# Privacy notice SingleMall is a private, invitation-only project. This page says what is kept about you, where it sits, how long it stays and how to have it deleted. It is written to be read, not to cover the person who wrote it. Version of 17 October 2026. The Italian text is the authoritative one; this is a translation. ## Who handles the data SingleMall is run by a private individual, for himself and a small group of invited people: [MicheledG on GitHub](https://github.com/MicheledG). There is no company behind it, nothing is sold, and the data is given or sold to nobody. For any request — to see what is held, to correct it, to delete it, to object — write to the person who invited you: they are the same person who administers the service, and it is the channel that actually exists. Requests are carried out by hand, usually within a few days. ## What is kept On the server, and nothing else that is about you: - **Your sign-in:** the e-mail address you sign in with, the language chosen when you were invited, whether the address is confirmed, and the dates the account was created and last changed. - **Your level:** whether you are somebody who uses the app or somebody who administers it, and whether the account is active, suspended or waiting for a first sign-in. - **The list of people:** whoever administers sees that same list for everyone invited, with the name each person chose, the app version on the phone they used last, when they were last active, and how much of their daily Claude allowance they have used today. It is what invitations and withdrawals are made from. - **The server's logs:** every request leaves a technical line carrying the account's internal identifier — not your e-mail address — the request made and the time. They are deleted automatically after seven days. - **Your list, if you are not in a group:** the shopping list, the favourites, the shops you hid and the shop settings, so a second phone signed in to the same account shows the same. That means what you put on them: the products, with the name, brand, picture and price they had when you added them; the lines you typed in your own words; quantities, the notes on a line, what was ticked, the shop a line is pinned to, and dates. - **Your group, if you have one:** what the people in it share, and who they are. It has a section of its own below. - **The name you choose, if you choose one:** up to thirty characters, which the people in your group and whoever administers see in place of your address. - **Your meal plan, if you keep one:** meals, portions, alternatives, supplements and notes, as you wrote them or as Claude transcribed them, and archived plans until you delete them. It is health data: it has a section of its own below. - **Your allergies and body, if you write them:** allergies, intolerances, health conditions and foods you dislike, each with any note you add, and your height, weight, year of birth and sex — height and weight typed or, if you connect it, read from Health Connect. It is health data too: the same section covers it. - **Your devices:** for each phone or browser you sign in on, a random number the app made when it was installed or the browser made on the first visit, as its name the phone's model or the browser and system (for example "Safari · iPhone"), the app version, when you first signed in on it and when it was last used, and the address the app is woken at or, in a browser, the one notifications reach, if you turned them on. You see the same list in Settings, under "Your devices", where you can remove a device or sign out everywhere. The group section says what the address is for. - **Your Home Assistant's connection, if you use it:** while your Home Assistant is connected, the address of its connection, which is how it is told that the list changed. It holds nothing you wrote. - **Your use of Claude, if you connect it:** how many times Claude used SingleMall for you each day, and the daily allowance you have. It has a section of its own below. - **Your suggestions and problems, if you send any:** on the server, only how many you sent today. What you write goes somewhere else, said in its own section below. - **Products joined together:** when whoever administers decides that two entries are the same product, that decision is kept. It is about products, not about people. - **The catalogue:** products, prices and pictures copied from what the shops publish. It is nobody's personal data. Not kept: your location, your address book, your contacts, an advertising profile, your web browsing history. You are never asked for a supermarket password. ## What stays on the phone The barcodes scanned recently, the appearance and the language live only on the device, inside the app: they are not sent to the server, they are never shared, not even in a group, and they go when you uninstall the app. The list, the favourites, the hidden shops and the shop settings are on the phone and also in your account on the server, so they stay the same on every phone you sign in on. In a group the list, the favourites and the shop settings belong to everyone in it, as described below; hidden shops stay yours alone. The app also keeps on the device what it needs to stay signed in, and a local copy of the catalogue, so that it works without a network. None of it goes into the phone's backup or moves to a new phone: after signing in there, the app reads it again from the server. ## What stays in the browser If you use SingleMall in a browser, the browser keeps, for this site only: what keeps you signed in to your account, the random number that names that browser in your list of devices, the language, the picture you chose, if you chose one, and small preferences such as what a swipe does or which shop you read the list in. It also keeps a copy of the app's files, so it opens without a network. The list, the favourites and the catalogue do not stay there: it reads them from the server each time. None of it is a cookie and no other site reads it. Signing out removes what keeps you signed in; the rest goes when you clear the site's data in the browser's settings. If you turn on invitation notifications in a browser, the browser creates an address at its maker's notification service (Google for Chrome, Apple for Safari, Mozilla for Firefox, Microsoft for Edge) and SingleMall keeps it with your devices. When somebody invites you to a group, all that passes through that service is the notice that there is an invitation: not who invites you, not the group's name. You turn them off in Settings, and the address is removed. ## Where the data sits With a cloud infrastructure provider, in its data centres in Milan: the data therefore stays in Italy and inside the European Union. The sign-in service — the one that checks your address and your password — is the same provider's and is in the same region. Three things leave it, each only as far as this page says: the signal that wakes your phone goes through Google's messaging service; a suggestion or a problem you send becomes a note in a private project on GitHub; and what Claude reads or writes for you goes through Anthropic, if you or somebody in your group connected it. Those three services follow their own terms and may keep data outside the European Union. The site you are reading is served from that provider's distribution network and is nothing but static files. ## No statistics, no advertising, no tracking This page loads nothing from anywhere else: no external typeface, no visit counter, no advertising, no cookie. That is a rule checked by a test on every build, not a promise. The app carries no analytics, crash-reporting or advertising library. With one honest qualification: the product photographs and the shops' logos are downloaded straight from the supermarkets' own sites, because that is where they live. When the app shows one, the supermarket's site sees a request from your IP address, as if you had opened their page yourself. Everything else — products, prices, categories — comes from SingleMall's own server. Barcodes are read on the phone. The camera image never leaves the device and is not saved. The reader is a Google component that works on the phone; Google states that a component of this kind may send it figures on how the component itself performs, never the image. ## The supermarket accounts belong to whoever runs this Some supermarkets show their prices only to somebody signed in with an account of their own. Those accounts belong to whoever runs SingleMall, not to you: you are never asked to connect yours, and the service holds no supermarket credentials of yours. If that ever changed, this page would change first. ## How long - **Your account:** as long as you have it. When whoever administers removes you from the list, you are taken out of your group, and the account is deleted with everything kept in it: the e-mail address and the level, your list and your favourites, the chosen name, the meal plans, the allergies and body, the phones' addresses and the counts of Claude and of the suggestions. - **An invitation nobody accepted:** seven days. Then it is withdrawn by itself and the address is free again. - **The server's logs:** seven days, then deleted automatically. - **A group's things:** as long as the group exists. The last person leaves and they are deleted with it. - **An invitation to a group:** it can be accepted for seventy-two hours, and after thirty days it is deleted whatever became of it. - **A phone's address:** sixty days from the last time the app used it, and gone at once when you sign out. - **Your Home Assistant's connection:** gone when the connection closes, and in any case two hours and ten minutes after it opened. - **The note that your e-mail address belongs to your account:** sixty days from the last time one of your phones checked in. It runs out on its own, even after you sign out or the account is deleted. - **Your list and your favourites:** as long as you have the account; if your account is deleted, they go with it. - **The chosen name:** until you remove it, or until your account is deleted. - **The meal plan:** until you delete it, or until your account is deleted. - **The allergies and body:** until you remove them, or until your account is deleted. - **The count of a day's use of Claude:** three days, then deleted by itself. The allowance stays until whoever administers changes it, or until your account is deleted. - **The count of a day's suggestions:** two days, then deleted by itself. - **A picture sent with a suggestion:** the one you chose, about a day; the copy the note shows, fourteen days. - **A suggestion or a problem on GitHub:** until whoever runs SingleMall deletes it. Ask, and it is deleted. - **The catalogue and the product joins:** they stay, because they are not about you. ## Why keeping it is lawful The e-mail address and the level are what let you in and what separates who may do what: without them the service does not exist. The server's logs are what make it run and what say what went wrong, and they last the shortest time useful for that. The chosen name, Claude and the suggestions exist only if you use them: you start them, and you can stop. There is no processing for marketing, because there is no marketing. ## Your rights You can ask to see what is held about you, to correct it, to delete it, to restrict its use, to object to it and to receive a copy. You can also complain to the competent supervisory authority. Requests go to the person who invited you, as above; deleting an account takes a few minutes and has no conditions. ## If you share the shopping in a group A person can be in one group at a time, and a group shares the shopping — and the meal plan, if you keep one and do not hide it: the section below says how. The server keeps the group's list and favourites — the same things the personal list holds, described above — and the group's shop settings: the nicknames, the colours, the copies of shops, the order of their aisles and which copy is the default. It also keeps who is in the group and since when: the list of members names each person by their account identifier, not by their e-mail address. The invitations carry the address somebody typed to send one and the address of whoever sent it, and that is how the Group screen shows who is who; if somebody chose a name, the others see that name. An invitation link is kept as a fingerprint, never as the link itself, together with the sender's address. An invitation can be accepted for seventy-two hours, and after thirty days it is deleted whatever became of it. If you choose a picture in Settings, the people in your group see it too, next to your name. The server never receives the picture you chose: the phone sends a small copy, and the server draws a 128-point square from it, without any of the hidden data a photo keeps, such as where and when it was taken. It stays in your account until you remove or change it: removing it in Settings deletes it from the server, and the others see your initial again. Nobody outside your group sees it. Somebody who leaves keeps their copy of the list, the favourites and the settings exactly as they were, on the phone and in their account, and comes off the list of members; what the group changes afterwards is no longer theirs. When the last person leaves, the group is deleted with everything it held. The barcodes scanned recently, the appearance and the language are never shared: they stay on the phone inside a group too. So that the list changes on the other phone while you are both at the counter, rather than when somebody remembers to look, the server keeps for each phone you sign in on an address used only to wake the app, with the app version and when the phone last checked in. It is an address, not a content: the message that goes through it says only what kind of thing changed — the list, the people, a meal plan, a new version of the app — and what the app does next is read again as it would on opening. The message travels through Google's messaging service, which therefore sees the address and that a message was delivered, and nothing else. The address goes when you sign out, and in any case after sixty days without being used. Beside it the server notes that the e-mail address you signed in with belongs to your account, so that a group invitation sent to that address can wake your phone. It holds no phone address, and it runs out sixty days after the last time one of your phones checked in. Whoever runs SingleMall can see which groups exist and who is in them, and can take a person out of a group or dissolve a group on request. ## The meal plan A meal plan says something about your health, and the law treats it as a special kind of data. So a few more rules apply. It is there only if you put it there: you write it in the app, or you ask Claude to read it from a document and save it. Nothing of the document is kept: the server holds only the plan as transcribed, without the contact details of whoever prepared it — at most their name. It is kept because you ask for it, and only to show it to you and to whoever you decide; you withdraw that consent by deleting it. If you are in a group, the others see it unless you hide it from the Sharing screen, and they can change it only if you allow it. The same goes for their Claude, if they connected it. Whoever leaves the group, or is taken out of it, stops seeing your plan, and you theirs. When you use Claude to read or write the plan, its content goes through Anthropic, which provides Claude, on the terms you accepted with them. If nobody connects Claude, the plan does not leave SingleMall. You delete it whenever you like from the app, one plan at a time, archived ones included. If your account is deleted, the plans are deleted with it. The plan's content never goes into the server's logs. **Your allergies and body.** Beside the plan you can write your allergies, intolerances, health conditions, the foods you dislike, your height, weight, year of birth and sex — all optional, and only if you write them. Unlike the plan, they cannot be hidden: everyone in your group reads all of it, health conditions included, so whoever does the shopping knows what you cannot eat. Only you change them. Whoever leaves the group stops reading them. You remove them whenever you like from the app; if your account is deleted they are deleted with it, and they never go into the server's logs. **People without an account.** A group can also hold people who will never sign in — a child, a grandparent — added by name by one of its members. Their plan, allergies and body are written by the members, for that person and with their consent or their parent's or guardian's: the member who writes them is responsible for having it. Everyone in the group reads and changes them. Any member deletes such a person from the app, and their plan and habits go with them; when the group dissolves, they are deleted too. Their name and their data never go into the server's logs. ## If you connect Health Connect You can connect Health Connect, Android's health store, from the app's settings, under Integrations. Until you do, SingleMall reads nothing from it. Connecting it lets the app read two things only: your height and your weight. It writes nothing to Health Connect and reads nothing else. Each time you open your allergies and body, the app reads the latest height and weight recorded on the phone — including ones recorded before you connected it, where Health Connect allows — and, when they changed and are newer than the ones you saved, saves them as if you had typed them: from there the rules of your allergies and body apply, and everyone in your group sees the new weight. Only the saved value leaves the phone; the history of measurements stays in Health Connect. You disconnect whenever you like from the same switch, or from Health Connect's settings. ## If you connect Claude You can connect your own Claude account to SingleMall, from Claude's settings. You sign in on SingleMall's own sign-in page, and Claude receives a key that lets it act for you: it lasts an hour and Claude renews it for up to thirty days, after which you sign in again. To make that connection the server keeps a few technical details, which are used once and stop being valid after ten minutes at most; once connected, it keeps nothing of the key. Connected, Claude can search the catalogue and read products and prices; read and change your shopping list and your favourites — the group's, if you are in one, so the change reaches the other phones; and read and write your meal plan and, where they share it, the plans of the people in your group, changing them only if they allow it; and read your allergies and body and those of the people in your group, changing only yours. It cannot invite or remove anybody, see other people's addresses or reach anything an administrator does. What Claude reads or writes for you goes to Anthropic, which provides Claude, under your own Claude account and the terms you accepted with them: what Anthropic keeps, and for how long, is decided by those terms, not by SingleMall. In a group this reaches further than you: if somebody in it connects Claude, the group's list and favourites, and your plan if you share it with the group, reach Anthropic through their account. SingleMall counts how many times Claude uses it for you on each day, by the Italian calendar, against a daily allowance: a hundred, unless whoever administers sets another number for you. Whoever administers sees today's count, your allowance and when Claude last acted for you. A day's count is deleted by itself after three days. The server's logs say which action Claude asked for, never what it read or wrote. You end the connection by removing it in Claude. If your account is deleted, it stops working within the hour. ## If you send a suggestion or a problem The form in the app sends what you choose and write — whether it is a suggestion or a problem, the text and up to three pictures — and, as the form says, the app version, the Android version and the phone model. Nothing else: no name, no e-mail address. It becomes a note in a private project on GitHub, a service for software projects, which keeps it on its own servers under its own terms. Only whoever runs SingleMall can read it. The note carries, in place of your name, a short code worked out from your account: it tells two senders apart and says nothing about who you are to anybody else, though whoever runs SingleMall can match it to an account if needed. The note stays until whoever runs SingleMall deletes it; ask, and it is deleted. The pictures are not passed on as you sent them. The server reads each one and draws a new picture from it, which carries none of the hidden details a photo keeps, such as where and when it was taken or with what phone. The picture you chose is deleted within about a day. The new one is published at an address nobody can guess and is linked from the note: whoever has that link can see it, so do not put in it anything you would not show. It is deleted after fourteen days. You can send three a day. To count them, the server keeps in your account how many you sent on that day, by the Italian calendar, and that count deletes itself after two days. The server's logs say that something was sent and with how many pictures, never what it said. ## If this notice changes The date at the top is the version. A change to what is kept is written here the moment it happens, and the front page carries the summary. Corrections of wording do not move the date. See also the [terms of use](/en/terms.md).