Privacy Policy for CoCart
Effective Date: March 1, 2026
Last Updated: March 1, 2026
This Privacy Policy describes how Saif Abu Eideh ("we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the CoCart mobile application (iOS and Android) and any related services or pages that link to this Privacy Policy (collectively, the "Service").
CoCart is a shopping and list management utility application that allows users to create grocery lists and related content, including shared lists.
By using the Service, you acknowledge the practices described in this Privacy Policy.
1. Who We Are
- Owner / Developer: Saif Abu Eideh
- Location: Jordan
- Contact Email (Privacy & Support): [email protected]
- Website: cocart.app
2. Scope of This Privacy Policy
This Privacy Policy applies to:
- the CoCart mobile application (iOS and Android), and
- related services and pages that link to this Privacy Policy.
This Privacy Policy does not apply to third-party services that we do not control, including Apple, Google, RevenueCat, Expo, Novu, Sentry, Cloudflare, Hetzner, Neon, Amazon Web Services, app stores, or external websites/services linked from the Service.
3. Eligibility and Children's Privacy
CoCart is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13.
If you believe a child has provided personal information to us, please contact us at [email protected], and we will take reasonable steps to delete that information.
4. Information We Collect
We collect information you provide directly, information collected automatically in connection with the Service, and information received from third-party sign-in providers.
A. Information You Provide to Us
Depending on how you use CoCart, we may collect:
- Account Information
- Full name
- Email address
- Profile/avatar image
- Account login-related information
- User Content
- Grocery/shopping list items
- Shared lists and list content
- Photos/images you upload, including:
- item images
- profile images
- Support / Communications
- Information you provide when contacting support or submitting privacy requests
B. Information from Social Sign-In Providers
If you sign in using Apple Sign-In or Google Sign-In, we may receive and store information such as:
- your name,
- email address,
- profile photo (if provided by the provider),
- provider-specific user identifier.
The exact data received depends on your provider account settings and permissions.
C. Information Collected Automatically
When you use the Service, we may collect certain technical information, such as:
- app version
- device/app diagnostic information (e.g., crash logs)
- an internal account identifier associated with diagnostic events
- language / locale
- push notification token (if notifications are enabled)
- limited subscription and paywall interaction information needed to display products, process purchases, restore entitlements, and provide subscription support
We do not use this information for advertising, cross-app tracking, or general behavioral marketing analytics. Limited subscription and paywall interactions are processed only to provide and support purchase functionality. If our data practices materially change, we will update this Privacy Policy before or when such changes take effect, as required by applicable law.
D. Information We Do Not Collect (Current Functionality)
- Precise or approximate location data
- Background location data
- Payment card details processed directly by us
- Personalized advertising identifiers for targeted advertising
5. Permissions and Device Access
CoCart may request access to certain device features to provide app functionality, including:
- Camera access to scan an owner-generated household invite QR code
- Photo library/media access to select a profile picture or attach an image to a shopping-list item
- Notification access to receive household reminders and shared-list updates
You may control these permissions through your device settings. If you deny permissions, some features may not function properly.
6. How We Use Your Information
We use personal information for the following purposes:
- to create and manage user accounts
- to authenticate users (including social sign-in)
- to provide core app functionality (shopping lists, shared lists, uploads)
- to personalize the user experience
- to sync content across devices (if applicable)
- to send non-marketing app notifications (such as reminders and shared-list related updates)
- to maintain security, detect abuse, and troubleshoot issues
- to monitor and fix app crashes / technical problems
- to comply with legal obligations and enforce our terms
No AI Processing in the Current Service
The current version of CoCart does not use an AI service and does not send account information, shopping-list content, or images to a third-party AI provider.
7. Shared Lists and Visibility to Other Users
CoCart includes collaborative/sharing features. If you share a list with other users, certain information may be visible to those users, including:
- your name
- avatar/profile image
- shared list content (including list items)
- images attached to shared shopping-list items within the shared list context
Please use care when uploading or sharing content, especially images and personal details, because shared content may be visible to invited users.
8. Payments, Subscriptions, and RevenueCat
CoCart offers free usage and subscription-based features.
A. App Store Billing
Payments and subscription purchases are processed by:
- Apple App Store (iOS), and/or
- Google Play (Android)
We do not directly collect or store your payment card details.
B. RevenueCat
We use RevenueCat to manage subscription status, entitlements, and related purchase/subscription data.
C. Refunds
Refunds are generally subject to the policies and processes of Apple and Google. You may contact us for assistance, and we may review requests in accordance with platform/provider capabilities and applicable policies.
9. How We Share Information
We do not sell personal information. We also do not share personal information for cross-context behavioral advertising (targeted advertising across third-party apps/websites).
We may share information in the following circumstances:
A. Service Providers / Processors
We may share information with trusted service providers that help us operate the Service, such as:
- Apple Sign in and Google Sign-In (identity-provider authentication)
- RevenueCat (subscription and entitlement management)
- Expo / EAS and Expo Push Notification services (application delivery, updates, and push-token infrastructure)
- Novu (transactional push-notification delivery and notification preferences)
- Sentry (crash and error diagnostics)
- Hetzner (production server hosting)
- Cloudflare (DNS, TLS, and network delivery/security services)
- Neon (managed PostgreSQL database hosting)
- Amazon S3 (storage of optional profile and shopping-item images)
These providers process data on our behalf or as independent service providers, subject to their own terms and privacy policies.
B. Other Users (Sharing Features)
If you use list-sharing features, your account information and shared content may be visible to other users you invite or with whom you collaborate.
C. Legal Compliance and Protection
We may disclose information if we believe in good faith that disclosure is necessary to:
- comply with applicable law, regulation, legal process, or lawful request,
- protect our rights, users, or the public,
- detect, prevent, or address fraud, abuse, or security issues.
D. Business Transfers
If we are involved in a merger, acquisition, financing, asset sale, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable law.
10. International Data Processing and Transfers
We are based in Jordan, and we use service providers and infrastructure that may process data in other countries.
Based on the current setup, data may be processed and/or stored in:
- Germany (including hosting/infrastructure), and
- other countries where our service providers operate (for example, cloud, authentication, subscription, or app platform providers).
If you access the Service from a country with data protection laws different from those in Jordan or the countries where our providers operate, your information may be transferred to and processed in those countries.
Where required by law, we will use appropriate safeguards for international transfers.
11. Data Retention
We retain personal information for as long as reasonably necessary to:
- provide the Service,
- maintain your account,
- comply with legal obligations,
- resolve disputes,
- and enforce agreements.
Current Retention Approach (CoCart)
- We generally retain account and app data until account deletion.
- We support in-app account deletion.
- After deletion, data may be soft-deleted first and permanently purged later.
- Certain data may remain for a limited period in backups, logs, or records needed for security, fraud prevention, legal compliance, or technical recovery.
12. Account Deletion and Your Choices
You may have the following controls (subject to technical and legal limitations):
- Access and view your account data
- Edit your profile information
- Delete your account in-app
- Manage device permissions (camera/photos) in your device settings
- Disable push notifications in your device settings
If you request account deletion, we will process the request and delete or de-identify personal information as required by applicable law, subject to data we are legally required or reasonably permitted to retain.
For privacy requests, contact: [email protected]
13. Security
We use reasonable administrative, technical, and organizational measures designed to protect personal information.
For example, data transmitted between the app and our services is generally sent using secure transport protocols (such as HTTPS/TLS).
However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Third-Party Services and Links
The Service may rely on or link to third-party services such as Apple, Google, RevenueCat, Expo, Novu, Sentry, Cloudflare, Hetzner, Neon, Amazon Web Services, and app stores. These third parties may collect, use, and process information under their own privacy policies.
We encourage you to review their privacy policies before using related features.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
If we make material changes, we may provide notice by:
- updating the "Last Updated" date,
- posting the updated policy within the app or on the relevant website/page,
- and/or other reasonable means.
Your continued use of the Service after the updated Privacy Policy becomes effective means you acknowledge the updated terms, to the extent permitted by law.
16. Regional Privacy Rights
Depending on where you live and applicable law, you may have privacy rights such as the right to:
- access personal information,
- request correction,
- request deletion,
- object to or restrict certain processing,
- withdraw consent (where processing is based on consent),
- and lodge a complaint with a regulator.
We will review and respond to requests as required by applicable law.
A. EEA / UK Users (GDPR / UK GDPR)
If you are located in the EEA or UK, we may process your personal information under one or more legal bases, including:
- performance of a contract (to provide the Service),
- legitimate interests (e.g., security, troubleshooting, service operation),
- consent (e.g., optional permissions where required),
- and legal obligations.
B. California Residents (CCPA/CPRA)
If California privacy law applies to our processing, California residents may have rights including:
- the right to know/access,
- the right to request deletion,
- the right to correct,
- and the right to non-discrimination for exercising privacy rights.
Current practice: We do not sell personal information and do not share personal information for cross-context behavioral advertising.
To submit a privacy request, contact: [email protected]
17. Contact Us
If you have questions, support requests, or privacy requests, please contact:
Saif Abu Eideh
Email: [email protected]
Location: Jordan