Privacy Policy
This page describes what data the Grapsy Light mobile app processes and on what basis.
Last updated: 2026-08-31
Controller and contact
Grapsy Light is operated by MKT Grzegorz Liniewicz, Parkowa 59, 05-074 Halinow, Poland, Tax ID 5372503705, REGON 382856854. Privacy and app operation questions may be sent to office@grapsy.app.
Application scope
Grapsy Light is used for local shopping lists, saved list templates, pantry data, shopping history, and promotion alert management. The app also downloads a shared remote promotions catalog for Poland and Germany in read-only mode. Region selection, store filtering, search, sorting, and alert matching are handled locally on the device. Full access to the app is provided by a local 30-day trial managed by the app, and after it ends, by a monthly Google Play subscription.
Data processed locally
These data are intended to stay locally on the user's device.
- shopping lists and their status,
- saved list templates and their products,
- pantry data and completed-list history,
- saved promotion alerts,
- the start and end dates of the local trial period,
- selected regions, part of store filters, and part of the app and notification settings.
Data that may be processed remotely
To deliver the shared promotions catalog and maintain service security and reliability, the Operator's infrastructure or its technical providers may process minimal technical connection data such as service logs, basic network metadata, and information needed to deliver content. The technical infrastructure used for this purpose is based on Google Cloud Platform / Firebase (Google Ireland Limited). This may involve transferring that minimal technical data outside the European Economic Area, based on compliance mechanisms recognized under the GDPR (including standard contractual clauses or other appropriate safeguards used by that provider).
Camera and photos (recipe import)
The app lets you import recipe ingredients from a photo. To do this, it may ask for access to the device's camera or photo gallery. The selected or captured photo is processed entirely on the device using offline text recognition (OCR) - the photo and the recognized text are never sent to the Operator or to any external server. The photo is used only to fill in the ingredient list and is not stored by the app after the import finishes, aside from any copy the operating system itself keeps in the device's standard photo gallery if the picture was taken there.
Trial and subscription
The first 30 days of full access to the app are a local trial managed entirely by the app on the user's device. Starting it requires no payment method, does not create a subscription, and does not cause any charge, and its record (start and end date) is never sent to Google Play or any other party.
After the trial ends, paid access to the app is sold through Google Play (Google Ireland Limited). Google Play handles the subscription purchase, renewals, cancellation, refunds, and payment card data under its own policies. The Operator does not receive the user's full payment card details. The app may locally store the subscription product identifier, the purchase identifier provided by Google Play, and the time of the last successful verification solely to verify access to premium features and maintain short offline access. This local cache is cleared when no active subscription is found, and in offline mode it may be used for up to 72 hours from the last successful verification. The user can remove these data earlier by clearing app data or uninstalling the app.
Backup, import, and export
The app supports optional local backup import and export through the system file picker or save dialog. A backup may contain local lists, saved templates, pantry data, alerts, history, and part of the app settings. In its current scope, the Operator does not provide cloud synchronization for those data.
What the app does not do
- it does not create user accounts or require login,
- it does not use ads or advertising identifiers,
- it does not use geolocation,
- it does not offer list sharing,
- it does not include an in-app contact form,
- it does not load fonts or other resources from external servers at runtime — all fonts are bundled locally with the app.
Notifications
Promotion notifications are local and depend on the settings saved on the device and on the downloaded promotions catalog. Users can limit what is shown on the lock screen.
Deleting data
Locally stored data can be removed by clearing the application data, uninstalling the application, or deleting the backup files created by the user.
Legal basis and your rights
The data described in this policy is processed on the basis of Article 6(1)(b) GDPR (processing necessary to perform the contract for providing the app and the subscription) and Article 6(1)(f) GDPR (the Operator's legitimate interest in ensuring the security and reliability of the service).
You have the right to access, rectify, erase, and restrict the processing of your data, to data portability, and to object to processing based on legitimate interest. For data processed locally on your device, these rights are exercised directly through the app or operating system features (see "Deleting data" above). For anything else, you can contact the Operator at the address given at the top of this policy.
You also have the right to lodge a complaint with a supervisory authority - in Poland this is the President of the Personal Data Protection Office (PUODO); users in other EU/EEA countries may also contact their own local supervisory authority.
The app does not make automated decisions producing legal effects concerning you and does not create profiles within the meaning of Article 22 GDPR.
Locally stored data remains under your control until you delete it yourself. Technical data processed remotely (see "Data that may be processed remotely" above) is kept only for as long as necessary for the purposes described in this policy.
Policy updates
This policy may be updated if the application's functional scope, delivery model, or legal requirements change.