Privacy policy
Effective 8 August 2026 · applies to moj-cekar.si and the Cekar mobile app
1. Who we are
Cekar ("we") is run by the Cekar team, based in Slovenia, which is the data controller for the personal data described here. You can reach us at feedback@example.com. Cekar watches Slovenian grocery catalogues and tells you when products you follow are on sale, and keeps shopping lists you can share with your household.
2. What we store about you
- Account: your email address, a display name, how you sign in (email link or Google), language and display preferences, and the date you joined.
- Watched products: the product names you follow, price targets, categories and exclusions you set.
- Shopping lists: list names and items, who each list is shared with, and your devices' push registrations for list updates.
- Notifications: your alert settings and shopping day, a log of the digests we sent you, and web push subscriptions for devices you enabled.
- Usage: when usage statistics are enabled, which features are used and when, tied to your account id. Deleting your account anonymises these events.
- Technical: short-lived server logs with IP addresses, kept for security and rate limiting.
If you add a product from a photo through an AI assistant, the photo is read by your assistant on your side; only the recognised product details reach Cekar, never the image.
3. What we use it for
- Running the service you signed up for: your account, watches, lists and deal matching (performance of a contract, art. 6(1)(b) GDPR).
- Messages you turned on: sign-in links, the weekly deal digest by email or push. You can switch these off any time under Notifications.
- Keeping the service safe: rate limiting, abuse prevention and security logs (legitimate interest, art. 6(1)(f) GDPR).
- Payments, if you subscribe: your subscription state (performance of a contract).
We do not advertise, profile you, sell your data, or use your data to train AI models. The catalogue reading behind the deals runs on retailer material, not on your data.
4. Who processes it for us
- Fly.io hosts the application and its database.
- Google Firebase syncs shopping lists and signs the mobile app in.
- Brevo delivers our emails (sign-in links, digests).
- Stripe handles payments if you subscribe; we never see your card number.
- Google Fonts serves the website's font, so Google sees your IP address when the site loads.
Some of these providers process data in the United States. Those transfers rest on the EU standard contractual clauses or the EU-US Data Privacy Framework.
5. How long we keep it
For as long as your account exists. Deleting your account removes your watches, lists, notification log, sign-in tokens and app connections right away, and anonymises usage events. Encrypted database backups age out within two weeks. Catalogue and price data is retailer material, not personal data, and stays.
6. Your rights
You can ask for access to your data, correction, deletion, restriction, portability, or object to processing: write to feedback@example.com. You can delete your account yourself at any time under Account, in the app or at moj-cekar.si/account. You can also complain to the Slovenian supervisory authority: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
7. Cookies
Cekar uses one signed session cookie, needed for signing in and for remembering your language and theme. There are no advertising or third-party tracking cookies.
8. Children
Cekar is not aimed at children under 15 and we do not knowingly keep their data.
9. Changes
If this policy changes, the new version appears here with a new effective date, and we flag material changes in the app.