Privacy Policy
This page describes what data the Grapsy Light mobile app processes and on what basis.
Last updated: 2026-10-16
Controller and contact
Grapsy Light is operated by MKT Grzegorz Liniewicz, Parkowa 59, 05-074 Halinow, Poland, Tax ID 5372503705, REGON 382856854. Privacy and app operation questions may be sent to office@grapsy.app.
Application scope
Grapsy Light is used for local shopping lists, saved list templates, pantry data, shopping history, and promotion alert management. The app also downloads a shared remote promotions catalog for Poland and Germany in read-only mode. Region selection, store filtering, search, sorting, and alert matching are handled locally on the device. The app is free and remains functional indefinitely: for the first 30 days without quantity limits, and after that on the free plan, whose limits a monthly Google Play subscription lifts.
Data processed locally
These data are intended to stay locally on the user's device.
- shopping lists and their status,
- saved list templates and their products,
- pantry data and completed-list history,
- saved promotion alerts,
- the start and end dates of the local trial period,
- selected regions, part of store filters, and part of the app and notification settings.
Data that may be processed remotely
To deliver the shared promotions catalog and maintain service security and reliability, the Operator's infrastructure or its technical providers may process minimal technical connection data such as service logs, basic network metadata, and information needed to deliver content. The technical infrastructure used for this purpose is based on Google Cloud Platform / Firebase (Google Ireland Limited). This may involve transferring that minimal technical data outside the European Economic Area, based on compliance mechanisms recognized under the GDPR (including standard contractual clauses or other appropriate safeguards used by that provider).
Camera and photos (recipe import)
The app lets you import recipe ingredients from a photo. To do this, it may ask for access to the device's camera or photo gallery. The selected or captured photo is processed entirely on the device using offline text recognition (OCR) - the photo and the recognized text are never sent to the Operator or to any external server. The photo is used only to fill in the ingredient list and is not stored by the app after the import finishes, aside from any copy the operating system itself keeps in the device's standard photo gallery if the picture was taken there.
Free plan, trial and subscription
The first 30 days of using the app without quantity limits are a local trial managed entirely by the app on the user's device. Starting it requires no payment method, does not create a subscription, and does not cause any charge, and its record (start and end date) is never sent to Google Play or any other party.
The end of the trial does not block access — the app moves to the free plan and keeps working. Uncapped access is sold as a subscription through Google Play (Google Ireland Limited). Google Play handles the subscription purchase, renewals, cancellation, refunds, and payment card data under its own policies. The Operator does not receive the user's full payment card details. The app may locally store the subscription product identifier, the purchase identifier provided by Google Play, and the time of the last successful verification solely to verify access to premium features and maintain short offline access. This local cache is cleared when no active subscription is found, and in offline mode it may be used for up to 72 hours from the last successful verification. The user can remove these data earlier by clearing app data or uninstalling the app.
Backup, import, and export
The app supports optional local backup import and export through the system file picker or save dialog. A backup may contain local lists, saved templates, pantry data, alerts, history, loyalty cards, and part of the app settings. In its current scope, the Operator does not provide cloud synchronization for those data.
A single list can also be exported to a file from that list's menu: its name, the export date, and its products with manufacturer, amount and unit, notes, stores and status (bought / unavailable). The file contains no other data and no device identifiers. If you send it to someone, they will also see the notes written next to the products. Importing it on another device adds the list next to the existing ones, replacing nothing.
App updates
The app asks the Google Play app installed on the device whether a newer version of Grapsy Light is available (Google Play In-App Updates library). To do so, the library sends Google Play (Google Ireland Limited) device metadata and the installed version of the app, to determine whether an update is available and how large it is. Google processes this data as a separate controller under its own privacy policy; the Operator receives no data in connection with it. If the user agrees to an update, Google Play downloads and installs it. The app stores locally only when the user last answered an update offer and which note about new features it has already shown.
App ratings
After some actions, such as saving a list or adding an alert, no sooner than a week into using the app and no more than once every few months and at most three times in all, the app may ask Google Play to show its rating card (Google Play In-App Review library). Google Play decides whether the card appears. The app can also be rated at any time from Settings, which opens its page in Google Play. The user gives any rating and review directly in Google Play (Google Ireland Limited), which processes this data as a separate controller under its own privacy policy. The app sends the Operator no data and does not learn whether the card was shown or what rating was given; the Operator sees only the ratings and reviews Google Play makes available. No benefit is offered in return for a rating. The app stores locally only when the first such action happened, how many there have been, and when and how many times a rating was asked for.
What the app does not do
- it does not create user accounts or require login,
- it does not use ads or advertising identifiers,
- it does not use geolocation,
- it does not offer lists shared between users — a single list can only be exported to a file,
- it does not include an in-app contact form,
- it does not load fonts or other resources from external servers at runtime — all fonts are bundled locally with the app.
Notifications
Promotion notifications are local and depend on the settings saved on the device and on the downloaded promotions catalog. Users can limit what is shown on the lock screen.
An alert may concern a specific product or all products of a given manufacturer. Matching takes place locally on the device; when one alert covers many promotions at once, they may be shown in a single summary notification.
Deleting data
Locally stored data can be removed by clearing the application data, uninstalling the application, or deleting the backup files and exported list files created by the user.
Legal basis and your rights
The data described in this policy is processed on the basis of Article 6(1)(b) GDPR (processing necessary to perform the contract for providing the app and the subscription) and Article 6(1)(f) GDPR (the Operator's legitimate interest in ensuring the security and reliability of the service).
You have the right to access, rectify, erase, and restrict the processing of your data, to data portability, and to object to processing based on legitimate interest. For data processed locally on your device, these rights are exercised directly through the app or operating system features (see "Deleting data" above). For anything else, you can contact the Operator at the address given at the top of this policy.
You also have the right to lodge a complaint with a supervisory authority - in Poland this is the President of the Personal Data Protection Office (PUODO); users in other EU/EEA countries may also contact their own local supervisory authority.
The app does not make automated decisions producing legal effects concerning you and does not create profiles within the meaning of Article 22 GDPR.
Locally stored data remains under your control until you delete it yourself. Technical data processed remotely (see "Data that may be processed remotely" above) is kept only for as long as necessary for the purposes described in this policy.
Policy updates
This policy may be updated if the application's functional scope, delivery model, or legal requirements change.