delete your account.
• Sign-in sessions: until they expire or you sign out.
• Voice command text: only for the time needed to process the command.
• Push tokens: until you turn notifications off, sign out, or delete your account.
• Server logs: for a limited period, for security and troubleshooting.
• Data on your device: until you remove it or delete the app.

Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict certain processing, and withdraw consent. To delete your account and its data, or to make any other request, email hello@basketpal.app from the address on your account. We will respond within one month. You can also complain to your local data protection authority.

Children

BasketPal is not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Security

We protect data in transit with encryption, store passwords only as hashes, keep sign-in tokens in your phone’s secure storage, and limit access to our systems.

Changes to this policy

We may update this policy. We will change the date at the top and, for significant changes, let you know in the app.

Contact

Email hello@basketpal.app.