Sync & Shop ("the app") is operated by ALGOTECH UNLIMITED SRL, a company registered in Romania, registration number RO43636142, with its registered office at Str. Labirint Nr.43, Constanța, România ("we", "us", "our").
For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy.
Privacy questions, requests, or complaints: support@syncnshop.com.
This policy covers the Sync & Shop mobile app on Android and iOS, and this website. It explains what we collect, why, how long we keep it, who else can see it, and what rights you have.
Sections marked "Not yet active" describe features we are building but which are not live at the time of the version date above. They do not process any data until the feature ships and this policy's version date is updated.
| Data | Why | Legal basis |
|---|---|---|
| Email address | To create and identify your account, sign you in, and send password resets | Contract (Art. 6(1)(b)) |
| Password | To secure your account. We never see or store your password — it is handled and hashed by Google Firebase Authentication | Contract |
| Display name / nickname | So other members of your group can see who added or was assigned something | Contract |
| Time zone | To send daily reminders at the right local hour | Contract |
If you sign in with Google (or, on iOS, with Apple), we receive your email address and name from that provider. We do not receive your Google or Apple password.
Everything you and your group members put into the app: shopping list items, calendar events, tasks, chores, chat messages, photos sent in chat, and voice messages. This is stored so it can be shared with your group and synced across devices. Legal basis: contract.
Please note: content you add is visible to every member of that group. We cannot control what other members do with information you share with them. Do not put anything in a shared group that you would not want every member of that group to see.
Group names, invite codes, who belongs to which group, and who is a group administrator. Legal basis: contract.
A push notification token issued by Google Firebase Cloud Messaging, so we can deliver notifications to your device. Your notification preferences (which categories you've turned on). Legal basis: consent — you choose which notifications to receive, and you can turn any of them off at any time in Settings.
The app keeps a copy of your group's recent content in your device's local storage so it works offline. This never leaves your device except as part of the normal sync described above. Uninstalling the app removes it.
When you create an account, we use Cloudflare Turnstile to check you are a real person and not an automated script. Cloudflare receives your IP address and technical signals from your browser for this check. Legal basis: legitimate interests (Art. 6(1)(f)) — preventing fraudulent and abusive account creation.
When you accept these terms, we store the fact that you accepted and which version. Legal basis: legal obligation (Art. 6(1)(c)) — we must be able to demonstrate that consent was given.
If you choose to connect a Google or Microsoft calendar, we will:
Legal basis: consent. You initiate the connection, and you can disconnect at any time in Settings, which revokes the credential.
Imported events become ordinary events inside Sync & Shop. They are no longer linked to the source calendar, and editing them here does not change anything in Google or Microsoft.
Google API Limited Use disclosure: Sync & Shop's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google calendar data for advertising, we do not sell it, we do not transfer it to data brokers, and we do not use it to train artificial intelligence or machine learning models.
A limitation we want to be upfront about: a calendar event you import may incidentally contain sensitive information (for example a medical appointment). We cannot detect or filter this automatically. Only connect a calendar if you are comfortable with its contents being imported into a shared family group.
We plan to show ads in the free version of the app, served by Google AdMob. AdMob may process your device's advertising identifier, device information, and approximate location derived from your IP address.
If you are in the EU, UK, or Switzerland, we will ask for your consent before any personalised advertising, using Google's User Messaging Platform. You can decline, and you can change your choice later. If you decline, you will still see ads, but they will not be personalised. Legal basis: consent.
Ads are removed entirely for subscribers (see 3.10). We never use your app content — your lists, events, tasks, chats, or imported calendar data — to target advertising.
We plan to offer a paid subscription. Payment is handled entirely by Google Play or the Apple App Store. We never receive or store your card details.
We will use RevenueCat to verify and track subscription status. This involves a purchase identifier and your subscription state (active, expired, cancelled). Legal basis: contract for providing the paid service, and legal obligation for retaining transaction records required by tax law.
We do not sell your personal data. We share it only with the service providers we need to operate the app. Each acts as a data processor under contract with us.
| Provider | What they handle | Where |
|---|---|---|
| Google (Firebase) | Authentication, database, file storage, push notifications, server functions | Database and server functions: Belgium (EU). See section 5. |
| Cloudflare | Sign-up bot protection (Turnstile) | Global network |
| Google (AdMob) — planned | Advertising | Global |
| RevenueCat — planned | Subscription verification | United States |
| Microsoft — planned | Calendar import, if you connect a Microsoft account | Global |
We may also disclose data where legally required (for example a valid court order), or to protect our rights, safety, or property.
Your account data and all group content is stored in Google's europe-west1 (Belgium) region, inside the European Union. Our server functions run in the same region.
However, Google is a US-headquartered company, and some services — notably push notification delivery — may involve processing outside the EU. Where personal data is transferred outside the European Economic Area, that transfer relies on the safeguards Google and our other providers have in place, which include the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
[[VERIFY_STORAGE_REGION]] — Confirm in the Firebase Console which region your Cloud Storage bucket (used for chat photos and voice messages) was created in. If it is not an EU region, this section must say so explicitly. Do not leave this unverified.
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Group content (lists, events, tasks, chores) | Until deleted by you or another group member, or until the group is closed |
| Checked-off shopping items | Automatically deleted 24 hours after being checked |
| Chat messages, photos, voice messages | Until deleted by the sender, or until the group is closed |
| Push notification tokens | Removed automatically when they become invalid, or when you sign out or delete your account |
| Calendar access credentials (planned) | Until you disconnect the calendar or delete your account |
| Transaction records (planned) | As required by Romanian tax and accounting law |
Something we want to state plainly: apart from checked-off shopping items, we do not currently delete old content automatically. Chat history and past events remain until someone deletes them or the group is closed. If you want something gone, delete it — or delete your account, which removes everything described in section 7.
You can delete your account at any time: open the app, go to Settings, and tap Delete account. This immediately and permanently:
Content you added to a group that still has other members — a shopping item, an event, a chat message — remains visible to those members, because it is part of their shared record too. Delete it before deleting your account if you want it gone.
You can also request deletion by emailing support@syncnshop.com. See our data deletion page for details.
If you are in the EU, UK, or Switzerland, the GDPR gives you the right to:
We do not make automated decisions that have a legal or similarly significant effect on you, and we do not carry out profiling.
To exercise any of these rights, email support@syncnshop.com. We will respond within one month, as the GDPR requires.
If you are unhappy with how we handle your request, you can complain to the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro — or to the supervisory authority where you live.
Under the CCPA/CPRA you have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising. The requests above cover these rights; email us using the same address.
Other jurisdictions, including Brazil (LGPD), the UK, Canada, and Australia, grant similar rights. We apply the process in section 8 to every request we receive, wherever you are.
[[DECISION_REQUIRED_CHILDREN]] — This section contains our recommended default, but it is a decision you must make deliberately and, we strongly suggest, with a lawyer. It affects your Google Play "target audience" declaration, whether you may show personalised ads at all, and whether COPPA (US) applies to you. A family organiser app will attract child users in practice, so this cannot be left vague.
Sync & Shop is not directed at children. You must be at least 16 years old to create an account.
A parent or guardian may create a group and invite a child under 16, but in doing so the parent or guardian confirms they consent to that child's use of the app and accept responsibility for it. We do not knowingly collect personal data from children under 16 without such consent.
If you believe a child under 16 has created an account without parental consent, contact us at support@syncnshop.com and we will delete it.
Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by Google Firebase. Access is restricted by database security rules so that you can only read and write data for groups you belong to. Passwords are hashed by Firebase Authentication and are never visible to us. Sensitive server credentials are held in Google Secret Manager, not in our application code.
No system is perfectly secure. If a data breach occurs that is likely to affect your rights, we will notify the ANSPDCP within 72 hours of becoming aware of it, and notify you directly where the law requires.
If we change this policy materially — for example when we launch calendar import, advertising, or subscriptions — we will update the version date at the top and ask you to accept the new version inside the app. Continuing to use the app after being notified means you accept the updated policy.
ALGOTECH UNLIMITED SRL
Str. Labirint Nr.43, Constanța, România
support@syncnshop.com