This Privacy Policy explains what data mitbringen ("we", "us") collects when you use the mitbringen mobile app and the mitbringen.at website, how we use it, and the rights you have over it. mitbringen is operated as a personal project by an individual based in Austria. We follow the EU General Data Protection Regulation (GDPR).
The data controller for personal data processed by mitbringen is the developer of the project. You can reach us by email at vamshee3000@gmail.com for any privacy-related question or request.
We collect only what we need to run your account and your shopping list. Specifically:
Push notifications: if you allow notifications, we store your device's push token to deliver the weekly notification about your favourites on offer. The token is sent to Apple (Apple Push Notification service) or Google (Firebase Cloud Messaging) only for that purpose. It is deleted when you sign out and when you delete your account.
We share data only with the infrastructure providers we need to run the service, and only the data they need to do their job:
We do not sell your personal data. We do not share it for advertising. We do not give it to data brokers.
Account, profile, shopping-list data and shopping history is kept while your account is active and deleted on request (see Section 7). We do not delete past trips on our own; they are erased when you delete your account.
Google Analytics data from the website (only collected after you accept analytics) is kept for 2 months, the shortest retention Google Analytics offers, and then deleted by Google.
All traffic between the app and our server is encrypted with TLS. Passwords are stored as bcrypt hashes. The database and server access are restricted to the developer over SSH key authentication. We do not export or copy user data off the server, except the pseudonymised, read-only statistics view described in Section 4.
Under the GDPR you have the right to:
To exercise any of these rights, send an email from your account address to vamshee3000@gmail.com. We will respond within 30 days and, in the case of deletion, confirm once your data has been removed from active databases and backups.
The public website always sets one first-party cookie to remember your cookie choice. Google Analytics cookies are set only if you choose Accept all. We do not use advertising cookies, tracking pixels, or social SDKs.
mb_consent: remembers your choice on the cookie banner. It is strictly necessary to store that choice (TKG § 165; GDPR Art. 6(1)(f)). The value is v2.necessary.<unix timestamp> (essential only) or v2.analytics.<unix timestamp> (you accepted analytics). An older v1 value only recorded the earlier essential-only notice, so the banner asks you again. It lives 13 months, is host-only, Path=/, SameSite=Lax, and Secure on HTTPS. It is not HttpOnly because a first-party script sets it when you tap the notice — there is no network call and no consent database._ga, _ga_<id>): set by Google Analytics 4, loaded through Google Tag Manager, only after you choose Accept all. They distinguish visits and live up to 2 years. Before you accept, the website makes no request to Google at all. Advertising consent signals (ad_storage, ad_user_data, ad_personalization) are always sent as denied, so nothing is used for ads. Legal basis: your consent (GDPR Art. 6(1)(a), TKG § 165(3)).localStorage on this device. It never leaves the browser.This runs whatever you choose on the cookie banner, because it stores nothing on your device. To learn which blog articles are useful, a small first-party script on the blog pages tells our own server when an article or the blog overview is opened, and when an article has been read to the end after at least 15 seconds on the page. This is not a third-party service, and it sets no cookie and writes nothing to localStorage or any other storage on your device.
The home page view and clicks on our App Store and Google Play buttons (on any page of this website) are counted the same way: the same script type, the same pseudonymous daily visitor code, no cookie and no stored IP address. For a click we record which page, which button and which store it was. When you scan the QR code on the home page, our server counts the scan before forwarding you to the App Store or Google Play: we record the phone platform (iOS, Android or other), the store, the device class and the same pseudonymous daily visitor code, with no cookie and no stored IP address or browser string.
utm_source, utm_medium, utm_campaign), the device class (mobile, tablet or desktop), how many seconds the article was visible when it was read, and a pseudonymous visitor code. For the home page and store clicks, the page, its language, the button position and the store instead of the article; for a QR scan, the platform and store only.The footer Cookie settings link reopens the banner without clearing the stored choice until you choose again.
mitbringen is not designed for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
If we change anything material, we will update the "Last updated" date at the top and, for significant changes, notify you in the app. Continued use after a change means you accept the updated policy.
Questions about this policy or about your data: vamshee3000@gmail.com