Privacy Policy

Last updated 18 October 2026 — Version 2026-10-18

This Privacy Policy for the private individual acting as ClimateCart (full name and contact details in section 14 at the end of this policy) ("we", "us", "our"), explains how we access, collect, store, use, and share ("process") your personal information when you use our mobile application ClimateCart or its web version at app.climatecart.app (the "Services").

ClimateCart is a mobile application that estimates the environmental footprint of grocery purchases. Users scan or upload their grocery receipts, which are processed via optical character recognition to identify products and calculate an estimated environmental footprint based on publicly available environmental impact databases. Users may optionally create an account to save their scan results.

Questions or concerns? Contact us at contact@climatecart.app.

1. Summary of key points

• What we collect from you: your email address and hashed password (at signup); your language preference; the results of receipt scans you choose to save; anonymous usage events (such as which features you use); and which product-match corrections you make when reviewing scan results.
• What we do not store: receipt images and PDFs you upload for scanning, and the text extracted from them, are processed transiently and discarded immediately after processing. We do not store IP addresses, device identifiers, or location data. Our web host and our captcha provider receive your IP address to deliver and protect the Services; we do not receive or store it.
• Sensitive information: we do not process special-category (sensitive) personal data as defined in Art. 9 GDPR.
• Sub-processors: Supabase (Frankfurt, EU) for authentication and database, Render (Frankfurt, EU) for backend hosting, and Google Cloud Vision (United States) for optical character recognition of receipt images only. Cloudflare (web version hosting) and hCaptcha (bot protection), both United States companies.
• Your rights: you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to lodge a complaint with a supervisory authority.
• Retention: we keep your data only for as long as your account is active. When you delete your account, all associated data is permanently and immediately removed. Accounts inactive for 24 consecutive months are automatically deleted along with all associated data.

2. What information we collect

2.1 Information you provide directly

When you create an account and use ClimateCart, we collect and store the following personal information:

• Your email address (used as your account identifier and for password-reset emails).
• Your password, stored only as a hash by our authentication provider.
• Your language preference (Dutch, French, or English).
• The saved results of your receipt scans, including the receipt date, an optional name you assign to the receipt, the product-level breakdown, the calculated total carbon footprint, and optionally your household size. This information is stored only if you choose to save a scan while signed in.
• Timestamps recording when you accepted this Privacy Policy and our Terms of Use, and the version identifiers of the versions you accepted.

2.2 Information we process transiently but do not store

When you scan or upload a receipt:

• If it is a photo (image file), the image is uploaded to our backend and forwarded to Google Cloud Vision in the United States for optical character recognition (OCR).
• If it is a PDF, the file is uploaded to our backend and processed locally on our EU-based backend server to extract its text. PDFs are not sent to Google Cloud Vision or transferred outside the European Union.
• The extracted text is used by our matching pipeline to identify products.

Neither the receipt image, nor the PDF, nor the extracted text is stored on our servers or by our sub-processors after the scan completes. Only the calculated results are stored, and only if you are signed in and choose to save them.

2.3 Information automatically collected

We do not use third-party analytics services, tracking pixels, advertising identifiers, or advertising cookies. We do not collect or store your IP address, device identifiers, operating system version, or location data.

We automatically collect the following data, all of which is stored within our existing EU-based database infrastructure:

• Usage events: when you use certain features (such as scanning a receipt, saving results, or opening a screen), we record the event type, a timestamp, and your account identifier. These events contain no receipt content, product data, or other personally identifying information beyond your account identifier. They are used solely to understand how the app is used in aggregate and to identify technical problems.
• Match corrections: when you review your scan results and correct a product match (for example, re-matching a product to a different entry, removing a product, or editing a weight), we record the original product text from the receipt, the action you took, the corrected product name if applicable, and an identifier of the scan the correction belongs to. This data is used to improve the accuracy of our product-matching pipeline over time and to show your own progress in the app (badges). It does not include the receipt image, the full receipt text, or any other product lines from the receipt.
• Badges and milestones: which badge levels and milestone messages have been shown to you, so that each message appears only once. Your badge levels themselves are calculated from your saved scans and your match corrections; no separate data is collected for them.
• Rate-limit counters: a per-user counter of API requests, used solely to enforce fair-use rate limits and prevent abuse of our OCR quota. This counter contains no personally identifying information beyond your account identifier.
• Bot protection: when you sign up, sign in, reset or change your password or email, or scan your first receipt without an account, an hCaptcha check runs. hCaptcha receives your IP address, browser and device characteristics, and how you interact with the check, to tell people from automated abuse. It may set a strictly necessary security cookie.

All automatically collected data is deleted when you delete your account.

2.4 Storage on your device

The app keeps your language, onboarding progress, sign-in session, and dismissed messages on your device: in app storage on Android, and in your browser's local storage (localStorage) in the web version. This stays on your device. It is removed when you uninstall the app or clear the site data in your browser.

2.5 Device permissions

ClimateCart requests the following permissions on your Android device:

• Camera — required to photograph grocery receipts.
• Storage / file access — required to let you upload receipt PDFs from your device.

These permissions are used only for the specific action you take (photographing or picking a file). You can revoke either permission at any time in your Android system settings.

Web version: photos and PDFs are picked through your browser's own camera or file picker. The web version only receives the file you choose, and you manage camera access in your browser settings.

3. How we use your information

We process your personal information only for the following purposes:

• To provide the Services: authenticating your account, running the OCR and footprint-calculation pipeline on receipts you submit, storing and retrieving results you choose to save, and showing your progress in the app (badges and milestones).
• To improve the Services: recording which product matches you correct during the review step, so we can improve the accuracy of our product-matching pipeline over time; and collecting anonymous usage events to understand how features are used and to identify technical problems.
• To respond to inquiries: when you contact us at contact@climatecart.app.
• To protect the Services: preventing abuse of our infrastructure and OCR quota via per-user rate-limiting.
• To comply with legal obligations: retaining timestamps of your acceptance of this Privacy Policy and our Terms of Use as evidence of consent (Art. 7 GDPR).

We do not use your data for advertising, marketing, profiling, or automated decision-making with legal or similarly significant effects.

4. Legal bases for processing (GDPR)

Under the EU GDPR and UK GDPR, we rely on the following legal bases:

• Performance of a contract (Art. 6.1.b) for account creation, authentication, receipt processing (OCR and matching), saving your scan results, and showing your progress in the app (badges and milestones).
• Legitimate interests (Art. 6.1.f) for per-user rate-limiting, which is necessary to protect the availability and cost-integrity of the Services against abuse; for collecting usage events, which is necessary to maintain and improve the reliability and quality of the Services; and for recording match corrections, which is necessary to improve the accuracy of the product-matching pipeline that the Services depend on; and for bot protection (hCaptcha) and the request processing by our web host (Cloudflare), which are necessary to deliver the web version and to protect the Services against automated abuse.
• Legal obligation (Art. 6.1.c) for recording your acceptance of this Privacy Policy and our Terms of Use, which we are required to document under Art. 7 GDPR.

5. Sub-processors

We share personal information only with the following sub-processors, each of which acts on our documented instructions under a data processing agreement:

• Supabase (Supabase Inc., hosted in Frankfurt, Germany) — provides authentication and database hosting. Data processed: email address, hashed password, language preference, saved scan results, consent timestamps and versions, per-user rate-limit counters, usage events, match correction records, and records of which badges and milestones have been shown to you.
• Render (Render Services, Inc., hosted in Frankfurt, Germany) — provides backend application hosting. Data processed transiently: receipt image content, receipt PDF content, and the text extracted from them during the scan flow.
• Google Cloud Vision (Google LLC, processed in the United States) — provides optical character recognition for receipt images only. Data processed transiently: receipt image content. PDFs are not sent to Google Cloud Vision.
• Cloudflare (Cloudflare, Inc., global network) — hosts the web version. Data processed: IP address and standard request data (such as browser type and the page requested) needed to deliver the site. No account or receipt data passes through Cloudflare; the web version sends that directly to Supabase and our backend.
• hCaptcha (Intuition Machines, Inc., United States) — provides bot protection. Data processed: IP address, browser and device characteristics, and interaction data during the check.

We do not sell your personal information. We do not share it with advertisers, data brokers, or analytics providers.

6. International data transfers

Our primary infrastructure is located in Germany, within the European Union. Personal data stored by ClimateCart does not leave the EU. Receipts uploaded as PDFs are processed entirely within the EU.

Receipts uploaded as photos are transiently transferred to the United States for optical character recognition by Google Cloud Vision. This transfer is protected by the EU-US Data Privacy Framework, under which Google LLC is self-certified with the U.S. Department of Commerce. As an additional safeguard, Google's Cloud Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses.

Cloudflare and hCaptcha may process your IP address and technical data in the United States. Both are certified under the EU-US Data Privacy Framework, and their data processing agreements include the Standard Contractual Clauses.

7. Retention

We keep your personal information only for as long as your account is active:

• Account records (email, hashed password, language, consent timestamps): kept until you delete your account, or until your account has been inactive for 24 consecutive months.
• Saved receipt scans: kept until you delete the individual receipt, delete your account, or until your account has been inactive for 24 consecutive months.
• Usage events, match corrections, and badge and milestone records: kept for as long as your account is active. Deleted when you delete your account or when your account is automatically deleted due to inactivity.
• Rate-limit counters: deleted automatically when your account is deleted.
• Use without an account: the app then works with an anonymous user ID that is not linked to an email address. That ID and its usage data are deleted after 90 days without use. Match corrections are kept without a user ID.
• Receipt images, PDFs, and extracted text: not retained at all — discarded immediately after each scan.
• Technical data received by Cloudflare and hCaptcha: kept under their own retention terms.

Account deletion. You can delete individual saved receipts from the receipt-detail screen, or your entire account from the settings screen, at any time. When you delete your account, all associated data — profile record, saved receipts, usage events, match corrections, badge and milestone records, consent timestamps, and rate-limit counters — is permanently and immediately removed from our database. There is no grace period and deletion is irreversible.

Automatic deletion of inactive accounts. Accounts that have not been used for 24 consecutive months are automatically deleted, along with all associated data, without further notice. This is measured from your last use of the app.

Data exports. Before deleting your account, you may request a machine-readable export of the data we hold about you (see section 10, Right to data portability). Once your account is deleted, the data is no longer recoverable and we cannot fulfil any subsequent export request.

8. Security

We apply the following technical and organisational measures to protect your personal information (Art. 32 GDPR):

• All data transmission uses HTTPS with TLS encryption.
• Passwords are hashed by our authentication provider — we never store or see your plaintext password.
• Backend endpoints are protected by JWT-based authentication.
• Row-level security policies ensure that each user can access only their own data in our database.
• Per-user and per-IP rate limits protect against abuse.
• Receipt images, PDFs, and OCR text are processed in memory and never written to persistent storage.
• Our primary data-processing infrastructure is located within the EU.

No security measure is perfect. If we become aware of a personal data breach affecting your rights, we will notify the Belgian supervisory authority within 72 hours and, where required, notify you directly.

9. Children

ClimateCart is not directed at children. In accordance with Belgian law implementing GDPR Art. 8, we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at contact@climatecart.app and we will take reasonable steps to delete it.

10. Your rights under the GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your data.
• Right to restriction (Art. 18) — request that we limit how we process your data.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right not to be subject to solely automated decision-making (Art. 22). We do not make automated decisions with legal or similarly significant effects about you.

You can exercise the rights to rectification and erasure directly in the app: edit any saved receipt, delete individual receipts, or delete your entire account from the settings screen.

Access and portability requests. To request a copy of the personal data we hold about you, or a machine-readable export of your account data, please email us at contact@climatecart.app from the email address associated with your ClimateCart account. We will provide a JSON export of your profile record and saved receipts within 30 days of receiving your request (Art. 12.3 GDPR). If you are unable to email from your account address, we may ask for additional information to verify your identity before we release your data.

Right to complain. If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Belgian supervisory authority, the Gegevensbeschermingsautoriteit / Autorité de protection des données (gegevensbeschermingsautoriteit.be), or with the supervisory authority in your country of residence.

11. Do Not Track

Neither the app nor its web version tracks your browsing. We use no analytics or advertising cookies, web beacons, or other tracking technology, so there is nothing for a Do Not Track signal to affect. The only cookie is hCaptcha's strictly necessary security cookie.

12. Third-party links

ClimateCart contains a link to Ko-fi, an external donation platform we use to accept optional donations. When you tap that link, you leave the ClimateCart app and Ko-fi's own privacy policy applies to your interaction with them. We do not share your ClimateCart account data with Ko-fi.

13. Updates to this Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. If we make material changes, we will update the version and date at the top of this page.

14. Contact

The data controller responsible for your personal information is: