Spoilert
🔒 Privacy Policy

Privacy Policy

Last updated: August 2026

Spoilert is committed to protecting your personal data in compliance with the General Data Protection Regulation (EU GDPR), the Finnish Data Protection Act (Tietosuojalaki 1050/2018), and applicable US privacy laws.

1. Introduction and Data Controller

Spoilert ("we", "us", or "our") is committed to protecting your personal data in compliance with the General Data Protection Regulation (EU GDPR), the Finnish Data Protection Act (Tietosuojalaki 1050/2018), and applicable US privacy laws. The data controller is Spoilert, contactable at [email protected].

2. Legal Bases for Processing

We process your personal data under the following legal bases:
  • Contractual Performance (Art. 6(1)(b) GDPR): Account registration, food expiration tracking, inventory sync, and household sharing.
  • Explicit Consent (Art. 6(1)(a) GDPR): Optional telemetry, crash diagnostics (Firebase Crashlytics), usage analytics (Firebase Analytics), and personalization features.
  • Legitimate Interests (Art. 6(1)(f) GDPR): App security, abuse prevention, and system stability.

3. Information We Collect & Local-First Architecture

  • Local-First Storage: Food items marked as personal remain strictly on your local device (Realm database) and are never transmitted to cloud servers.
  • Cloud Sync Data: When using household sharing or account backups, item details (names, expiry dates, storage locations) and profile display names are stored securely in Supabase (hosted within the European Union, Stockholm region).
  • Receipt & Barcode OCR Processing: Text recognition from receipts and date labels is processed on-device (via Google ML Kit). Temporary image files created during scanning are purged immediately from local cache upon text extraction and are never permanently stored or transmitted.
  • Analytics & Crash Logs: When opted in, non-identifying diagnostics and performance logs are collected to improve app stability.

4. Digital Age of Consent & Children's Privacy

Under Section 5 of the Finnish Data Protection Act (1050/2018) and US COPPA, the digital age of consent is 13 years old. Spoilert is not directed to children under 13, and we do not knowingly collect personal data from minors under 13 without verifiable parental consent.

5. Third-Party Sub-Processors & Data Transfers

We partner with trusted GDPR-compliant sub-processors:
  • Supabase Inc. (Database & Auth, hosted in the EU, eu-north-1 Stockholm).
  • Google Firebase (Analytics & Crashlytics, processed under Standard Contractual Clauses / Data Privacy Framework).
  • RevenueCat (Subscription management).
We never sell, rent, or trade your personal data to third parties.

6. Data Retention & Automated Purging

Your data is retained as long as your account is active. You can permanently erase all personal and cloud data at any time via in-app self-service deletion.

7. Your Data Subject Rights (GDPR)

Under GDPR, you have the right to:
  • Access & Data Portability (Art. 15 & 20): Export a full copy of your data in JSON or CSV format directly in the app.
  • Rectification (Art. 16): Edit any item, category, or profile detail at any time.
  • Erasure / Right to be Forgotten (Art. 17): Hard-delete your account and all associated cloud data directly within app settings.
  • Withdraw Consent (Art. 7(3)): Opt out of analytics, crash reporting, or personalization anytime in Privacy Settings.

To exercise any of these rights or for inquiries, contact us at [email protected].

8. Supervisory Authority

You have the right to lodge a complaint with a competent supervisory authority, including the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto, www.tietosuoja.fi).