Privacy Policy
1. Introduction
This notice explains what personal data the Shelity app collects, why, who it is shared with, and how you can control it.
Effective date: [app publication date]
Who is responsible for your data (controller): Oleksii Bilousov, mkr. 3, building 17, Lozova, 64600, Ukraine, email: privacy@shelity.com. Referred to below as “we”.
About the app. Shelity is an app for tracking household items and supplies in a shared “Home” space. It runs on Android and iOS, has a server component, and can work offline and sync later.
By using Shelity you confirm that you have read this notice. If you disagree with it, do not create an account.
2. Data we collect
We collect only what is needed to run accounts, spaces and sync of your records.
| Category | What | Source |
|---|---|---|
| Account data | Name, email and account ID from Google or Apple (Apple may provide a private relay address instead of an email), profile photo (if the provider supplies it); for username-and-password accounts, the username and a secure password hash | Sign-in with Google, Apple, or registration with username and password |
| Space data | Space name, member list, roles, temporary invite codes | You create it in the app |
| Your records | Names of items and products, categories (name, icon, color), rooms, containers, quantities, units, notes | You enter it in the app |
| Images | Photos of items if you upload them to the cloud (subscription feature) | Camera or gallery |
| Barcodes | Read by the device camera; camera images are not stored | Camera |
| Technical data | Device model, Android or iOS version, app version, push token, error logs and crash reports, advertising ID | Device |
| Subscription data | Subscription status and term; we do not receive card details | Google Play or Apple App Store |
Sign-in. You can create an account with Google, with Apple on iOS, or with a username and password. If you choose a username and password, we store the username (email) and the password only as a hash: we cannot see the password itself [to confirm].
Advertising. On the free plan we show ads through Google AdMob. To serve and measure ads, the network may receive the device advertising ID, IP address (from which it infers approximate location), view and click data, and technical device data. Paid plans have no ads. Personalized ads are shown only with your consent.
Analytics and crash reports. We use Firebase Analytics for usage statistics (which screens and features are opened) and Firebase Crashlytics for crash reports. They receive the app installation ID, technical device data and the crash log. The content of your records is not sent to these services: we send only technical events (screen, element, action).
We do not collect your precise location, contacts or SMS and have no access to other files on your device: we receive only the photos you take with the camera or pick from the gallery.
If you enter other people’s personal data in notes or names, you are responsible for having the right to do so.
3. How we use data
We tie each purpose to a legal basis under the GDPR (Art. 6) and the Law of Ukraine “On Personal Data Protection”.
| Purpose | Legal basis |
|---|---|
| Create an account, sign in with Google, Apple or username and password, manage spaces and members | Performance of a contract (terms of use) |
| Store your records and sync them across devices and from offline mode | Performance of a contract |
| Upload photos to the cloud and show them to space members | Performance of a contract |
| Send push notifications about changes in a space | Performance of a contract; your consent to notifications in Android or iOS settings |
| Process and verify the subscription, limit the free plan | Performance of a contract |
| Detect errors (crash reports), protect the service from abuse | Legitimate interest |
| Comply with legal obligations | Legal obligation |
| Usage analytics; ad serving and measurement | Consent |
We do not sell your data. Personalized ads are shown only with your consent, which you can withdraw in the app or device settings (on iOS, through the tracking permission; on Android, through advertising ID settings). We do not make decisions with legal effects on you automatically.
4. Who we share data with
Only members of a space can see that space’s data. We share data with other parties only to the extent needed to run the service.
Space members. All members see the space’s records and each other’s name and profile photo. The space owner adds and removes members; a space can have up to 5 members, including the owner.
Service providers (processors):
| Provider | Purpose | Data |
|---|---|---|
| Google, Apple (sign-in with Google or Apple) | Authentication | Email, name, account ID |
| Google Firebase Cloud Messaging; Apple Push Notification service (iOS) | Push notifications | Device token |
| Google Play, Apple App Store | Subscription payment (Google Play and Google Pay; on iOS, Apple App Store and Apple Pay) | Subscription status; payment data is processed only by Google, Apple or the payment provider; we do not see your card number |
| VPS hosting provider [name, country] | Running the server and database | All data stored on the server |
| Cloudflare | Network protection and request delivery to the server | Technical request data (IP address, time, request address); requests to the server pass through Cloudflare |
| Open Food Facts, Open Products Facts, UPCitemdb [confirm if barcode lookup is enabled] | Looking up product name and information by barcode | Only the barcode; the request is sent by our server, not your device. Open Food Facts and Open Products Facts data is licensed under the ODbL |
| Firebase Analytics and Crashlytics (Google) | Usage analytics, crash detection | Technical data |
Advertising. Google AdMob (Google) serves ads and may act as an independent controller for the advertising ID and ad interaction data. Its policy: policies.google.com/privacy.
We conclude data processing agreements with processors and share only what is necessary.
Law. We may disclose data on a reasonable request from a court or authorized body where the law requires. If the business is sold or reorganized, data may pass to the successor on the same terms.
5. Retention and deletion
We keep your data while your account is active and erase it within 7 days after the account is deleted.
Where data is stored. Part of your records is stored locally on your device (so the app works offline), and a synced copy is on our server in [country/region of the data center].
Logging out. If you log out, your data and spaces stay in place.
Account deletion.
- You start deletion in the app settings or submit a request via the web page.
- We warn you about the consequences.
- For 7 days you can cancel the deletion.
- After 7 days we delete all data linked to your account.
If you are a space owner, deleting your account also deletes the space: all its members lose access. Warn them in advance.
Server backups are erased within 7 days after the main data is deleted. Error logs are kept for up to 180 days. Data we are legally required to keep (for example, payment records) is kept for the period the law requires.
Free plan. The cloud record limit does not affect local data: you can keep unlimited records on the device.
6. International transfers, security and children
Transfers abroad. Google, Apple, Cloudflare, the ad network and the hosting provider may process data outside Ukraine and the EU/EEA. For EU users we rely on adequacy decisions or the European Commission’s standard contractual clauses [clarify for the chosen host].
Security. We protect data as follows:
- we transmit it over encrypted channels (HTTPS/TLS);
- we restrict access to the server and database and use keys rather than passwords;
- we store a password you set in Shelity only as a hash; we never see your Google or Apple password, as sign-in happens on their side;
- we make backups and update the system [clarify].
No system is 100% secure. If a breach threatens your rights, we will notify you and, where required, the supervisory authority within the legal deadlines (in the EU, within 72 hours for the authority).
Children. Shelity is not intended for people under 16. We do not knowingly collect children’s data. If you believe a child has created an account, write to privacy@shelity.com and we will delete the data.
7. Your rights, contacts and changes
You can exercise the following rights at any time by writing to privacy@shelity.com:
- access to your data and a copy;
- rectification of inaccurate data (most can be changed in the app);
- erasure of data (also through settings, see section 5);
- restriction of processing and objection to processing based on legitimate interest;
- portability of data in a convenient format;
- withdrawal of consent where processing is based on it, including analytics and personalized ads (this does not affect earlier processing).
We will reply within 30 days. To protect you, we may ask you to verify your identity.
Complaints. If you believe we violate your rights, you can contact the Ukrainian Parliament Commissioner for Human Rights (omb.gov.ua) or the supervisory authority in your EU country of residence.
Changes. We may update this notice. We will notify you of material changes in the app or by email at least 7 days before they take effect. The date of the last update is shown at the top of the document.
Contacts: Oleksii Bilousov, mkr. 3, building 17, Lozova, 64600, Ukraine, privacy@shelity.com.