Privacy policy

Effective 9 October 2026 · applies to moj-cekar.si and the Cekar mobile app

1. Who we are

Cekar ("we") is run by the Cekar team, based in Slovenia, which is the data controller for the personal data described here. You can reach us at dev-support@moj-cekar.si. Cekar watches Slovenian grocery catalogues and tells you when products you follow are on sale, and keeps shopping lists you can share with your household.

2. What we store about you

Account: your email address, a display name, how you sign in (email link or Google), language and display preferences, and the date you joined.
Watched products: the product names you follow, price targets, categories and exclusions you set.
Shopping lists: list names and items, who each list is shared with, and your devices' push registrations for list updates.
Notifications: your alert settings and shopping day, a log of the digests we sent you, and web push subscriptions for devices you enabled.
Usage: which features are used and when. On the web this is tied to your account id and is anonymised when you delete your account. In the mobile app usage statistics are collected by Google Analytics for Firebase and cannot be switched off.
Crashes and performance: when the mobile app fails, a crash log, the state of the app and details about the device, so we can find and fix the fault. This cannot be switched off either.
Device identifiers: your push notification token, an app installation id, the device advertising ID and the app set ID. Analytics uses the advertising ID for usage statistics; Google AdMob uses it, together with the app set ID, for ads and fraud prevention.
Ads (mobile app only): when the app loads an ad, Google AdMob receives your phone's IP address, from which it estimates an approximate location (a town or region, never a precise one), along with how you interact with the ad and the app, and technical performance data.
Technical: short-lived server logs with IP addresses, kept for security and rate limiting.

If you add a product from a photo through an AI assistant, the photo is read by your assistant on your side; only the recognised product details reach Cekar, never the image.

Conversations with the assistant in the Cekar app are kept in your Cekar account on our server until you delete them or delete the account.

3. What we use it for

Running the service you signed up for: your account, watches, lists and deal matching (performance of a contract, art. 6(1)(b) GDPR).
Messages you turned on: sign-in links, the weekly deal digest by email or push. You can switch these off any time under Notifications.
Keeping the service safe: rate limiting, abuse prevention and security logs (legitimate interest, art. 6(1)(f) GDPR).
Improving the app: usage statistics and crash reports, so we can see what is used and what breaks (legitimate interest, art. 6(1)(f) GDPR).
Ads in the mobile app: in the EU and other countries where consent is required, we show personalised ads only if you consent (consent, art. 6(1)(a) GDPR); without consent Google shows limited ads that are not based on your profile. Ad measurement and fraud prevention rest on legitimate interest (art. 6(1)(f) GDPR).
Payments, if you subscribe: your subscription state (performance of a contract).

The mobile app may show ads from Google AdMob; some accounts are ad-free. We do not profile you ourselves: if you consent, Google personalises the ads. We do not sell your data or use it to train AI models. The catalogue reading behind the deals runs on retailer material, not on your data.

4. Who processes it, and who receives it

Fly.io hosts the application and its database.
Google Firebase syncs shopping lists and signs the mobile app in.
Google Analytics for Firebase and Firebase Crashlytics collect the mobile app's usage statistics and crash reports.
Google AdMob shows ads in the mobile app. To personalise and measure ads and to prevent fraud, Google also uses this data as an independent controller, under its own privacy policy (policies.google.com).
Brevo delivers our emails (sign-in links, digests).
Stripe handles payments if you subscribe; we never see your card number.
Google Fonts serves the website's font, so Google sees your IP address when the site loads.

Some of these providers process data in the United States. Those transfers rest on the EU standard contractual clauses or the EU-US Data Privacy Framework.

5. How long we keep it

For as long as your account exists. Deleting your account removes your watches, lists, assistant conversations, notification log, sign-in tokens and app connections right away, and anonymises usage events. Encrypted database backups age out within two weeks. Catalogue and price data is retailer material, not personal data, and stays. Data that Google AdMob receives is kept by Google under its own policy; it is not tied to your Cekar account, so deleting your account does not cover it.

6. Your rights

You can ask for access to your data, correction, deletion, restriction, portability, or object to processing: write to dev-support@moj-cekar.si. You can delete your account yourself at any time under Account, in the app or at moj-cekar.si/account. You can change your consent to personalised ads at any time in the app under Settings → Legal → Ad privacy (where consent is required, for example in the EU), and reset or delete the advertising ID in your phone's settings. You can also complain to the Slovenian supervisory authority: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.

7. Cookies

The moj-cekar.si website uses one signed session cookie, needed for signing in and for remembering your language and theme. The website sets no advertising or third-party tracking cookies; for ads in the mobile app, see section 3.

8. Minors

Cekar is intended for people aged 18 and over. We do not knowingly keep data about anyone under 18; if you believe a minor has given us their data, write to dev-support@moj-cekar.si and we will delete it.

9. Changes

If this policy changes, the new version appears here with a new effective date, and we flag material changes in the app.