Privacy policy

1. Data controller

SmartCode AS is the data controller for the personal data in FrostTrack. Please send any privacy questions to post@smartcode.no.

2. Data we process

• Account: email address, name and a user ID from signing in with Apple or Google, and the display name you choose.
• Content you add: places, units, items, quantities, dates, shopping lists, chosen dinners and the emergency preparedness checklist.
• Households and sharing: who is a member of your households, and invitations you send or receive.
• Photos of units: photos you take of the contents of a unit are stored and shown to the household.
• Receipts: photos, screenshots and PDFs are sent to the AI service to read the items. They are not stored.
• Voice: your phone (Apple or Google) converts what you say into text. Only the text is sent to us and the AI service to interpret the command. Neither audio nor text is stored.
• Barcodes: the barcode is looked up in product databases. The product information is stored in a shared product catalogue that contains no information about you.
• Subscription: whether you have an active subscription, which plan and when it renews. Payment is handled by Apple or Google – we never see your payment details.
• Use of AI features: how many times you have used each feature per day and month, to enforce usage limits.
• Referrals: your referral code, who has used it, and rewards.
• Improvement suggestions: the text you send, app version, platform and language.

3. What we don’t do

• We don’t show ads and we don’t use any ad networks.
• We don’t track you across apps and websites, and we don’t use any analytics tools.
• We never sell or rent out information about you.
• The website frosttrack.app does not use cookies.

4. Purposes and legal basis

We process the data to provide the service you have asked for: keeping track of your items, syncing between phones, sharing with your household, reading receipts and dates, suggesting dinners and interpreting voice commands. The legal basis is our contract with you (Article 6(1)(b) GDPR).

We also use data to secure the service, prevent misuse (for example limits on AI features and referral rules) and handle improvement suggestions. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).

The camera, microphone, speech recognition and photos are only used when you give your phone permission and choose to use them.

5. Processors and third-party services

We use the following services to run FrostTrack. They process data on our behalf and according to our instructions, or as independent services you use through the app:

• Supabase – database, sign-in, photo storage and server functions.
• Anthropic (Claude) – AI that reads receipts and dates, suggests dinners and interprets voice commands. Under Anthropic’s API terms, the data is not used to train models.
• RevenueCat – keeps track of subscriptions and purchases.
• Apple and Google – sign-in, payment, speech recognition and app distribution.
• Kassalapp and Open Food Facts – product databases. Only the barcode is sent.
• GitHub – improvement suggestions are published as issues in our project. Your name and email are not sent, only a pseudonym.
• Vercel – hosts the website frosttrack.app (standard server logs).

6. Where the data is stored

The app’s data is stored with Supabase in EU (eu-west-1).

7. Transfers outside the EEA

Some service providers, including Anthropic, RevenueCat, GitHub and Vercel, are based in the United States. Such transfers are made on the basis of the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

8. Retention and deletion

We keep your data for as long as you have an account. You can delete your account at any time in the app under Settings → “Delete account”. This deletes your account, the households you own with all their content, and the photos in them.

Items you have added to households owned by others remain in those households. Improvement suggestions on GitHub remain, but without any information about you. Purchase history held by Apple, Google and RevenueCat is subject to their own rules and accounting obligations.

9. Your rights

You have the right to access the data we hold about you, and to have it corrected, erased or provided to you in a portable format (data portability). You may also object to processing or ask for it to be restricted. Write to post@smartcode.no and we will respond within 30 days.

If you believe we are processing your data in breach of the law, you can lodge a complaint with the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or the data protection authority in your country.

10. Children

FrostTrack is not designed for children under 13. Children may use the app as members of a household owned by an adult.

11. Security

All traffic is encrypted. Each household is isolated so that only its members can access its content, and access is checked on the server.

12. Changes

We update this policy when the service changes. We will notify you of significant changes in the app. The date at the top shows when it was last updated.