Privacy Policy

Basket Vitality reads your receipts and bank statements on your phone, and keeps them there. We don't have a server that stores your data, we don't have accounts, and we can't see your spending, your shopping, or your health information. We run no analytics, telemetry or tracking, and we receive nothing about you or how you use the app. If the app ever crashes, a report is saved on your phone — and goes nowhere unless you choose to share it.

For the app's own features, the only things that leave your phone are anonymous lookups to Open Food Facts — the barcode you scan, and a product's photo and details if you open them. Nothing that identifies you goes with any of them. Google Play handles installs, subscriptions, ratings and updates under Google's own terms.

If that's all you wanted to know, you're done. The rest is detail.

Who we are

Basket Vitality is built by TheDevSpot, based in the Netherlands. For anything privacy-related, contact privacy@basketvitality.com.

Under the GDPR we are the data controller for the very limited processing described below. For everything stored on your device, you hold the data — we have no copy and no access.

What stays on your phone

All of it, in practice:

Receipts you scan, including the photo, the parsed line items, the store, the date and the totals.
Transactions, whether you typed them in or imported them from a bank statement file.
Bank statement imports — the file you choose is parsed on the device.
Budgets, categories, recurring charges and any notes you add.
Product and nutrition data matched to your items, and the health and environmental scores derived from them.
Your PIN (stored only as a salted hash) and your biometric preference.

This is stored in an encrypted database on your device, using AES-256. The encryption key is itself protected by the Android Keystore, unlocked by your PIN or biometrics. If someone takes your phone and pulls the app's files off it, they get ciphertext.

A consequence worth stating plainly: if you forget your PIN and have no fingerprint or face enrolled, your data cannot be recovered — by anyone, including us. There is no reset email, no support backdoor, no spare key. The lock screen offers an explicit “Forgot PIN?” path that erases everything on the device and starts the app over; that erase is the only way forward, and it is irreversible.

We never receive any of this. There is no account to sign into, no sync, and no backup we hold.

What leaves your phone

For the app's own features, one thing. Google Play and Google's libraries are covered further down.

Product lookups (Open Food Facts)

When a product isn't in the database bundled with the app, you can tap Look up online, and only then do we ask Open Food Facts about it. The request contains only the product's barcode — a number identifying the product, not you. It carries no device identifier, no account, no location, and nothing about your basket, your budget or your other items.

Open Food Facts is an independent open database. Their servers will see the request, including the IP address your phone connects from, as any web request would. We do not send them anything else, and we do not receive anything about you from them.

The request identifies the app in its User-Agent header so Open Food Facts can see which application is calling — this is their published etiquette for API users, not a tracking mechanism.

If you open a scanned product's detail, its photo, ingredients and additive list are fetched from Open Food Facts in the same way — again keyed only by the product, never by you, and only for a product you chose to look up. Nothing about your visit is recorded beyond the ordinary web-server log of the request.

The product database

The product and nutrition database ships inside the app and is updated when the app updates through Google Play. The app doesn't download it separately.

Analytics, telemetry and Google

We run no analytics, no advertising, no tracking and no telemetry, and we receive nothing about how you use the app.

Google libraries used in the app can send usage data to Google. Since version 1.1.7 we have switched that off, and we check it with a network capture of the release build.

Correction, 4 November 2026. Versions before 1.1.7 sent this usage data to Google, and this policy wrongly said no such data was sent. We never received it ourselves. Please update to 1.1.7 or later.

Google Play handles installs, subscriptions, ratings and updates under Google's own terms.

If the app crashes, a structured report (the technical error and app version — never your receipts, transactions, or health data) is stored only on your phone. You can view, share, or delete these reports under Settings → Crash reports. Nothing is ever sent automatically; a report reaches us only if you tap Share and choose where to send it.

Permissions we ask for, and why

Permission	Why
Camera	To photograph receipts and scan barcodes. Images are processed on the device and stored encrypted; they are never uploaded.
Internet	Only for the product lookups above.
Biometrics / Fingerprint	To unlock the app, if you choose to enable it. Your fingerprint or face never leaves the Android system; the app only receives a yes/no.

The app requests no location, no contacts, no SMS, and no access to your photo library.

Text recognition happens on your device

Reading the text off a receipt uses Google's ML Kit text recognition, running entirely on your phone with a model bundled in the app. Your receipt image is not sent to Google or to us in order to be read.

Payments

If you subscribe to a paid plan, the payment is handled entirely by Google Play Billing. We never see your card details. The app only learns whether your subscription is active. Google's handling of your payment data is covered by Google's privacy policy.

Bank connections

Basket Vitality does not connect to your bank. Statement importing works on a file you export from your bank yourself and choose to open in the app; the parsing happens on your device.

Direct bank connections are planned for a later release. If and when that ships, this policy will be updated before the feature is available, and connecting an account will be something you explicitly opt into.

This website

This website has no analytics, no cookies and no third-party resources. It's hosted on Cloudflare, which processes your IP address to deliver the pages, as any web host does.

The shopping-list checker runs in your browser. It downloads a public product list and searches it on your device. What you type stays on the page. We don't store it, and it isn't sent anywhere unless you use Search online.

Search online only runs when you tap it, for one line of your list. The words on that line go to a small service on this website, which asks Open Food Facts and returns the results. Open Food Facts sees our service, not your IP address. We don't log your search. The results are cached for up to a day under a code derived from the search words, without your IP address, so repeat searches don't have to ask again.

Links to Open Food Facts open their website, where their own terms apply. If you email us, we use your message to reply.

Your rights

Because your data lives on your device and we hold no copy, most GDPR rights resolve directly in the app rather than by writing to us:

Access and portability — Settings → Export Data (CSV) gives you your transactions in a standard, portable format.
Erasure — Settings → Danger Zone → Clear all data permanently deletes everything: the encrypted database, its encryption keys, your PIN, your receipt images and your preferences. The app returns to first-launch setup. The same erase is offered from the lock screen (“Forgot PIN?”) for anyone locked out. This is immediate and irreversible; because there is no cloud copy, there is nothing left for us or anyone else to recover.
Rectification — you can edit or delete any receipt, transaction, budget or category at any time, and remove a whole bank account together with every statement and transaction imported under it.

Uninstalling the app also removes all of it. Because your data never leaves your device, there is no “request deletion” step and no one to email: erasing your data is entirely in your hands — inside the app, or by uninstalling.

You have the right to lodge a complaint with a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Children

Basket Vitality is not directed at children and we do not knowingly process children's data. Since we hold no data at all, there is nothing for us to delete on request — clearing the app's data removes everything.

Changes to this policy

If the app starts doing something materially different with data — a new outbound connection, optional crash reporting, bank connections — this policy will be updated before that ships, and the change will be called out in the app rather than quietly edited here. The last-updated date above always reflects the current version.