Privacy Policy

Technical & Usage Data (automatic)

• Internet Protocol (IP) address
• Device type, model, and operating system version
• App usage data (screens viewed, time spent, interactions)
• Crash reports and diagnostic information (see "Diagnostics" below)

Anonymous Account & Device Identifiers

The Application does not require you to register or log in. It uses Firebase Anonymous Authentication, which creates a random account identifier on your device, and Firebase App Check (Play Integrity on Android, App Attest on iOS) to confirm that requests come from a genuine copy of the Application. Your favourite products and stores are linked to a random device identifier stored locally on your device, not to your identity. The Application never sends your name, email address, or phone number.

Location Data (with your permission)

The Application may request access to your device's approximate or precise location to provide location-based features such as identifying nearby stores or regional pricing, and to verify price reports (see below).

• Collected only after you explicitly grant permission
• Used solely to provide and improve location-based features and to verify that a price report was made at the store
• Controlled entirely via your device's system settings — revoke access at any time

Any location data used for analytics is anonymised and aggregated before processing.

Price Reports (when you submit one)

You can report the price you see for a product in a store. When you submit a report, the Application sends:

• The product barcode and the store
• The price (in local currency) and, optionally, a discount
• How the price was entered: manually, by barcode scan, or by camera price reading
• Your device's precise location at the moment you submit
• Your anonymous account token (not a name or contact detail)

Our server uses your coordinates only to check that you are within 300 metres of the store. It then keeps only the resulting distance in metres and does not store the coordinates themselves.

Reporter Score & Public Leaderboard

Reports that other users confirm earn points. The Application shows a public leaderboard listing an automatically generated pseudonymous handle (for example "Reporter-A1B2C3") with points and rank. The handle is derived from your anonymous account. It contains no name, photo, or contact details. If you reinstall the Application or clear its data, a new anonymous account and handle are created, and your score starts again from zero.

Camera

The camera is used to scan barcodes and, optionally, to read a shelf price tag. Price-tag reading uses Google ML Kit text recognition running on your device. Camera frames are analysed in memory and discarded. No image is saved or uploaded, and only the recognised price number is sent when you submit a report.

Diagnostics (Firebase Crashlytics)

To find and fix errors, the Application records request breadcrumbs (HTTP method, request path, status code, and duration), the names of screens visited, non-fatal error reports, and the address of the server the app build connects to. We deliberately do not record authentication tokens, request contents, search or query text, or coordinates in these diagnostics.

• To operate and deliver core Application functionality
• To process and verify price reports, calculate reporter scores, and display the leaderboard
• To diagnose errors, crashes, and performance issues
• To analyse usage patterns and improve the Application
• To comply with applicable legal obligations
• To protect the security and integrity of the Application

The Application uses Google Firebase, a platform provided by Google LLC. Firebase may collect and process:

• Device identifiers and tokens, including anonymous authentication and App Check tokens
• App usage and engagement data
• Crash logs and performance diagnostics (Firebase Crashlytics)

The Application also uses Google ML Kit for on-device text recognition. This processing takes place on your device and does not send images to Google or to us.

Firebase acts as a data processor on our behalf under a Data Processing Agreement (DPA) with Google. Data processed by Firebase may be transferred to and stored on Google's servers, which may be located outside the European Economic Area (EEA). Google relies on Standard Contractual Clauses (SCCs) as the legal mechanism for such transfers, in accordance with GDPR Article 46.

For more information, see Google's Privacy Policy and Firebase's data processing terms.

If you are located in the EEA or United Kingdom, please be aware that some of your data may be processed in countries outside your region, including the United States, where Google Firebase infrastructure operates.

These transfers are safeguarded by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Google's compliance with applicable data transfer frameworks

If you are located in the EEA, we process your personal data under the following legal bases:

For legitimate interests processing, we have assessed that our operational purposes are proportionate and do not override your fundamental rights.

Data may be shared only in the following limited circumstances:

• With Google Firebase, as a data processor, to provide Application functionality
• Publicly, in the Application's leaderboard, limited to your pseudonymous handle, points, and rank
• With law enforcement or regulatory authorities, if required by applicable law or valid legal process
• To protect the rights, property, or safety of the Service Provider or users, where legally permitted

All third-party processors are contractually required to process data securely and only for the stated purpose.

We retain collected data only for as long as necessary:

• Usage & diagnostic data — up to 12 months from collection
• Crash logs — up to 6 months, or until the underlying issue is resolved
• Anonymised location data — up to 12 months
• Pending price reports — deleted after 30 days
• Settled price reports and reporter scores — deleted after 12 months

Precise coordinates submitted with a price report are not stored; only the distance to the store is kept, as part of the report.

You may request deletion of your personal data at any time by contacting us. We will respond within 30 days, subject to any legal retention requirements.

If you are located in the EU or EEA, you have the following rights under the General Data Protection Regulation:

For Croatian residents, the relevant authority is AZOP — Agencija za zaštitu osobnih podataka.

To exercise any of these rights, contact: covic.marin1@gmail.com. We will respond within 30 days.

The Application is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16.

If you believe a child has provided us with personal information without parental consent, please contact us immediately at covic.marin1@gmail.com and we will take prompt steps to delete it.

We implement reasonable technical, administrative, and organisational measures to protect your information against unauthorised access, loss, or misuse. These include relying on Google Firebase's secure infrastructure and limiting data collection to what is necessary.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

We may update this Privacy Policy periodically. When we make material changes, we will update the effective date at the top of this document. For significant changes affecting your rights, we will provide notice within the Application where feasible.

Where consent is required for new processing, we will request it separately rather than relying on continued use of the Application.

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, please contact: