Cartly+

Privacy Policy

Last updated: 10 October 2026

S10 Solutions OÜ (“we”, “us”) operates Cartly+ and is responsible for the personal data described here. This policy covers our iOS and Android apps, the web app at app.cartly.plus, Apple Watch and Wear OS companions where available, connected-assistant service at mcp.cartly.plus, and this website. Contact support@cartly.plus about privacy or your data.

At a glance

1. Data we process and why

Accounts and authentication

We process your email address, account identifier, display name, authentication sessions and sign-in provider identifiers to create and secure your account. Email/password sign-in uses Supabase authentication; Apple or Google sign-in provides the information allowed by that provider and your settings. Apple’s Hide My Email may provide a relay address. Session information and preferences are stored on your device or browser so you can stay signed in.

Households, lists, chat, recipes and meal plans

We store household names, memberships, roles and invitations; shopping item names, quantities, units, categories, notes, planned dates and completion state; chat messages, author display names, timestamps and read receipts; and saved recipe titles, ingredients, instructions, servings, source links and meal-plan entries. Record identifiers and update versions support synchronization and reliable edits.

Members of a household can access its shared content within their permissions. A read receipt can tell other members that you have read a message. Invitations and join codes grant access to household information, so share them only with intended members. These features are not end-to-end encrypted messaging: Cartly+ and its infrastructure providers process content to deliver the service.

Notifications

We store device notification tokens, platform information and notification preferences to deliver updates. Notification payloads may include a household name, an author name, a shopping item or a message preview. Apple and Google notification services process the payload and delivery information. Previews may appear on a locked phone or paired watch depending on your device settings.

Purchases and support

Apple or Google processes purchases made through its store. RevenueCat manages subscription status and entitlements using account identifiers, transaction information and, where supplied by the app, email addresses. We do not receive your full payment card details. If you contact us or send in-app feedback, we process your message, contact details and associated account or diagnostic information to respond. Feedback emails are delivered through Resend.

2. AI features

Recipe import and translation

When you ask to import a recipe, our server fetches the public webpage you supply and sends extracted recipe/page text to the OpenAI API to structure it in your selected language. The source website receives the server’s request. When you ask to translate a saved recipe, we send its title, instructions, ingredient names and notes, together with the requested language, to OpenAI. These actions do not send your entire household conversation or shopping history.

We disable storage of these AI completions for later retrieval through the API. This does not disable all provider-side security or abuse-monitoring retention. OpenAI processes API data under its applicable service terms and privacy policy. We store the resulting recipe when you save it, cache import/translation results, and record account/household-linked usage, timing and budget information to enforce limits and avoid duplicate processing. Do not submit private access links or sensitive personal information in recipe text. Review the result before saving or using it.

Connected AI assistants

Connecting an assistant is available on Free and Premium and requires explicit sign-in and authorization. The connection can access all households and shopping lists available to that account; it is not a per-household or read-only permission. It can read, add, update, mark as bought and remove shopping items. Responses may contain household names, item names, dates, quantities, units, categories, notes, completion state and record identifiers. If you additionally approve recipe and meal-plan access, the connection can read, create, update and archive saved recipes, and read, add, update and remove planned meals in those households. Responses can include recipe titles, ingredients, instructions, source links, servings, meal dates, meal slots and identifiers. Existing shopping-only connections do not gain this access without a new authorization. The connector does not provide tools for chat messages or account deletion.

The service runs on Cloudflare and uses Supabase for authentication, shopping, recipe and meal-plan data. Renewable account credentials used by the connection are stored encrypted. Your password and Apple or Google sign-in credentials are not shared with the assistant. Request-duration logs used by the connector do not include shopping-list content or authentication secrets.

Temporary sign-in transactions expire after ten minutes. Access tokens expire after five minutes; renewable connection tokens have a thirty-day lifetime and may be renewed while in use. You can disconnect assistants at Manage connections. Existing access tokens may take up to five minutes to expire. Disconnecting does not erase information already received by an assistant; use that provider’s privacy and deletion controls as well. See our connection guide.

3. Watches, widgets and voice input

Apple Watch and Wear OS companions exchange shopping-list information and actions with the paired phone using Apple WatchConnectivity or Google’s Wear OS services. This includes household/list titles, item names, categories, identifiers, completion information and the text you enter to add an item. The phone performs authenticated operations against Cartly+. Watch companions require a reachable paired phone with internet access; they are not independent offline accounts.

Home-screen widgets store a local snapshot of today’s pending items, household name, record identifiers and update information. Watches may retain a pending addition or draft so a retry does not add the same item twice. Information already displayed or cached on a device may remain until it refreshes or local app data is removed. Protect shared devices and remove widgets or companion apps when you no longer want list information shown there.

If you choose system dictation, Siri, Apple Shortcuts or a supported Google voice action, the platform handles your voice input under its own settings and privacy terms. Cartly+ receives the resulting text or requested action; these features do not upload raw microphone recordings to Cartly+ servers.

4. Analytics, diagnostics and advertising

On iOS, App Tracking Transparency controls permission for cross-app tracking and access to the advertising identifier. The app configures Meta’s advertiser-ID collection according to that status. Declining tracking does not switch off account processing, operational diagnostics or every analytics/app event. Manage tracking in Settings → Privacy & Security → Tracking; Android advertising controls are available in your device’s Google/Ads privacy settings. Applicable platform permissions and consent requirements continue to apply.

Website and browser storage

Cloudflare hosts our website, web app and connector and processes request information such as IP addresses, URLs and technical/security logs. Our marketing website’s click counter records the button type, page section and public website page path for store, web-app, invite and preview clicks; those event fields contain no account ID, shopping content, URL query parameters or referrer. The web app uses local/browser storage for authentication and preferences, and Firebase Analytics may use browser identifiers. Connector sign-in uses short-lived security cookies. Clearing browser data can sign you out.

5. Recipients and international processing

We use the following providers for the purposes described above:

We also disclose shared content to household members and may disclose information when required by law, to address abuse or to protect legal rights. We do not sell personal data for money. Advertising and matching disclosures are described above rather than treated as anonymous sharing.

Providers may process data outside your country, including outside the EEA. Where GDPR transfer rules apply, transfers require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses. Contact us for information about the safeguards applicable to your data.

6. Purposes and legal bases

Where the GDPR applies, we process account and shared-feature data to perform our agreement with you; subscription and legally required records to meet contractual or legal obligations; and proportionate security, fraud prevention, support and service-reliability processing for our legitimate interests. Optional tracking or device storage that requires consent relies on that consent. You may withdraw consent without affecting earlier lawful processing. These bases do not make accepting optional tracking a condition of using shared shopping features.

7. Retention and deletion

Dated shopping items are automatically removed more than 30 days after their planned shopping date, whether checked or unchecked. For Main list, checked items are removed 30 days after checking; unchecked items are not automatically expired. Unchecking a Main list item cancels its removal countdown.

Account and household content is retained while needed to provide the service, until deleted, or while a continuing household still uses shared records. Operational, support, purchase and AI-usage records are retained according to their purpose, applicable legal requirements and provider retention settings. Import results may be cached separately from saved recipes. Backup copies and provider records are not necessarily erased at the same moment as live account data.

Account deletion removes your authentication identity, profile, membership links, notification tokens and user-scoped records handled by the deletion process. A household with no remaining members is removed. Shared households with other members remain, and administration can transfer to another member. Shared shopping items, recipes, meal plans and chat history can remain. Account links are removed, but existing chat display names and personal information in shared text can remain. Contact us if shared content needs a separate erasure assessment. See the full deletion instructions.

Deleting an account does not cancel a store subscription or delete copies already received by household members, notification services or external assistants. You can also clear local app/browser data on devices you no longer use.

8. Your choices and rights

You can edit supported profile fields, manage household access, change notification permissions, disconnect assistants and delete your account. For access, correction, erasure, restriction, objection or a portable copy of your data where applicable, email support@cartly.plus. We may need to verify account ownership; never send us your password. We respond within applicable legal deadlines, normally one month for GDPR requests, and explain any lawful extension or exception.

You can complain to your local data-protection authority. In Estonia, contact the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). For a request concerning data Meta received from Cartly+, use the same support address with the subject “Meta data deletion request”.

9. Security and children

We use access controls, authenticated connections and other technical safeguards. No service can guarantee absolute security. Cartly+ is not directed to children under 13, or a higher minimum age where applicable. Contact us if a child has provided data without the authorization required by law.

10. Changes and contact

We update this policy when our practices change, revise the date above and provide additional notice where required. For privacy questions, support, content reports or legal/DSA inquiries, contact S10 Solutions OÜ at support@cartly.plus.