Privacy Policy

Effective date: 6 October 2026

Basket ("Basket," "we," "us") is operated by Nordic Raven Solutions ("we," "us," "our"). This policy explains what data Basket collects, why, and what rights you have over it.

Basket is a household grocery and pantry management app: it lets you and the people in your household keep a shared list of staples, check what's actually in stock using your phone's camera, and build shopping lists together. Basket also has optional social features built on top of that -- generating and saving recipes, choosing to make a recipe visible beyond your household, following other users, and commenting on recipes others have made public -- described below alongside everything else we collect.

1. What we collect

Account data. When you sign up, we collect your email address and (for email/password sign-up) a password, which is stored securely by our authentication provider (Supabase) and never visible to us in plain text. If you sign in with Google, we receive your email and profile information from Google. We also ask everyone for a display name (and, optionally, an emoji) shown to other Basket users, not just your household (see "Public profile & social content" below).

Household data. The staples you track, the shopping lists you build, and the names of the household(s) you create or join. This data belongs to the household as a shared unit, not to any one person, and is visible to every member of that household.

Public profile & social content. Separately from household data, Basket has social features that are visible beyond your household: your profile (display name, emoji), the recipes you create, any photos you attach to a recipe, comments and reviews you post on recipes, and your follow relationships (who you follow, who follows you). Each of these has its own visibility setting, changeable any time in Settings → Privacy:

• Your profile is visible to everyone by default.
• Favorites and your default recipe visibility are set to only you by default.
• Your pantry/stock level ("hoard level") is set to household-only by default.

When something is set to "everyone," any Basket user can see it, not just your followers or household. Public recipes go through a review step before they're shown to other users; we may reject or remove content that violates these Terms.

Photos. Basket handles two kinds of photos differently.

• Check Stock photos -- when you photograph your fridge, freezer, or pantry to check what's in stock, that photo is sent directly to Google's Gemini API for analysis and is not stored by us. It's not saved to disk, not saved to our database, and not kept anywhere on our servers after the analysis request completes. Only the result (e.g. "milk: present," "eggs: missing") persists, as plain text, not the image.
• Recipe photos -- a photo you choose to attach to a recipe you create is stored, the same as any other content you add to that recipe, since it's something you're deliberately saving (and, depending on that recipe's visibility setting, potentially sharing). Deleting your account deletes your recipes and any photos attached to them.

Recipe generation. When you generate a recipe, we send Google's Gemini API a text description of what you're looking for -- which can include your household's pantry staples, any allergens or dietary preferences recorded for your household, and any notes you type -- purely to generate the recipe. This is separate from the Check Stock photo flow above; no image is involved. We also use a second AI provider, Groq, for a smaller, faster task: matching the text you type against our known grocery-item vocabulary as you type a staple name. Groq receives only that in-progress text, not your pantry list, allergens, or any other household data.

Nutrition tracking. If you choose to use Basket's personal nutrition tracker (an optional feature under your own profile's Activity section, not part of household data above), we additionally collect your sex, height, current weight, and activity level, plus a log of the foods you tell us you ate and their nutrient values. This data is private to you specifically: it is never visible to anyone else, including other members of your household, and is used only to compute your own personal daily nutrient targets and track your own intake against them. If you search for a food that isn't already in our catalog, the food name you typed is sent to Google's Gemini API to estimate its nutrition facts (governed by the same Gemini terms as recipe generation above) -- your biometrics, food log, and other personal data are never included in that request. Deleting your account deletes all of this data immediately, same as your recipes and photos.

Push notifications. If you allow notifications, we generate a device push token (via Expo's push notification service) and store it linked to your account, so we can send you notifications. This token is removed when you sign out or delete your account.

Subscriptions. If you subscribe to a paid plan, the payment itself is processed by the App Store or Google Play. We never see or store your card details. We use RevenueCat to keep track of your subscription status (whether a plan is active and when it renews or expires): it receives your purchase and renewal events and an opaque account identifier, never your name, email, or household content. See the subprocessor table below.

Sharing. If you use Basket's share feature on a list or recipe, we generate a public, unauthenticated preview (a link and, for some destinations like Instagram Stories, an image) so it can be displayed as a link preview or shared to a third-party app. Anyone with that link, or any platform that fetches its preview (e.g. Instagram, Slack), can see the title and content you chose to share. If you share directly into a third-party app, the content you chose to share is handed to that app, governed by its own terms -- Basket doesn't control what happens to it after that.

Technical data. Standard operational data our infrastructure providers generate in the course of running the service (e.g. server request logs), used only for debugging and keeping the service running.

Product analytics. We track a small number of specific in-app actions (e.g. "signed up," "ran a Check Stock check," "saved a shopping list") to understand how Basket is actually used and where people get stuck -- not raw clicks or screens, only these named events, and no automatic screen-by-screen tracking. Two of these events include the grocery item name involved (when you add or remove a staple from your list, e.g. "milk") so we can see in aggregate which items people wish were on the default starter list and which ones aren't wanted. Like every analytics event, these are linked to the same internal, opaque account ID as everything else in this section -- not your email, name, or household -- and we only look at them in aggregate across everyone, not to see what any one person added or removed. This data is hosted in the EU (see PostHog in the subprocessor table below), specifically so it never has to leave the EU at all.

2. Who we share data with (subprocessors)

We use a small number of third-party services to run Basket. We don't sell your data to anyone, and we don't use it for advertising.

If you use the in-app share feature to share directly to a third-party app (e.g. Instagram), that app receives the content you chose to share -- see "Sharing" above. That app isn't a subprocessor of ours; it's a destination you picked.

3. Your rights

Since we operate from Denmark, GDPR applies to everyone who uses Basket, not just EU residents. You have the right to:

• Access the data we hold about you.
• Correct inaccurate data (most of this you can already do yourself, in-app, under Settings).
• Control who can see your content. Profile, recipe, favorites, and pantry-level visibility are all separately configurable in Settings → Privacy at any time.
• Delete your account and personal data. This is built directly into the app: Settings → Delete My Account. This permanently removes your sign-in and profile, your recipes and any photos/comments/reviews attached to them, and your follow relationships. It does not delete a household's shared staples or shopping lists if other members still rely on them -- only your own personal account/identity and your own social/recipe content is removed.
• Export your data, or ask us to stop processing it, by contacting us (below).

4. Children

Basket is a household app, and we expect kids to genuinely use it -- taking Check Stock photos, checking off shopping lists -- as part of normal household use, even though accounts are created by an adult. We do not knowingly collect account-creation data (email, password) directly from children without a parent or guardian's involvement in setting up the household. If you believe a child has an account that wasn't set up with appropriate parental involvement, contact us and we'll address it.

Basket's social features (public profiles, following, comments) mean a child's account is not necessarily confined to their own household the way it would be in a purely household-scoped app. To address this, everyone is asked their birth year once, during account setup. An account that declares a birth year putting it under 15 -- Denmark's own digital-consent age for information society services since a 1 January 2024 law change (raised from 13), our own jurisdiction -- is automatically restricted: its profile, recipes, and any Eatlists can only ever be set to visible within your own household or to only you, never to "everyone" or "followers," and this restriction cannot be turned off from inside the app. The same declared age also opts the account out of our analytics tool (PostHog) entirely -- no events are sent for that account until the declared age changes. This is a self-declared check, not an identity-verified one -- we ask, we don't verify. Parents/guardians should still review Settings → Privacy with any child using the app.

5. Data retention

We keep your data for as long as your account is active. If you delete your account, your personal identity (email, name, login), your recipes and any photos/comments/reviews/follow relationships tied to it are removed immediately. Shared household data (staples, lists) persists only as long as it's useful to any remaining household members, and is never linked back to a deleted account's personal information.

6. If something goes wrong

If we discover a security incident that results in unauthorized access to, loss of, or exposure of your personal data, we'll notify you by email at the address on your account -- without undue delay, and in any case within the timeframe GDPR requires. That notice will explain what happened, what data was involved, what we're doing about it, and what you can do to protect yourself. If an incident affects the service broadly rather than a single account, we'll also post a notice inside the app. Where GDPR requires it, we'll also notify the relevant data protection authority within 72 hours of becoming aware of a breach.

7. Changes to this policy

If this policy changes in a material way, we'll update the effective date above and, where required, notify you directly.

8. Contact

Questions, data requests, or concerns: privacy@nordicravensolutions.com