Privacy policy

1. Who is responsible?

Mark Welge, Alte Darmstädter Str. 2, 64367 Mühltal. Contact: support@zettelchen.app.

Zettelchen is a shopping list app (web app, mobile apps later) with an optional voice assistant. This policy explains which data is processed and why.

2. Which data do we process?

Account: email address, display name, password (only as a one-way hash), for passkeys the public key and a device name. Plus settings such as language, price display and default list.

Content: lists, items, categories, quantities, notes, prices with store and date, household, invitations and guests, and for receipts the recognised text and the prices you take over. The photo of a receipt stays on your device, the text recognition runs in your browser.

Access codes for shortcuts and voice assistants (Settings, “Siri, Google and others”): a name you choose, the start of the code to recognise it, a checksum of the code (we do not store the code itself), and the time it was created and last used. When a shortcut calls Zettelchen with the code, the item lands on your list.

Feedback you send through the app: message, type, whether we may contact you, language and platform.

Reminders you create for a list: time, repetition, note and language. For a reminder we send you an email with the name of the list and the open items.

Support requests: type, subject, message, language and platform, plus ticket number, status and time, as well as follow-up questions and our replies on the ticket. We email them to ourselves and to you (confirmation with the ticket number) and answer by email.

Request for the beta (the “Request beta access” form, available without an account): your email address, optionally name and note, language, time, the beta code issued and the status of the request. We send you the code by email and also report the request to ourselves by email at support@zettelchen.app.

Request for the Alexa beta: the Amazon email address you enter, plus language, time and status of the request. It is also reported to us by email at support@zettelchen.app.

Technical data: when you open the site and when the servers are used, your IP address, the time and the requested address end up in log files at the hosting and database providers.

On your device the app stores settings and a cache of your lists so it works without a connection. This is technically necessary and not tracking.

3. Purposes and legal bases

Providing the app, sign-in, lists, reminders, household, voice assistant and support: performance of a contract (Art. 6(1)(b) GDPR).

Security, troubleshooting and abuse protection (for example request limits): legitimate interest (Art. 6(1)(f) GDPR).

Contacting you about your feedback: your consent (Art. 6(1)(a) GDPR), which you set when sending. The same applies to the beta request: when you submit it you agree that we store your details for the request and send you the code by email. And to joining the Alexa beta: when you request it you consent that we store your Amazon address and use it for the invitation (Art. 6(1)(a) GDPR).

Storage in your browser is required to operate the app. We do not use advertising or analytics cookies.

4. Who receives data?

We use service providers who process data on our behalf:

Supabase (database, sign-in, functions), region Europe (Frankfurt). Provider: Supabase Inc., USA.

Netlify (hosting of the web app). Provider: Netlify, Inc., USA.

Resend (sending emails such as "reset password" and reporting a beta request to us), region Europe (Ireland). Provider: Resend, USA.

ImprovMX (forwarding incoming mail to support@zettelchen.app). Provider: ImprovMX, USA.

Amazon (Alexa), only if you connect the skill to your account. Alexa then sends the recognised item name to our server. Amazon's own terms also apply.

When the app loads, files are fetched from third-party servers (Google Fonts and Flutter files from gstatic.com). When you first read a receipt, your browser loads the text recognition from jsDelivr. That provider then sees your IP address.

We do not sell your data or pass it on for advertising. Members of your household see the household's lists, items and prices. Guests only see the list they were invited to.

5. Transfers to third countries

Some providers are based in the USA. Transfers rely on the adequacy decision (EU-US Data Privacy Framework) or on standard contractual clauses. Your content is stored in the EU.

6. How long do we keep data?

Checked items are deleted automatically after 30 days, with Pro after 90 days.

Account and content until you delete your account. Then your account, feedback, support requests, reminders, access codes and beta request are deleted, and if you are alone in the household or delete it for everyone, the household with all its data as well. Backups and logs expire after a short period.

Beta requests are deleted after 90 days. If you registered, the address is only kept in your account afterwards.

Incoming mail to support@zettelchen.app is deleted once handled.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR) and to withdraw consent with effect for the future.

You can delete your account yourself: Settings, "Delete account". For anything else write to support@zettelchen.app.

You can complain to a data protection authority, for example where you live.

8. Changes

We update this policy when the app or the law changes. Last updated: 18 October 2026.