Handlekurv
PRIVACY

Privacy Policy

This policy covers Handlekurv for iPhone and the web. It explains what information is processed when you use the service, why, and what rights you have.

Last updated: 26 September 2026

Controller and contact

The controller is Sander Barsnes Torvik. Contact us at support@sandertorvik.no with any privacy question.

Information we process

Account. Email address, user ID, creation time and, if set, a display name. If you sign in with Apple or Google, we receive an identifier and the details that service shares, such as name and email. Apple may give us a private relay address instead of your real email address.

Content you create. Shopping lists, items, quantities, check-offs, categories, folders, recipes, ingredients, notes, recipe links and dinner plans. We also store who is a member of a list, invited email addresses and when recipes were added to a shopping list.

Support requests. If you contact support, we process your email address and what you write.

Technical data. When the app and website are used, our hosting providers process IP addresses, timestamps, requests and error messages to deliver and secure the service.

Purposes and legal bases

Providing the service – your account, storage, sync, sharing, confirmation and password emails, and the AI features you choose to use. The legal basis is our agreement with you (GDPR Art. 6(1)(b)). Without your account details we cannot create your account or sync your content.

Invitations – when someone invites you to a list, we store the email address you were invited with so you get access when you sign in. The legal basis is legitimate interest (Art. 6(1)(f)): the user’s interest in sharing a list with you. We store only the email address, never use it to contact you, and you can ask us to delete it at any time.

Security, troubleshooting and support – protecting the service from misuse, fixing problems and answering requests. The legal basis is legitimate interest (Art. 6(1)(f)) in a safe, working service. We use only the information needed.

Usage statistics on the web – only with your consent (Art. 6(1)(a)). You can withdraw consent in Settings at any time; this does not affect processing before you withdrew it.

Sharing with other users

Members of a list can see the list and its recipes. Display names or email addresses may appear in the member list.

Anyone with a recipe’s sharing link can open it and save a copy. Copies others have already saved are not deleted when you delete the original or your account. Only share what you want recipients to have.

AI features

When you use an AI feature, our server sends what is needed to OpenAI: item names for categorisation, the text of a recipe page or the photo you choose for import, and recipe names, ingredients and usage history for dinner plans. When importing from a link, the server fetches the page you provide.

The photo is used only to read the recipe and is not stored in our database – the recipe text and ingredients are. OpenAI does not use data sent through its API to train models, and deletes it after up to 30 days (the period it keeps data to detect abuse). Avoid sending photos or text containing personal information that isn’t part of the recipe.

Categories and dinner suggestions are suggestions you can change. They are not automated decisions with legal or similarly significant effects on you.

Service providers and international transfers

We use these providers, who process information on our behalf:

  • Supabase – sign-in, database and sync. The database is hosted in Ireland (EU).
  • Netlify – website and server functions.
  • OpenAI – AI features, only when you use them.
  • Resend – sending account confirmation and password reset emails.
  • Cloudflare – domain and forwarding of support email.
  • Google – Sign in with Google (if you choose it), web fonts on the website, Google Analytics (only with consent) and the support inbox.
  • Apple – Sign in with Apple (if you choose it).

Several providers are US companies, so information may be transferred to the United States. These transfers rely on the EU Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework. Contact us to learn more about the safeguards.

Local storage and usage statistics

The app stores your sign-in, settings and a local copy of your content on your device so it works and loads quickly. On the web, browser storage and a cache serve the same purpose. Clearing browser data signs you out and resets local choices.

The website uses Google Analytics only if you consent. It records page views with general page types – never list or item names, list IDs, sharing links or searches. Google Analytics sets a cookie lasting up to 2 years. Event data is deleted after 2 months, and data linked to the anonymous user identifier is deleted after 14 months without activity. Ad personalisation and Google Signals are turned off.

The iPhone app contains no analytics. The support and privacy pages load no analytics or external fonts.

How long we keep information

  • Account and content are kept until you delete the content or your account. We do not automatically delete inactive accounts.
  • Deleting your account: in the iPhone app, go to Settings → Account → Delete my account. This deletes your account, the lists you own and the recipes you created – including for people you share them with. Contact us if you cannot access your account.
  • Invitations are kept until they are used, the owner removes them, or the list is deleted.
  • Support requests are deleted no later than 12 months after the case is closed.
  • Operational logs at our providers are kept briefly, normally from a few days to a few weeks.
  • Backups: the database has no separate backups, so what you delete is removed from the database straight away.

Your rights

You can ask to access, correct or delete your information. Depending on the processing, you can also ask us to restrict it, receive your data (data portability) and object to processing based on legitimate interest. Email support@sandertorvik.no. We may ask for information to confirm your identity, and we reply within 30 days.

You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live or work in the EEA. You don’t need to contact us first.

Children

Handlekurv is not intended for children under 13, and we do not knowingly collect information about them.

Changes

We update this policy when our processing changes and show the date of the latest change at the top. For significant changes, we will let you know in the app or on the website.